Short answer: usually the client whose name the app is published under, not the agency that wrote it.

The CRA's manufacturer is the person who develops a product or has it designed or developed , and markets it under its name or trademark (Article 3(13)).

An agency becomes a manufacturer when it markets an app under its own name, supplies its own reusable code or white-label product to clients, or substantially modifies an app and makes it available itself (Article 22).

A contract can decide who does the compliance work. It does not move the legal duties of Articles 13 and 14 away from the manufacturer.

That gap is a service opportunity: the client carries the obligations, and the agency is often the only party able to fulfil them day to day.

What the regulation says

Article 3(13) of the Cyber Resilience Act defines the manufacturer as "a natural or legal person who develops or manufactures products with digital elements or has products with digital elements designed, developed or manufactured, and…