Location of the company is irrelevant. The regulation applies to products with digital elements made available on the EU market (Art. 2). A manufacturer in California or Tel Aviv owes the same things as one in Munich, and the EU importer who brings your product in is obliged to check that you did them.
The manufacturer obligations in Art. 13 attach to whoever develops the product and places it on the market under their name, with no exception for where that happens. For a non-EU company that means: the essential requirements of Annex I, the SBOM, the technical file of Annex VII, a conformity assessment (self-assessment for most products, see which class you are in), the EU declaration of conformity, the CE marking, a support period of at least five years, and, since 11 September 2026, the 24-hour reporting duty for actively exploited vulnerabilities under Article 14.
The enforcement mechanism for foreign manufacturers is the EU company that imports the product. Under Art. 19 an importer may place a product on the market only after confirming that the manufacturer carried out the conformity assessment, drew up the technical documentation, affixed the CE marking, provided the EU declaration of conformity and user instructions in a language users can readily understand, and met the manufacturer's identification and contact obligations. An importer who cannot confirm these things is not allowed to sell your product. In practice, the request for your technical file, your declaration and your SBOM will come from your European distributor, as a condition of the contract.
If you sell directly to EU customers online with no importer in between, there is no one else in the chain to check, which makes you the only party carrying the risk.
The CRA lets a manufacturer appoint an authorised representative in the EU by written mandate (Art. 18). The text says "may", so it is an option, not a requirement. The representative keeps the declaration of conformity and the technical documentation available for authorities and cooperates with them on the manufacturer's behalf. For a small company with no EU presence it is often the simplest way to give authorities and importers a European contact point.
Article 14 reports go through ENISA's Single Reporting Platform to the CSIRT coordinating for the manufacturer. The platform is reached through an EU Login account, which any company can create. The 24-hour clock does not pause for time zones.
Penalties are set and enforced by Member States and can reach €15 million or 2.5% of worldwide annual turnover (Art. 64). Enforcement against a non-EU company runs through market surveillance of the product itself: an authority can order a non-compliant product withdrawn from the EU market, which is the sanction that matters most to a foreign seller.
Two free tools that apply this to your case: the 2-minute applicability check (does the CRA apply to you, with the clauses) and the SBOM generator (CycloneDX + SPDX from your manifest, signed). Neither asks for an account.
Sources, primary only: Regulation (EU) 2024/2847 (EUR-Lex) · European Commission, CRA summary · European Commission, CRA reporting · ENISA, Single Reporting Platform. This is not legal advice; the regulation text controls.