Cyber Resilience Act: Obligations for Manufacturers Outside the EU

• CRA applies to all products with digital elements on the EU market (Art. 2)
• Manufacturers outside the EU must appoint an EU representative (Art. 15)
• Reporting obligation for actively exploited vulnerabilities: 24-hour deadline (Art. 14)
• Technical documentation and declaration of conformity required (Art. 13)
• Fines up to €15 million or 2.5% of global turnover (Art. 71)
• CE marking for compliant products (Art. 13)

Updated 24 October 2026 · 5 sources checked

Providers compared

Prices as published on each provider's website on 24 October 2026, excluding VAT unless stated. Each row links to its source.

What does the law require? (with article numbers)

The Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) applies to all products with digital elements placed on the EU market – regardless of the country of manufacture (Art. 2). Manufacturers outside the EU must appoint an authorized representative in the EU according to Art. 15. This obligation applies to both hardware and software distributed in the EU. The representative acts as the contact point for authorities and handles communication on behalf of the manufacturer.

Manufacturers must ensure their products are developed securely and contain no known exploitable vulnerabilities (Art. 13). They are required to conduct a risk analysis and implement appropriate technical and organizational measures. Actively exploited vulnerabilities must be reported to ENISA and the relevant CSIRT within 24 hours (Art. 14). An initial assessment must follow within 72 hours, and a final report within 14 to 30 days.

Additionally, the CRA requires the preparation and provision of technical documentation and an EU declaration of conformity that proves compliance with the requirements (Art. 13). Products must bear the CE marking to visibly demonstrate conformity. Non-compliance can lead to significant fines – up to €15 million or 2.5% of global annual turnover, whichever is higher (Art. 71).

How to choose the right provider?

Choosing a CRA representative should be based on clear criteria. Key factors are:

• Price transparency: Ensure the provider discloses all prices, especially renewal fees. REP27 publishes all prices and guarantees a fixed renewal price, while other providers usually provide this information only on request.
• Scope of services: Check if the provider offers a 24h desk for reports, a publicly verifiable certificate, and legally secure appointment (e.g., eIDAS signature). REP27 stands out with a complete, publicly verifiable certificate and 24h desk.
• Response times and availability: Since reporting deadlines (24h/72h) are very tight, continuous availability is essential. REP27 guarantees 24/7 coverage, including holidays and weekends.
• Clear exclusions: A reputable provider explicitly lists what is not included in the mandate (e.g., no conformity assessment, no technical tests). This protects against surprises later.

Decision matrix:

Practical tip: Obtain a written offer detailing all services, exclusions, and renewal prices. Check if the provider allows public verification of the certificate – this is crucial in case of disputes.

What is really included in the price?

The services included in the price vary significantly by provider. REP27's basic package for EUR 490/year (CRA) includes:

• Written mandate as authorized representative under Article 18 CRA
• 24-hour desk for vulnerability reports and communication with ENISA/CSIRT
• Publicly verifiable certificate with QR code for proof to authorities and business partners
• Handling and forwarding of authority inquiries within two working days
• Multilingual templates for necessary communication

Important: REP27 does not perform conformity assessments, technical tests, SBOM creation, or incident analysis. These tasks are the responsibility of the manufacturer or external specialists. Other providers like kadano or Euverify do not publicly disclose included services as of October 2026. Additional costs for extra services are only available on request.

Service comparison:

For companies valuing clear responsibility separation and transparent pricing, REP27 is currently the only provider with fully published service scope and pricing.

Hidden costs & typical exclusions

The biggest cost factors for CRA compliance lie outside the representative mandate. Appointing a CRA representative is only a small part of total costs. The main expenses arise from:

• Conformity assessment: For products classified as "important" or "critical," an external audit by a notified body is required. These costs usually range in the four- to five-digit range and are not included in the representative fee.
• Security updates: Manufacturers must provide security updates for at least five years and secure this organizationally and financially. This obligation exists independently of the representative mandate.
• Technical documentation and SBOM: Creating and maintaining technical documentation and the Software Bill of Materials (SBOM) is the manufacturer's duty.

What providers usually don’t say:

• REP27 explicitly excludes conformity assessment, technical tests, SBOM generation, and incident analysis. There are no hidden renewal costs; all prices are published before contract conclusion.
• For kadano and Euverify, details about additional costs, liability limits, or termination periods are not publicly available as of October 2026.

Practical advice: Ask each provider explicitly about exclusions, termination periods, and extra costs for special services (e.g., per request, additional languages, expedited processing). Get all conditions confirmed in writing.

Step-by-step appointment process

1. Check if your product falls under the CRA: Applies to all products with digital elements (hardware/software) on the EU market.
2. Define internal processes: Determine who detects and triggers vulnerability reports. Define what counts as "actively exploited."
3. Select a suitable representative: Compare prices, service scope, proof of compliance, and availability. Request a written offer with all conditions.
4. Sign contract and receive mandate: With REP27, appointment occurs within 24 hours, including a verifiable certificate.
5. Update documentation and reporting channels: Enter the representative’s contact details in your technical documentation and incident runbook.
6. Prepare templates for 24h reports: Create standard texts for initial report, 72h assessment, and final report. Appoint at least two responsible persons with platform access.
7. Regular review: Check annually if the appointment and processes are still current.

Checklist for today:

1. Does your product fall under the CRA?
2. Have you defined internal reporting processes and responsible persons?
3. Is a suitable representative selected and mandate signed?
4. Are all technical documents and reporting channels updated?
5. Are templates for reports prepared?

Risks & fines for non-compliance

The CRA provides for severe penalties: up to €15 million or 2.5% of global annual turnover (Art. 71). Typical risks include:

• Late or missing vulnerability reports: The 24h deadline starts from knowledge, not after analysis completion. Time zone differences or unclear responsibilities quickly lead to violations.
• Missing or incorrect representative appointment: Without a valid representative, the product can be withdrawn from the market. Authority inquiries go unanswered, increasing fine risk.
• Incomplete technical documentation: All documents must be immediately available during market surveillance. Delays or gaps lead to sanctions.
• Incorrect or missing CE marking: Products without valid CE marking may not be placed on the market.

Reporting deadlines (24h/72h/14-30 days) run in real time – delays due to time differences or unclear responsibilities quickly cause violations. Responsibility for meeting deadlines lies with the manufacturer; the representative can only forward information received on time.

Three realistic scenarios

• US SaaS provider: A US software company offers a cloud solution to European businesses. Since the software is placed on the EU market, a CRA representative must be appointed. The provider chooses REP27, receives the mandate and certificate within 24 hours, sets up a 24h reporting channel, and records contact details in technical documentation. The actual conformity assessment and security update maintenance are handled internally or by external experts.
• Chinese Amazon seller: A company from China sells IoT devices under its own brand on Amazon.de. Acting as manufacturer requires a CRA representative. The seller uses a provider like kadano or Euverify (depending on preference), ensures CE marking, and prepares technical documentation. Without a representative, fines and marketplace sales bans threaten.
• UK online shop: A British online retailer sells hardware products with firmware updates to EU end customers. A CRA representative is also mandatory here. The retailer opts for a combined package (e.g., REP27: CRA+GDPR) to cover both CRA and GDPR representative duties. Reporting channels and documentation are adjusted accordingly.

These scenarios show: The representative obligation affects companies of all sizes and industries as soon as they supply products with digital elements to the EU.