Cost of an Authorized Representative for the Cyber Resilience Act: Providers & Prices 2026

• Article 18 CRA: Representation obligation for manufacturers outside the EU
• Verified 2026 prices: €490 to €999 annually
• REP27: €490 (first year), €440 (renewal), no additional fees
• Services vary: conformity assessment and testing never included
• Fines up to €15 million or 2.5% turnover for violations (Art. 64 CRA)
• Not everyone needs a representative: importers, distributors, EU manufacturers exempt

Updated 25 October 2026 · 7 sources checked

Providers compared

Prices as published on each provider's website on 25 October 2026, excluding VAT unless stated. Each row links to its source.

What the Cyber Resilience Act Requires (with Articles)

The Cyber Resilience Act (CRA) is the central EU regulation for cybersecurity of products with digital elements. For manufacturers outside the EU, appointing an authorized representative in the EU is mandatory once they offer products on the European market. This obligation arises from Article 18 of the CRA (Source).

• Article 18: Manufacturers established outside the EU must appoint a representative who communicates with authorities and market surveillance bodies on their behalf.
• Articles 13 and 14: Regulate security requirements and reporting obligations for vulnerabilities and security incidents. From September 11, 2026, manufacturers must report within 24 hours of becoming aware of an actively exploited security issue (Source).
• Article 64: Violations of the regulations can be fined up to €15 million or 2.5% of global annual turnover (Source).
• Article 71: The regulation came into force on December 10, 2024. Reporting obligations apply from September 11, 2026, with full application from December 11, 2027 (Source).

The obligation applies exclusively to manufacturers not established in the EU. Importers and distributors are only affected if they act as manufacturers (e.g., rebranding or own placing on the market). Open-source projects without commercial intent have a reduced regime.

The representative's role is clearly limited: they act as an interface to authorities but do not assume technical responsibility for the product. Actual tasks like conformity assessment, security updates, and technical documentation remain with the manufacturer.

How to Choose the Right Provider?

The selection of a CRA representative should focus on transparency, pricing structure, and verifiability. Many providers do not publish their prices, making comparisons difficult. REP27 stands out with an open pricing structure and clear statements about included and excluded services (Source).

• Pricing structure: Look for published prices and renewal costs. REP27 openly shows these (€490 first year, €440 renewal).
• Scope of services: By law, a CRA representative may only perform the tasks from Article 18. Providers promising technical testing or conformity assessments exceed the legal scope.
• Verifiability: A verifiable mandate (e.g., with QR code and public verification page like REP27) is crucial in case of issues.
• Cancellation terms and extra fees: Ask about hidden costs, cancellation periods, and per-request fees. REP27 has no extra fees; others require inquiry.

Check whether the provider is a legal entity registered in the commercial register and whether mandate issuance is fast and traceable. REP27 issues the order and mandate within 24 hours.

What Is Actually Included in the Price?

The price of a CRA representative covers exclusively the mandate under Article 18. This means the representative acts as the formal contact point for authorities and market surveillance bodies. The technical responsibility for the product, conformity assessment, creation of the Software Bill of Materials (SBOM), and security testing are not included and must be arranged separately (Source).

• REP27: Includes the mandate, a written order, a verifiable certificate, a desk for authority inquiries, and no additional fees. Conformity assessment, testing, and SBOM are excluded.
• kadano / Euverify: Detailed information on included services is not available. It is advisable to request this in writing before signing a contract.

The representative is not responsible for the technical implementation of CRA requirements. Most providers, including REP27, explicitly state that no technical consulting, conformity assessment, or product testing is included in the mandate. Those needing these services must contact specialized testing bodies or security firms.

The representative's role is clearly limited and primarily prevents authority inquiries from going unanswered or market surveillance from being delayed. In critical cases, a verifiable mandate ensures communication is fast and legally secure.

Hidden and Real Costs of CRA Compliance

The main costs of CRA compliance lie not with the representative but with internal and external measures to meet legal requirements. The representative's mandate costs between €490 and €999 per year and is the smallest budget item (Source).

• Conformity assessment: For important Class I products, compliance with harmonized standards is sufficient. For Class II or critical products, an external assessment by a notified body is mandatory. These costs are several thousand euros and the process takes months.
• Security updates: Manufacturers must provide security updates for at least five years. These costs often exceed the mandate cost and must be planned long-term.
• Internal resources: Documentation, SBOM creation, and setting up a reporting channel require additional effort.
• Hidden costs: Some providers may charge extra fees for individual authority inquiries, expedited processing, or mandate changes. REP27 excludes these; others should be asked.

Ordering a representative is necessary but not sufficient for full CRA compliance. The greatest costs and risks come from technical implementation and ongoing product maintenance.

