The container never cleared the terminal. It sat on the apron at a northern-European port for the better part of two weeks, a sealed forty-foot box of industrial cellular gateways bound for a distributor's warehouse, while a national market-surveillance lab took three sample units apart and read their firmware. What the lab found was not a bug. It was a service, listening on a high port, that accepted a fixed username and a password baked into the image. Nothing in the product's documentation mentioned it. Nobody was supposed to find it.
The importer of record learned about it the way importers usually do: a letter, not a phone call. By the time the letter arrived, the decision had been made somewhere upstream of them, in a building they had never dealt with, about a defect they had never seen. Their stock was not going to move.
That scenario is composite, not a named case. But every mechanism in it is real and already law, and the point of walking through it is to show where an importer's control actually sits. It is much earlier than the port.
A hidden access path is not a close call
Most CRA non-conformance is arguable. Reasonable engineers can disagree about whether a logging default was adequate, whether an update mechanism was timely, whether a given interface needed hardening. Those are risk judgments, and the essential requirements let you make them against a documented assessment.
A deliberate, undocumented access path is a different animal. It fails the essential requirements in Annex I, Part I on its face, and it fails several of them at the same time. The product is meant to be placed on the market without known exploitable vulnerabilities; a hardcoded credential is one, and whoever built the image knew it was there. The product is meant to ship in a secure-by-default configuration; a listening service with a fixed password is the exact inverse of that. And the product is meant to protect against unauthorised access through real control mechanisms; a backdoor is a channel built to defeat those controls. An assessor does not have to weigh risk here. The finding writes itself.
There is a further reason a backdoor moves faster than an ordinary defect. The national procedure turns on whether a product presents a significant cybersecurity risk, and a remotely reachable authentication bypass in networking gear is close to the textbook example of one. It is not a theoretical weakness a future attacker might chain into something worse; it is a working entry point, shipped, in equipment that sits on other people's networks. An authority does not have to speculate about the impact. The impact is the feature.
That distinction matters for how the rest plays out. An arguable defect buys you a conversation. A backdoor buys you a procedure.
What the authority is allowed to do
The CRA did not build a new border force. Under Article 52 it routes product-security enforcement through the machinery the Union already runs for unsafe goods, the general market-surveillance regulation, Regulation (EU) 2019/1020. Importers tend to picture that machinery as a paperwork desk. It is a good deal more.
Market-surveillance authorities cooperate with customs, and customs can hold a consignment at the external border while an authority decides whether it may enter. Goods do not have to reach a shelf to be stopped. A product can be intercepted at the point it crosses into the Union, which is exactly the leverage the opening scene turns on.
Authorities can also acquire samples and examine them, physically. Firmware extraction and board-level teardown are ordinary market-surveillance technique, not exotic overreach. The exact lab, the method, and the threshold that triggers a deeper look are set nationally and vary by Member State, so treat the specifics as country-dependent rather than uniform. What does not vary is the principle: an authority is entitled to look inside the thing, not only at the paperwork attached to it.
And the paperwork is its own exposure. Under Article 53, on a reasoned request, an authority can compel the data it needs to assess how a product was designed, developed, produced, and how its vulnerabilities are handled, in a language it can read, including internal documentation. For a hidden service, that request is a bind you cannot think your way out of. Either the documentation discloses the access path, in which case you shipped a known backdoor knowingly, or it does not, in which case your own file confirms the product does not behave as documented. Both readings are findings.
From a finding of significant cybersecurity risk, the authority runs the national procedure in Article 54: it evaluates, it orders you to bring the product into compliance, withdraw it, or recall it, and if you stall it takes the measure itself and notifies every other Member State that it has done so. That ladder, the clocks attached to each rung, and how to answer the notice without compounding the problem are a subject of their own. The concern here is upstream of that letter: how you avoid being the operator it gets addressed to.
The importer is the operator the Union can reach
When the manufacturer sits outside the Union, the regulation's centre of gravity moves to whoever brought the product in. The importer places the product on the EU market, and by doing so takes on the duty to place only compliant products and to stand as the reachable, accountable economic operator inside the Union's jurisdiction. A factory in another hemisphere is hard to fine and harder to compel. The container on the apron is not. That is not an accident of the drafting; it is the design. The party that chose the supplier and profited from the import is the party the system can act against.
The reach does not stop at your warehouse, either. A remedy ordered against you runs to units already sold, so a recall can pull the product back out of your customers' hands and attach your name to the reason. The offshore maker's brand is not the one on the distribution agreement or the support contract. Yours is.
Which is why an importer's leverage is almost entirely at the purchase order, not the port. Once the box is on the water, your options narrow to the ones an authority hands you. Before it ships, you still hold all of them. You can require the supplier to disclose every listening service and every interface, contract for the right to independent firmware review, and define an undocumented access path as a breach that voids the deal. The full version of that pre-purchase discipline is the importer's due-diligence checklist. The through-line is short: you cannot inspect compliance into a product after you have already bought it.
If it helps to see the whole conformity trail assembled rather than argued about, you can walk a live conformity check, and the essential-requirement baseline an authority measures your goods against is laid out in the CRA reference.
Before the next consignment leaves the supplier's dock
Everything an importer controls happens before the goods move. Treat the following as gates on the purchase, not tasks for after delivery.
- Demand a written interface and service inventory. Every port that listens, every process that accepts a connection, every credential shipped in the image. A supplier who cannot or will not produce it has told you something.
- Buy the right to look inside. Contract for independent firmware review before acceptance, on your samples, from your lab. Acceptance testing you do not control is not a control.
- Make an undocumented access path a defined breach. Write it into the contract as a condition that voids the order and shifts the cost, so a backdoor is the supplier's problem, not your seized inventory.
- Keep the technical documentation retrievable, in a language an authority reads. The file an Article 53 request lands on should already exist, complete, on your side of the border.
- Know where each batch physically is. Which distributors hold stock and which field sites received units, so that if a remedy is ever ordered you can execute it without first spending a week finding your own product.
The authority's letter is the last point in the chain where you have no moves left. Every move you had was before the box shipped.