Best Cyber Resilience Act (CRA) Authorised Representative Services: 2026 Comparison

• CRA Article 18 requires non-EU manufacturers to appoint an EU authorised representative.
• REP27 — Europe Services, SE: €490/year, renewal €440, clear scope and exclusions.
• Euverify: GBP 590/year, price verified, details on inclusions not published.
• kadano: €999/year, price verified, inclusions not detailed.
• No provider includes conformity assessment, testing, or legal advice.
• Appointment is fast (REP27: within 24 hours); renewal terms vary.

Updated 17 October 2026 · 5 sources checked

Providers compared

Prices as published on each provider's website on 17 October 2026, excluding VAT unless stated. Each row links to its source.

What the Cyber Resilience Act Requires (Article 18, Article 14)

The Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) introduces strict obligations for manufacturers of products with digital elements that are sold in the EU. If you are a manufacturer established outside the EU, Article 18 requires you to appoint an authorised representative established within the EU. This is not optional for non-EU manufacturers: the representative acts as your legal point of contact for market surveillance authorities and coordinates vulnerability reporting under Article 14.

Article 14 imposes a 24-hour deadline to notify authorities of an actively exploited vulnerability or severe incident affecting your product's security. The representative is responsible for receiving and forwarding these notifications, ensuring you meet the regulatory clock. The reporting window is tight: 24 hours for the early warning, 72 hours for the full notification, and 14 days for the final report. The recipient is determined by the location of your representative, importer, or distributor—if you lack a representative, you lose control over the process and may face delays or enforcement actions.

It is crucial to understand what the representative's mandate includes and excludes. No provider, including REP27, kadano, or Euverify, offers technical assessment, SBOM (software bill of materials) generation, or product testing as part of the representative service. These are separate, often far more expensive, compliance steps handled by technical or security firms. The representative's role is strictly administrative and legal: holding your mandate, forwarding requests, and ensuring your reporting channel is open and verifiable.

Included / Not Included / Extra Fees Table

How to Choose a CRA Authorised Representative

Choosing the right CRA authorised representative is a critical compliance step for non-EU manufacturers. The provider you select will be your official point of contact for EU authorities, and their reliability can make the difference between smooth compliance and costly delays. Here are the key factors to consider:

• Legal Entity: Confirm the provider is a registered EU legal entity. For example, REP27 is Europe Services, SE, based in Prague and registered in the Czech commercial register since 2014. This ensures your mandate is valid and enforceable.
• Scope of Mandate: The mandate should be limited to Article 18 duties. Any provider claiming to cover Article 13 duties is exceeding what Article 18(2) allows and may be selling non-compliant services.
• Transparency of Pricing: Always request the renewal price in writing before signing. REP27 is the only provider in this comparison to publish renewal prices clearly on its website.
• Verification Process: Ask how you (and authorities) can verify your mandate. REP27 offers a QR-coded certificate with public verification; other providers do not specify their process.
• Languages and Availability: Confirm which languages the request desk operates in and what hours it is staffed. REP27 provides an 8-language desk, operating 24/7, including weekends and holidays.
• Exclusions: A reputable provider will list what is not included (e.g., legal advice, technical assessment, SBOM generation). This clarity helps you avoid misunderstandings and unexpected costs.

Decision Matrix

What the Price Really Includes

Understanding what you are buying is essential. All providers in this comparison offer a written Article 18 mandate, which is the legal minimum required for compliance. However, the scope and transparency of what is included varies significantly. REP27 details its inclusions: a signed designation letter (with eIDAS electronic signature), a verifiable certificate (with QR code and public verification), privacy notice wording in 8 languages, a request desk for forwarding authority and data subject requests within 2 business days, and retention of Article 30 records for authorities. The 24/7 reporting channel is also included, ensuring you can meet the CRA's strict reporting deadlines at any hour.

Euverify and kadano both publish their prices but do not specify, on their public pages, whether they include features such as a 24/7 request desk, multilingual support, or public certificate verification. Their published scope is limited to the Article 18 mandate itself. None of the providers include technical services such as conformity assessment, SBOM generation, or vulnerability testing—these are always external costs and must be arranged separately with technical or notified bodies.

REP27 is the only provider in this comparison to publish its renewal price (€440/year), and it offers bundled options for companies needing multiple mandates (e.g., GDPR Article 27, GPSR Article 16, or NIS2). This transparency allows you to budget accurately and avoid unpleasant surprises at renewal. Other providers do not specify renewal pricing or bundling options on their public pages.

Always ask for a detailed breakdown of what is included, what is not, and whether there are any extra fees for additional services or urgent requests. A clear, written offer is your best protection against hidden costs.