How the Ordering Process Works – Step by Step

1. Check if your company falls under Article 18: Are you a manufacturer of a product with digital elements and established outside the EU?
2. Compare providers: Review published prices, renewal costs, and service scope. Look for verifiable mandates and clear exclusions.
3. Order the mandate: REP27 offers online ordering with issuance within 24 hours. Other providers on request.
4. Receive and document the mandate: Store the mandate in your technical documentation and product file. The data must be presented to authorities and market surveillance bodies on request.
5. Publish representative data: Provide the representative’s contact details in your documents and, if applicable, on your website.
6. Set up a reporting channel: Establish an internal process to report vulnerabilities and security incidents timely to the representative. REP27 offers a desk that forwards authority inquiries within two business days.
7. Regular review: Annually check if the mandate is still valid and if contact details are current.

A structured process minimizes risks of delays and fines. Use the checklist to cover all steps legally securely.

Risks and Fines for Non-Compliance

Failure to comply with the representation obligation under Article 18 CRA is an independent administrative offense. According to Article 64, fines up to €15 million or 2.5% of global annual turnover may be imposed, whichever is higher (Source).

• Missing representative: Authority inquiries go unanswered, market surveillance may take measures up to sales stop.
• Unclear responsibilities: Without a verifiable mandate, communication delays with authorities risk missing deadlines for reporting obligations (e.g., 24-hour deadline for vulnerabilities).
• Contract traps: Providers with opaque renewal prices or extra fees can cause unexpected costs. A clear, written contract with fixed prices is essential.
• Technical failures: Simply ordering a representative does not protect against fines for technical deficiencies, missing updates, or insufficient documentation.

A reliable representative is the first step to compliance but does not replace the manufacturer’s technical and organizational duties. Risks mainly arise from lack of preparation for reporting duties and lack of transparency in provider choice.

What Providers Usually Don’t Say

• Limited scope of services: The mandate of a CRA representative covers only formal representation under Article 18. Technical consulting, conformity assessment, product testing, and SBOM creation are not included.
• No liability for product defects: The representative is not liable for technical defects or security vulnerabilities of the product. Responsibility always remains with the manufacturer.
• Renewal prices and cancellation terms: Many providers do not publish renewal prices or cancellation terms. REP27 openly shows these (renewal €440, no extra fees).
• Per-request fees: Some providers charge fees for individual authority inquiries, expedited processing, or mandate changes. REP27 excludes these; others on request.
• No technical support: The representative does not perform tasks related to implementing security updates, creating SBOMs, or conducting penetration tests.

Therefore, choosing a provider should not be based solely on price but primarily on transparency of services and exclusions. Ask specifically what is included and what is not in the mandate.

Decision Matrix: Do You Need a CRA Representative?

The obligation applies exclusively to manufacturers who place products on the EU market under their own name or brand. Importers, distributors, and pure marketplace sellers are exempt as long as they do not act as manufacturers.

Buyer Checklist (Immediately Actionable)

1. Check if your product falls under the CRA (digital elements, sold in the EU).
2. Determine if you qualify as a manufacturer (also for OEM/white-label).
3. Compare prices and services of providers. Request written details on renewal costs and exclusions.
4. Order the mandate and document it in your product file.
5. Publish the representative’s contact details in your technical documentation and, if applicable, on your website.
6. Set up a reporting channel for vulnerabilities and security incidents.
7. Plan resources for security updates (at least five years) and technical documentation.
8. Ensure all internal processes to meet reporting deadlines (e.g., 24 hours for vulnerabilities) are established.
9. Annually verify the mandate’s validity and contact details’ currency.

This checklist helps systematically and legally securely fulfill all legal requirements.

Three Real Scenarios: Who Needs What?

• US SaaS provider: A US company develops cloud software sold directly to EU customers. Since the manufacturer has no EU establishment, a CRA representative under Article 18 is mandatory. Price starts at €490 per year with REP27. Technical implementation (SBOM, updates, reporting channel) remains with the manufacturer.
• Chinese Amazon seller: A company from China sells its own smart home products via Amazon to EU customers. The representation obligation applies as the seller acts as manufacturer. Mandate ordering is online, costs start at €490 per year (REP27). Importer and Amazon themselves are not required to appoint a representative.
• UK online shop: A UK-based online shop imports products from Asia and sells them under its own name to EU customers. As the company qualifies as manufacturer without EU establishment, a representative under Article 18 is required. Other obligations (conformity assessment, updates) must also be fulfilled.

In all cases, ordering a representative is only part of overall compliance. Technical and organizational implementation of CRA requirements remains with the manufacturer.