Cost of 24h Vulnerability Reporting for Non-EU Producers (CRA 2026)

• Obligation from September 11, 2026, for all producers of digital products sold in the EU
• REP27 offers the service at €490/year, renewal €440, published price
• Kadano: €999/year, Euverify: £590/year (~€690), published prices
• Service covers only the transmission of the report, no tests or technical assessments
• Non-compliance: fines up to €15 million or 2.5% of global turnover
• Not required for importers, distributors, or those selling only outside the EU

Updated 22 October 2026 · 7 sources checked

Providers compared

Prices as published on each provider's website on 22 October 2026, excluding VAT unless stated. Each row links to its source.

Legal Requirements: Article 14 CRA

Article 14 of the Cyber Resilience Act (EU Regulation 2024/2847) introduces a very strict reporting obligation for all producers of digital products sold in the European Union, regardless of their location. From September 11, 2026, every producer must report within 24 hours of becoming aware of an actively exploited vulnerability or a serious security incident impacting the product. Reporting is done via the single platform managed by ENISA, addressed to the CSIRT coordinator of the relevant EU country.

• Reporting is structured in three phases: early warning (within 24h), detailed notification (within 72h), final report (within 14 days).
• Reporting is mandatory also for non-EU producers selling directly or via marketplaces to EU customers.
• No security tests or technical assessments are required from the representative: their role is to transmit reports and act as a contact point.
• The obligation applies also to incidents impacting product security, not only to already exploited vulnerabilities.

Failure to report or delays can lead to penalties up to €15 million or 2.5% of global annual turnover, whichever is higher. These rules apply to anyone placing digital products on the EU market, including software, hardware, IoT devices, SaaS, and more.

Sources: NIS2.gov.ie, Licentium

How to Choose a Provider: Practical Criteria and Comparison

Choosing the right provider for vulnerability reporting under the CRA requires attention to several practical aspects beyond price. Key criteria to evaluate include:

• Published and transparent price: Prefer providers that clearly state the annual and renewal costs to avoid surprises.
• Geographic coverage: The provider must guarantee representation in all EU countries where you sell your products.
• Certification and verification: An electronically signed and publicly verifiable mandate is a sign of reliability.
• 24/7 active reporting channel: The service must operate every hour of the year, including weekends and holidays.
• Clarity on exclusions: No included provider offers security testing, SBOM, or technical support in the base price: the mandate covers only report transmission.

Detailed comparison:

Practical advice: always ask in advance what is included, if there are per-report fees, and how renewal works. Prefer providers that provide a publicly verifiable certificate and clearly state their legal entity and geographic coverage.

What the Price Really Includes: Practical Details

The published price from providers covers exclusively the authorised representative mandate for vulnerability reporting under Art. 18 CRA. This means the representative:

• Receives and forwards vulnerability or security incident reports to competent bodies (CSIRT/ENISA) via the official platform.
• Acts as a contact point for European supervisory authorities in case of requests or clarifications.
• Provides a signed and certified mandate, often with a QR code for public verification.
• Ensures a 24/7 active reporting channel (at least for REP27, as declared on their official pages).

The base price does not include:

• Security testing or vulnerability assessments
• Software Bill of Materials (SBOM) generation
• Technical, legal, or operational support in drafting reports
• Crisis management or communication to end users (beyond forwarding the report)

For example, REP27 specifies that "conformity assessment belongs to notified bodies, testing to security firms, SBOM generation to your build pipeline and reporting to your security team." The mandate covers only transmission and receipt of requests from authorities. No extra fees declared per report, no hidden upsells.

Advice: ensure you have internal expertise to prepare reports and respond to any authority inquiries.

Hidden Costs, Service Limits, and Practical Risks

The cost of the authorised representative mandate is only part of the budget needed for Cyber Resilience Act compliance. Hidden costs and service limits are often overlooked:

• Internal preparation: Collecting information, drafting reports, and managing communications with the representative are the producer’s responsibility.
• Audits and assessments: If requested by authorities, you may incur costs for external audits or technical assessments, not covered by the mandate.
• Technical and legal support: The representative does not provide technical or legal advice beyond report transmission; any consultancy is extra.
• Limited liability: No included provider assumes responsibility for errors in content provided by the client or omissions in reporting.
• Renewal and switching: Always check renewal conditions and any penalties for changing providers: REP27 publishes switching and renewal prices, others do not.

Practical risks:

• If your internal procedure is not ready, the risk of missing deadlines is high.
• Failure to report or delays can lead to very high administrative fines and blocking of sales in the EU.

Advice: consider the mandate as a "process insurance," not a technical solution. Effective compliance depends on your internal organization.

How the Appointment Works: Step by Step and Checklist

Appointing the CRA representative follows a clear operational scheme. Here are practical steps and a checklist to follow:

1. Check if you sell digital products in the EU: If yes, verify if you are the producer (not just distributor/importer).
2. Choose the provider: Compare prices, inclusions, exclusions, and contract transparency.
3. Request the service online: Fill out the request form and receive the Art. 18 authorised representative mandate.
4. Sign and file the mandate: The mandate must be signed by both parties and kept for possible inspections.
5. Enter representative details in company documentation: Update runbooks, internal policies, and compliance documentation.
6. Prepare internal reporting procedure: Define who can declare a vulnerability, how to collect evidence, how to fill reporting templates (early warning, notification, final report).
7. Appoint at least two submitters: Ensure at least two people have access to the ENISA platform to avoid blocks in case of absence.
8. Record all steps: Track who, when, and how each report was made. This is essential in case of audits.

Operational checklist:

1. Verify your position (producer, importer, distributor)
2. Choose and appoint the representative
3. Prepare internal reporting procedure
4. Appoint submitters and update documentation
5. Pre-fill reporting templates
6. Record every report and communication

Advice: procedural clarity is the real added value of the representation service.

Decision Matrix: Who Needs the Service?

Not all companies need the authorised representative mandate for vulnerability reporting. Here is a decision matrix based on real cases:

Advice: if you are only a distributor or importer and do not place the product on the market under your name, you have no appointment obligation. If you are a non-EU producer, appointment is essential to avoid penalties.

What Providers Don’t Say (But You Should Know)

Many providers do not publish important details that can impact your compliance and actual costs:

• Exclusions: No included provider offers security testing, SBOM, or technical assessments in the base price. The mandate covers only report transmission.
• Liability: Responsibility for correctness and timeliness of reports always remains with the producer. The representative does not verify or modify received content.
• Renewal and switching: Some providers do not publish renewal prices or conditions for changing representatives. REP27 publishes both, others do not.
• Languages and hours: Verify that the provider is truly active 24/7 and can handle requests in multiple languages if needed.
• Service limits: The representative does not manage communication to end users, crisis management, or legal advice.

Advice: always request a written list of exclusions and liability limits before signing.

Practical Scenarios: Three Real Cases and Simplest Path

• US SaaS selling in the EU: Must appoint a CRA representative, prepare reporting procedure, and include the representative in official documents. In case of exploited vulnerability, sends report to the representative who forwards it to ENISA/CSIRT. The simplest path is choosing a provider with a 24/7 active channel and verifiable mandate.
• Chinese seller on Amazon: If the producer of the digital product, has reporting obligation and must appoint a representative; if only distributor, no. The simplest path is clarifying contractual role and, if needed, relying on a provider experienced in e-commerce.
• UK online shop: If selling digital products to EU customers, must appoint a representative and follow reporting procedure; if selling only in the UK, no obligation. The simplest path is evaluating if the EU sales share justifies compliance costs.

In all cases, internal preparation and procedural clarity are key to meeting deadlines and reducing sanction risks.