Hidden Costs and What Providers Usually Do Not Say

The published price for a CRA authorised representative covers only the legal mandate and administrative forwarding of requests. The most expensive and resource-intensive aspects of CRA compliance are not included in any provider's fee. These include:

• Conformity Assessment: For important class II and critical products, a notified body assessment is mandatory and typically costs several thousand euros, with lead times of months. This is never included in the representative fee.
• SBOM Generation: The software bill of materials (SBOM) must be generated by your own build pipeline or technical team. No representative provides this service.
• Vulnerability Testing: Security testing is the domain of specialist firms and is not part of the representative's scope.
• Support Period: The CRA requires a minimum of five years of security updates for products. Budgeting and resourcing this support period is a significant hidden cost, often overlooked by new entrants to the EU market.
• Renewal Pricing: Many providers do not publish their renewal prices, leading to unexpected increases after the first year. REP27 is the only provider in this comparison to publish renewal prices up front.
• Exclusions and Liability: The representative does not provide legal advice, answer technical questions on your behalf, or assume liability for your compliance. Article 27(5) of the GDPR (and by analogy, the CRA) makes clear that the designation does not prevent actions against the company itself.

Always request a list of exclusions in writing. If a provider is vague about what is not included, or cannot specify renewal terms, this is a red flag. The most common failure seen by REP27 is a mandate lapsing quietly due to unclear renewal processes or multiple providers with different renewal dates.

How Appointment Works: Step by Step

Appointing a CRA authorised representative is a straightforward process if you follow these steps:

1. Determine Applicability: Confirm that you are the manufacturer (not importer or distributor) of a product with digital elements sold in the EU. Check if your product falls under the CRA's scope.
2. Research Providers: Compare providers based on legal entity, published price, renewal terms, and scope of service. Use the included/not included table in this guide.
3. Request Written Offer: Contact the provider for a written mandate and confirmation of renewal price and exclusions.
4. Sign the Mandate: Sign the Article 18 mandate (REP27 provides eIDAS electronic signature, issued within 24 hours). Receive your designation letter and verifiable certificate.
5. Update Documentation: Add the representative's details to your technical documentation, packaging, and user instructions as required by the CRA.
6. Set Up Internal Processes: Prepare your internal runbook for 24-hour and 72-hour reporting. Define who can declare an incident, pre-write templates for notifications, and ensure at least two staff have access to the ENISA platform.
7. Budget for Technical Compliance: Arrange conformity assessment (if required), SBOM generation, and plan for the five-year support period for security updates.
8. Renew Annually: Monitor renewal dates and ensure the mandate does not lapse. REP27 offers one invoice and one renewal date for bundled services.

Checklist for Buyers

1. Are you a non-EU manufacturer selling digital products in the EU?
2. Have you identified the correct class of your product (default, important class I/II, critical)?
3. Do you have a written offer with the renewal price and exclusions?
4. Is your provider a registered EU legal entity?
5. Have you updated all documentation and packaging?
6. Are your internal reporting and support processes in place?
7. Have you budgeted for technical compliance and ongoing support?

Risks, Fines, and Realistic Scenarios

Failing to appoint a CRA authorised representative can have severe consequences. While the CRA does not specify a fixed fine for missing the mandate, non-compliance can result in your products being blocked from the EU market, withdrawal orders, and reputational damage. The costliest part of compliance is usually technical (notified body assessment, SBOM, security updates), not the representative fee. The representative's role is to prevent delays and ensure you have a direct, verifiable route for market surveillance and vulnerability reporting.

What Providers Usually Do Not Say

• Mandate lapses are a common failure—if you use multiple providers, keep renewal dates aligned.
• Some providers offer a low first-year price but do not publish renewal rates; always confirm in writing.
• Article 18 mandates should not claim to cover Article 13 duties—this is not permitted.
• Liability is limited: the representative does not answer technical questions or assume responsibility for your compliance.

Scenarios

• US SaaS company selling in the EU: Needs a CRA representative for Article 18 and a GDPR Article 27 representative. REP27 offers both in a bundle (€690/year), with one invoice and renewal date. The company must handle its own conformity assessment and security updates.
• Chinese Amazon seller: Must appoint a CRA representative to list IoT products in the EU. The cheapest published option is REP27 (€490/year). The seller must generate its own SBOM and ensure a five-year support period.
• UK online shop selling smart devices: Needs a CRA representative for EU sales. Euverify (GBP 590/year) and kadano (€999/year) are alternatives, but only REP27 publishes renewal pricing. The shop must arrange technical compliance separately.