Alternatives to Hiring a CRA Authorised Representative: Providers & 2026 Prices

• CRA Article 18 requires a representative for non-EU manufacturers selling in the EU
• EU-based manufacturers do not need an authorised representative
• Importers or distributors can act as representatives if appointed
• Verified 2026 prices range from €490 to €999 per year
• Mandate covers only representation, not conformity assessment or testing
• Non-EU B2B and B2C sellers of digital products usually need this service

Updated 18 October 2026 · 7 sources checked

Providers compared

Prices as published on each provider's website on 18 October 2026, excluding VAT unless stated. Each row links to its source.

What the Cyber Resilience Act Requires (with Article Numbers)

The Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) is a comprehensive regulation that sets mandatory cybersecurity requirements for all products with digital elements placed on the EU market. The law applies to both new and existing products, and its obligations cover the entire product lifecycle, from design and development to maintenance and end-of-life. The CRA entered into force on 10 December 2024 and becomes fully applicable from 11 December 2027.

Article 18 is central for non-EU manufacturers: it requires those established outside the EU to appoint an authorised representative established within the EU. This representative acts as the official contact point for market surveillance authorities and is responsible for forwarding communications and documentation. If you are an EU-based manufacturer, you do not need to appoint a representative. However, if you are a non-EU manufacturer, you must either appoint a representative or have an importer or distributor willing to formally take on this role. The appointment must be in writing and clearly documented.

Article 14 introduces a strict 24-hour reporting requirement for actively exploited vulnerabilities or severe incidents affecting product security. Manufacturers must notify ENISA (the European Union Agency for Cybersecurity) within 24 hours of becoming aware of such an event, followed by a full notification within 72 hours and a final report within 14 days. The deadlines are in calendar hours, not working hours, and the reporting platform is managed by ENISA. The duty falls on the manufacturer, not the importer or distributor, unless they have placed the product on the market under their own name.

Article 53 sets out the penalties for noncompliance, which can reach up to €15 million or 2.5% of global annual turnover, whichever is higher. The CRA is enforced through CE marking and market surveillance, and applies to all products with digital elements available in the EU, regardless of where the manufacturer is based.

• Article 18: Authorised representative for non-EU manufacturers
• Article 14: 24-hour vulnerability reporting
• Article 53: Fines and enforcement

For more on the legal text, see the official EU summary.

How to Choose a CRA Authorised Representative

Choosing the right CRA authorised representative is a critical step for non-EU manufacturers. The representative serves as your official presence in the EU for regulatory and market surveillance matters. Here are the key factors to consider:

• Legal Entity and Location: Ensure the provider is a registered legal entity in the EU. For example, REP27 — Europe Services, SE is established in Prague, Czech Republic, and is verifiable in the Czech commercial register.
• Transparency of Pricing: Look for providers who publish both first-year and renewal prices clearly. REP27, for instance, lists €490 for the first year and €440 for renewal, with lower rates for bundled mandates. Many providers do not publish renewal prices, which can lead to unexpected costs.
• Scope of Service: Check what the mandate actually includes. The Article 18 mandate should cover the written appointment, a verifiable certificate, and a request desk for forwarding authority communications. Some providers may claim to offer more, but by law, the representative cannot perform conformity assessment or product testing—these are outside the scope of Article 18.
• Verification and Documentation: A good provider offers a certificate with public verification (e.g., QR code), ensuring that authorities and buyers can easily confirm your compliance.
• Exclusions and Limitations: Reputable providers will clearly state what is not included, such as conformity assessment, SBOM generation, or incident response. This transparency helps you avoid misunderstandings and hidden costs.

Below is a summary comparison of what’s included and excluded by each provider (where known):

Always ask for written confirmation of scope, exclusions, and renewal terms before signing.

What the Price Really Includes

The cost of a CRA authorised representative is often the smallest line item in your overall compliance budget, but it is essential to understand what you are actually buying. The published price for a CRA representative covers only the Article 18 mandate. This typically includes:

• A written appointment of the representative in the EU
• A certificate of appointment, often with a QR code or public verification page
• A request desk to receive and forward communications from EU authorities, including market surveillance and CSIRTs

What is not included in the price:

• Conformity assessment (required for important class II and critical products; handled by notified bodies, not representatives)
• Security testing or SBOM (Software Bill of Materials) generation
• Incident response or engineering work
• Reporting to ENISA (the representative forwards, but does not author or submit your reports)

Bundled services may be available for GDPR Article 27, NIS2, or GPSR mandates, often at a discount. For example, REP27 offers combined CRA and GDPR representation for €690/year, or all three (CRA, GDPR, NIS2) for €990/year. Always check if the renewal price is fixed or subject to change, and whether the provider charges extra for switching from another representative.

Here is a summary of published prices and inclusions:

Providers are required to state the legal entity that signs the mandate. Always verify this before payment.

Hidden Costs and Exclusions

While the fee for a CRA authorised representative is usually clear, the real costs of CRA compliance are often hidden elsewhere. The most significant expenses are internal and relate to engineering, documentation, and ongoing product support:

• Conformity Assessment: For important class II and critical products, a notified body must conduct a conformity assessment. This process can cost thousands of euros and take months to complete. Representatives do not provide this service.
• Security Testing and SBOM: Generating a Software Bill of Materials and conducting security testing are technical requirements that must be handled by your engineering team or external security firms. No representative includes these in their mandate.
• Support Period: The CRA requires manufacturers to provide security updates for at least five years. Budget for ongoing maintenance and patching as a product line, not a one-off project.
• Incident Response: While the representative can forward vulnerability reports, the manufacturer remains responsible for incident investigation, reporting, and remediation.
• Silent Renewals and Price Increases: Some providers do not publish renewal prices or may increase fees without notice. Always get the renewal price in writing before signing.

