Cyber Resilience Act Authorised Representative for Non-EU Manufacturers: Providers & Prices (2026)

• CRA Article 18 requires non-EU manufacturers to appoint an authorised representative in the EU.
• REP27 — Europe Services, SE: €490/year (renewal €440), published price, clear scope.
• Kadano: €999/year, price verified, Austria-based.
• Euverify: £590/year, price verified, Ireland-based.
• Service does not include conformity assessment or legal advice.
• Not needed by EU-based manufacturers or importers placing products under their own name.

Updated 16 October 2026 · 7 sources checked

Providers compared

Prices as published on each provider's website on 16 October 2026, excluding VAT unless stated. Each row links to its source.

What the Law Requires: CRA Article 18

The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, is a landmark EU law that imposes mandatory cybersecurity requirements on all products with digital elements—hardware or software—placed on the EU market. Article 18 of the CRA specifically requires that any manufacturer established outside the EU must appoint an authorised representative established within the EU. This representative acts as the official contact point for EU market surveillance authorities, holds the declaration of conformity and technical documentation, and is responsible for forwarding regulatory requests to the manufacturer.

The law applies to a wide range of products, including embedded devices, software, SaaS, IoT, and components sold separately. The representative’s role is strictly defined: they do not assume the manufacturer’s legal liability, nor do they provide technical or legal advice. Their core duty is to ensure that authorities can reach the manufacturer quickly and efficiently, especially in the event of a vulnerability or incident.

• Article 14 introduces a 24-hour reporting obligation for actively exploited vulnerabilities, starting 11 September 2026. Manufacturers must notify ENISA (the EU Agency for Cybersecurity) via a single reporting platform, with a full notification due in 72 hours and a final report in 14 days.
• Article 71(2) sets the application dates: reporting duties from 11 September 2026, full obligations (including product marking and conformity assessment) from 11 December 2027.
• Non-compliance with Article 18 (failure to appoint a representative) is subject to fines up to €10 million or 2% of global turnover (Article 69(1)), while breaches of essential requirements can reach €15 million or 2.5% (Article 69(2)).

Importantly, if a non-EU manufacturer does not appoint a representative, the importer or distributor may become responsible by default, potentially leading to business disruptions or procurement delays.

How to Choose a CRA Authorised Representative

Choosing the right CRA authorised representative is a critical compliance decision. The market is new, and providers differ in transparency, scope, and renewal terms. Here’s how to make an informed choice:

• Legal Entity: Verify that the provider is a registered EU company with a clear legal identity. For example, REP27 is Europe Services, SE, registered in Prague since 2014 (IČO 03571785).
• Published Price and Renewal Terms: Insist on a provider that publishes both first-year and renewal prices. REP27 lists €490/year (renewal €440), with bundle discounts. Many providers do not publish renewal prices, which can lead to unexpected costs.
• Scope of Mandate: The mandate should be limited to Article 18(3). Providers should not claim to cover additional legal duties (such as Article 13), as this is not permitted by the CRA.
• Certificate Verification: Look for a provider offering a verifiable certificate, such as a QR code checkable on a public page. This is essential for procurement and regulatory audits.
• Request Handling: Understand how the provider forwards authority requests—languages supported, response times, and whether there are per-request fees.

Below is a comparison of what is included, not included, or may incur extra fees for each provider:

Always request a sample contract and ask for all exclusions and renewal conditions in writing before making a decision.

What the Price Really Includes

Most published CRA authorised representative prices cover only the basic Article 18 mandate. This typically means:

• A signed appointment letter (mandate) with the EU representative’s legal entity
• A verifiable certificate (sometimes with a QR code or public registry entry)
• Forwarding of requests from EU authorities to the manufacturer
• Optional: a request desk or support channel for regulatory inquiries, sometimes in multiple languages

What is not included:

• Legal advice or representation in court
• Conformity assessment, security testing, or SBOM generation
• Incident response or technical remediation
• Drafting or reviewing technical documentation

REP27’s published fee is €490/year for the CRA mandate, with a renewal price of €440/year. Bundled options are available: €690/year for both CRA and GDPR Article 27 representation, €990/year for CRA, GDPR, and NIS2, and an additional €200 for GPSR Article 16 responsible person. All prices are exclusive of VAT and are billed annually in advance. For non-EU customers, Czech VAT does not apply; for EU customers with a valid VAT number, the reverse charge applies.

