Manufacturers should retain accountability for the declaration, incident response and submission, while outsourcing only the maintained evidence and workflow support. The cleanest model is to separate who owns compliance from who assembles the artifacts, so accountability never shifts even if the delivery work is shared.
How to split CRA responsibilities without losing accountability
The practical split is between decision ownership and delivery support. Internal teams should own the legal and operational judgments that make the manufacturer accountable, while a managed service provider can help prepare evidence, track obligations and route workflows. That way, outsourcing improves throughput without turning the provider into the compliance owner.
That boundary matters because the CRA is about the manufacturer’s obligations, not the vendor’s convenience. If a managed service is drafting submissions, collecting evidence or coordinating remediation, the manufacturer still needs clear internal ownership for what is declared, when it is escalated and who signs off on the final position.
A useful operating model is to treat managed services as controlled support for evidence assembly and process execution, not as the source of truth for regulatory accountability. Internal governance should define the approval path, exception handling and escalation thresholds, while the service provider executes the agreed tasks under those rules.
What should stay inside the manufacturer?
Three things should stay internal: the accountability for conformity and declarations, the incident response decision-making, and the final submission authority. Those are the points where business risk, product knowledge and regulatory exposure converge, so they need named internal owners who can answer for the outcome even if much of the operational work is delegated.
Internal ownership should also cover the interpretation of product scope, the decision to treat an issue as reportable, and the acceptance of any residual risk if evidence is incomplete. A managed service can surface information, but it should not be the party deciding whether the manufacturer has met its obligations.
Where outsourced support is used, the manufacturer should keep control of the record that proves the decision chain. That includes who reviewed the evidence, who approved the declaration, what was escalated, and what remained open at the time of submission.
What is safe to outsource, and where do the boundaries break?
Outsourcing works best for repeatable, well-specified work such as evidence collection, workflow management, tracking artefacts and maintaining submission packs. Those tasks can be standardised, measured and handed back cleanly if the contract and operating procedure are clear.
The boundary breaks when the service begins to interpret obligations, arbitrate ambiguity or act as the de facto owner of response timing. At that point, the manufacturer can lose visibility into why a decision was made, which weakens both auditability and accountability.
Managed services also need tightly defined access to product, vulnerability and incident data. The manufacturer should expose only what the service needs to perform the assigned tasks, and should retain the ability to review, override and retrieve the underlying evidence at any time.
Risk and Threat Considerations
Delegating execution can reduce workload, but it also creates concentration risk if the provider becomes the only place where evidence, workflow state or incident handling knowledge lives. That can delay reporting, blur responsibility during a fast-moving issue and make it harder to prove that the manufacturer acted on time.
Failure mechanism: The manufacturer over-relies on the managed service for interpretation, record keeping or response coordination, so the internal team loses the ability to validate decisions quickly or reconstruct who approved what.
Impact: Missed deadlines, inconsistent declarations, weak audit evidence and avoidable exposure if a regulated incident is handled as a service desk workflow instead of a manufacturer-owned compliance event.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC-01 — Organizational Context | CRA responsibility split depends on clear internal ownership and external service boundaries. |
| GV.RM-01 — Risk Management Strategy | The manufacturer must set the risk appetite for outsourcing regulatory execution work. | |
| GV.SC-04 — Supplier Risk Management | Managed services handling CRA evidence and workflows create supplier dependency and oversight needs. | |
| Recommendation — Define accountability boundaries for outsourced compliance support and retain internal decision ownership. Set a risk strategy that limits what compliance tasks can be delegated to providers. Assess and monitor provider responsibilities, access and escalation paths for regulated support work. | ||
| ISO/IEC 27001:2022 | A.5.19 — Information security in supplier relationships | Outsourced evidence and workflow support must be governed through supplier controls. |
| A.5.2 — Information security roles and responsibilities | CRA accountability must remain with named internal owners even when work is shared. | |
| Recommendation — Include managed service obligations, access limits and review rights in supplier arrangements. Assign internal owners for declarations, incident response and submission sign-off. | ||
Practitioner Guidance
What to verify: The contract and operating model should make it obvious which tasks are advisory, which are execution-only, and which decisions remain with the manufacturer. If that is not explicit, the accountability boundary is probably already too blurred to trust.
What good looks like: Internal teams can produce the final declaration, the incident timeline and the approval record without asking the managed service to reconstruct the decision for them. The provider supports the process, but the manufacturer can still explain and defend every material decision on its own.
Decision rule: If a task changes legal position, reportability or sign-off authority, keep it inside the manufacturer. If it only speeds evidence gathering, tracking or packaging, it can be outsourced under strict controls.
Practitioner takeaway: The safest CRA operating model is not “outsource compliance”, it is “outsource execution while retaining the right to decide, declare and defend.”
Related resources from NHI Mgmt Group
- How should organisations divide responsibility between internal teams and outside experts during a breach?
- How should security teams divide responsibility between IAM and IGA?
- How should security teams use managed data security services when internal staffing is too thin to cover cloud and data risk operations?
- How should security teams divide responsibility in Azure between the provider and the customer?