Below is a summary of what’s included and excluded by each provider, based on available information:

To avoid surprises, always ask for a complete list of exclusions, notice periods for termination, and any per-request or administrative fees.

How Appointment Works: Step by Step

Appointing a CRA authorised representative is a straightforward process, but it must be handled carefully to ensure compliance. Here is a step-by-step guide:

1. Determine Applicability: Confirm whether your company is established outside the EU and if you place products with digital elements on the EU market. If you are an EU-based manufacturer, you do not need a representative.
2. Choose the Route: Decide whether to appoint a CRA authorised representative, or if your importer or distributor will take on this role. This must be agreed in writing.
3. Select a Provider: Compare providers based on published prices, scope, and transparency. Request written confirmation of what is included and excluded.
4. Sign the Mandate: The provider will issue a designation letter, usually signed electronically. This document should clearly state the scope and legal entity involved.
5. Receive the Certificate: Obtain a certificate of appointment, ideally with a QR code or public verification page, to include in your technical documentation and compliance files.
6. Update Documentation: Add the representative’s details to your technical documentation, runbook, and any procurement materials.
7. Prepare for Reporting: Set up your vulnerability reporting process to meet Article 14’s 24-hour deadline. Ensure you know how to contact your representative and the ENISA platform.

Checklist for Today:

1. Map your product portfolio for CRA coverage
2. Identify your EU sales channels (direct, via marketplace, via distributor)
3. Decide who will act as representative (if required)
4. Request written confirmation of provider’s price, scope, and renewal terms
5. Prepare your vulnerability reporting process and assign responsible staff

Timely appointment and clear documentation are essential to avoid delays in market access or regulatory action.

Risks and Fines for Noncompliance

Noncompliance with the CRA’s representative requirement can have serious consequences. Under Article 53, fines can reach up to €15 million or 2.5% of global annual turnover, whichever is higher. These penalties apply if you fail to appoint a representative when required, or if you do not meet reporting and documentation obligations.

Risks of noncompliance include:

• Regulatory Fines: Substantial financial penalties can be imposed for failing to appoint a representative, missing vulnerability reporting deadlines, or lacking proper documentation.
• Market Access Delays: Without a representative, you may face delays in procurement, certification, or sales cycles, as buyers and authorities require proof of compliance.
• Incident Response Failures: If you cannot respond to market surveillance or CSIRT requests within the required timeframes, you risk further penalties and reputational damage.
• Procurement Barriers: Large buyers and distributors may refuse to work with manufacturers who cannot demonstrate a valid representative mandate.
• Liability Remains with Manufacturer: The representative is a contact point only; all legal responsibility for product compliance, security, and incident response remains with the manufacturer.

To mitigate these risks, ensure your appointment is documented, your reporting processes are robust, and your compliance files are up to date. The representative’s role is to prevent delays and miscommunication during incidents—not to absorb liability for your products.

Decision Matrix: Do You Need a CRA Authorised Representative?

Use the following matrix to determine if you need to appoint a CRA authorised representative:

For marketplaces, always confirm in writing whether the platform acts as importer of record. If not, you are responsible for appointing a representative.

What Providers Usually Do Not Say

There are several aspects of CRA representation that providers may not highlight in their marketing materials:

• Scope Limitations: The Article 18 mandate covers only representation—no conformity assessment, SBOM, or incident response. Any claim to include these is misleading.
• Renewal Pricing: Many providers do not publish renewal prices, leading to silent or unexpected increases. Always get renewal terms in writing.
• Liability: The representative does not absorb legal responsibility for product compliance or security incidents. The manufacturer remains fully liable.
• Notice Periods and Termination: Terms for ending the agreement or switching providers are often not disclosed. Ask for these details before signing.
• Per-Request or Administrative Fees: Some providers may charge extra for handling specific requests or urgent communications. Always clarify if such fees apply.
• Language and Availability: The ability to handle authority requests in multiple languages and outside business hours varies. REP27, for example, offers a 24-hour staffed desk, but others may not.

Transparency is key—request a full list of exclusions, limitations, and terms before making a decision.

Realistic Scenarios: What Route to Take

• US SaaS company selling to EU businesses: As a non-EU manufacturer placing digital products on the EU market, you must appoint a CRA authorised representative. You also need a GDPR Article 27 representative. The simplest and most cost-effective route is to use a provider like REP27 that offers both mandates in a bundle, ensuring a single point of contact and clear renewal pricing.
• Chinese Amazon seller: If Amazon acts as the importer of record, you may not need a separate CRA representative. However, if you sell directly or via a marketplace that does not take on this role, you must appoint a CRA authorised representative. Always confirm the marketplace’s role in writing to avoid gaps in compliance.
• UK online shop selling IoT devices to EU consumers: Post-Brexit, UK-based manufacturers are considered non-EU. If you sell directly to EU consumers or via distributors who do not act as your representative, you must appoint a CRA authorised representative. If a distributor or importer places the product on the EU market under their own name, they can act as the representative instead.

In each scenario, the key is to document the arrangement, update your technical files, and ensure your reporting processes are ready for the 24-hour vulnerability notification requirement.