Kadano charges €999/year for the default or Important, Class I mandate (details on inclusions are on request). Euverify charges £590/year for CRA representation only (inclusions on request). Neither Kadano nor Euverify publish detailed inclusions or renewal terms on their websites as of October 2026.

Summary: The representative’s fee is generally the smallest part of CRA compliance costs. The bulk of expenses come from internal engineering, documentation, and, for higher-risk products, notified body assessments.

Hidden Costs and Exclusions

While the published price for a CRA authorised representative is straightforward, buyers should be aware of several hidden or excluded costs that can significantly impact total compliance spending:

• Conformity Assessment: For Important Class II and Critical products, notified body assessment is mandatory and can cost thousands of euros, with timelines stretching into months. This is not included in any representative’s fee.
• Internal Engineering: The cost of preparing technical documentation, SBOMs, and support period commitments is borne by the manufacturer. For default class products, these costs are mostly internal.
• Legal Advice and DPO Services: No provider in this guide offers legal advice, DPO services, or compliance assessments as part of the CRA representative package. REP27 explicitly excludes these services.
• Per-request Fees: Some providers may charge additional fees for forwarding or handling authority requests, though REP27 does not publish any such fees. Always confirm in writing.
• Renewal Price Increases: Many providers do not publish renewal prices, which can lead to unexpected increases. REP27 is transparent about renewal pricing.
• Notice Periods and Cancellation: Check the contract for notice periods and cancellation terms. Silent renewals and token first-year prices are common in the market.

Exclusions Table:

In summary, always clarify what is and is not included, and budget for the substantial costs of engineering, documentation, and, if required, notified body assessment.

How Appointment Works: Step by Step

Appointing a CRA authorised representative is a structured process. Here’s how it typically works, with practical tips for each step:

1. Determine Applicability: Confirm your product is in scope (any product with digital elements, hardware or software, sold in the EU).
2. Check Establishment: If your company is not established in the EU, you must appoint a representative.
3. Research Providers: Compare providers’ legal entities, published prices, renewal terms, and scope of service. Ask for sample contracts and clarify exclusions.
4. Sign the Mandate: Enter into a written agreement (mandate) with the chosen provider. Ensure the mandate is limited to Article 18 duties.
5. Receive Documentation: Obtain the signed designation letter and verifiable certificate. REP27 provides eIDAS electronic signatures and a QR code for public verification.
6. Update Technical Files: List the representative’s details in your technical documentation, declarations of conformity, and, where applicable, on product labels.
7. Prepare for Reporting: Set up a runbook for vulnerability reporting (Article 14), including who can declare an incident, who has platform access, and draft templates for early warnings and notifications.
8. Bundle if Needed: If you require GDPR Article 27, NIS2, or GPSR representation, consider bundled packages for cost savings and administrative simplicity.

Decision Matrix:

Risks and Fines

The risks of non-compliance with the CRA are substantial, both financially and operationally. The law provides for significant fines and other consequences:

• Failure to Appoint: Not appointing an authorised representative when required can result in fines up to €10 million or 2% of global turnover (Article 69(1)).
• Essential Requirements Breach: Fines for breaches of essential requirements or manufacturer obligations can reach €15 million or 2.5% of global turnover (Article 69(2)).
• Delayed Reporting: Missing the 24-hour reporting window for exploited vulnerabilities (Article 14) can trigger enforcement actions, market withdrawals, and reputational damage.
• Procurement Delays: Lack of a representative can stall sales cycles, as procurement teams often require proof of EU representation before purchase.
• Loss of Control: If you do not appoint a representative, the importer or distributor may become the default contact, potentially leading to loss of control over incident reporting and regulatory interactions.
• Silent Lapses: Managing multiple mandates with different renewal dates increases the risk of accidental lapses, which can result in non-compliance.

REP27 notes that the main value of the mandate is what it prevents: wasted time during incidents, delayed documentation requests, procurement stalls, and accidental lapses in coverage. These operational risks are as significant as the financial penalties.

What Providers Usually Do Not Say

Many providers in the CRA representation market do not clearly disclose important contractual and operational details. Buyers should be aware of the following:

• Renewal Prices: Some providers offer low first-year prices but do not publish renewal rates, which can increase unexpectedly. REP27 is one of the few to state renewal prices up front.
• Notice Periods: Silent renewals and long notice periods for cancellation are common. Always ask for these terms in writing.
• Scope Creep: Some providers may claim to cover duties beyond Article 18, such as Article 13, which is not permitted by the CRA. Ensure the mandate is limited to what the law allows.
• Per-request Fees: Additional charges for handling or forwarding authority requests may apply, though REP27 does not list any. Always clarify in advance.
• Liability Limits: Providers rarely disclose their liability caps or exclusions for damages. This can be critical in the event of a dispute.
• Exclusions: No provider covers conformity assessment, security testing, SBOM generation, or legal advice. These are always the manufacturer’s responsibility.

In summary, insist on full written disclosure of renewal prices, notice periods, per-request fees, and liability terms before signing any contract.

Decision Matrix: Do You Need a CRA Authorised Representative?

Use this matrix to determine if you need a CRA authorised representative based on your business model and market presence:

This matrix covers most practical scenarios for manufacturers and sellers. If in doubt, consult the law or a specialist for your specific product and sales model.

Checklist: Steps to CRA Compliance

Follow this checklist to ensure you meet your CRA obligations efficiently:

1. Determine if your product is in CRA scope (hardware/software with digital elements).
2. Check if you are established outside the EU.
3. Identify if you sell directly to EU customers or via marketplaces (Amazon, Etsy, eBay).
4. Research and compare CRA representative providers for legal entity, price, and scope.
5. Request sample contracts and clarify all exclusions and renewal terms in writing.
6. Sign the Article 18 mandate with your chosen provider.
7. Receive and verify your designation letter and certificate (preferably with public verification).
8. Update your technical documentation and product declarations to include the representative.
9. Prepare your vulnerability reporting runbook (Article 14 duties from September 2026).
10. Budget for internal engineering, documentation, and, if applicable, notified body assessment.
11. Review your support period commitments (minimum five years of security updates).
12. Monitor renewal dates and cancellation notice periods to avoid silent lapses.

Realistic Scenarios

• US SaaS provider: Sells a cloud-based product to EU customers. Must appoint a CRA representative and set up a 24-hour vulnerability reporting channel. REP27 offers a published price, fast appointment, and a verifiable certificate. The SaaS provider must also prepare technical documentation and a reporting runbook, but conformity assessment is likely self-declared unless the product is Important Class II or Critical.
• Chinese Amazon seller: Ships branded IoT devices to the EU. Needs a CRA representative for market access, as Amazon and EU customs may require proof of representation. The seller must ensure the product meets CRA requirements, appoint the representative (e.g., REP27, Kadano, or Euverify), and update product documentation. If selling under their own name, the obligation applies; if the importer rebrands, the importer assumes responsibility.
• UK online retailer: Sells connected devices B2B to EU companies. Needs a CRA representative unless an EU-based importer takes on the obligations. The retailer should clarify with partners who is responsible, appoint a representative if needed, and prepare for vulnerability reporting from September 2026.

These scenarios illustrate the practical application of the law and the steps required for compliance, regardless of company size or sector.