Cyber Resilience Act Obligations for Manufacturers Outside the EU

• CRA applies to non-EU manufacturers selling in the EU from 11 September 2026
• Article 18: EU authorised representative required if no EU presence
• 24-hour reporting duty for exploited vulnerabilities (Article 14)
• Conformity assessment route depends on product class
• Fines up to €15 million or 2.5% of turnover for breaches

Updated 17 October 2026 · 9 sources checked

Providers compared

Prices as published on each provider's website on 17 October 2026, excluding VAT unless stated. Each row links to its source.

What the Law Requires (with Article Numbers)

The Cyber Resilience Act (CRA) is the EU’s new regulation for products with digital elements, including hardware, software, and components. It applies to any manufacturer—regardless of location—if their products are placed on the EU market. The law entered into force on 10 December 2024. Reporting obligations start 11 September 2026; full compliance (including CE marking and conformity assessment) is required from 11 December 2027.

• Article 18: Non-EU manufacturers must appoint an authorised representative in the EU for each product line, unless they have an EU establishment. This representative acts as the official contact for authorities and market surveillance.
• Article 14: Manufacturers must report actively exploited vulnerabilities and severe incidents affecting product security. The timeline is strict: an early warning within 24 hours, a full notification within 72 hours, and a final report within 14 days after mitigation or notification. The reporting platform is managed by ENISA, and the recipient is determined by the representative’s member state.
• Annex I & II: Manufacturers must meet essential cybersecurity requirements, including vulnerability handling, secure-by-design development, and clear user instructions in a language easily understood by users and authorities.
• Conformity Assessment: The required process depends on product class. Default products may self-assess; important class I must use harmonised standards or third-party assessment; important class II and critical products require notified body or certification scheme assessment.
• Support Period: Manufacturers must provide security updates and vulnerability handling throughout the declared support period (minimum five years).
• Exemptions: Micro and small enterprises, and open-source stewards, are exempt from fines for late reporting but must still comply with technical and reporting duties.

Importers and distributors become manufacturers if they place products under their own name or substantially modify them. Otherwise, the original manufacturer remains responsible for CRA compliance and reporting.

How to Choose a CRA Representative or Compliance Provider

Choosing the right Article 18 representative or compliance provider is critical for non-EU manufacturers. The market varies widely in price, transparency, and included services. Here’s what to consider:

• Legal Entity and Location: Verify the provider’s legal entity and EU establishment. For example, REP27 is Europe Services, SE, based in Prague and listed in the Czech commercial register. Always check before paying.
• Scope of Mandate: Some providers only offer the Article 18 mandate (as required by law), while others bundle additional services like GDPR or NIS2 representation. Confirm whether the mandate is limited to Article 18(3) (as it should be) and does not claim to cover duties forbidden by Article 18(2).
• Transparency of Pricing: Look for providers that publish both first-year and renewal prices. Beware of token introductory prices followed by silent, higher renewals. REP27, for instance, clearly states renewal prices alongside first-year fees.
• Verification and Support: Ensure the provider offers a verifiable certificate, a public verification method, and a staffed request desk. Ask about the process for forwarding authority or CSIRT requests, supported languages, and response times.
• Bundled Services: If you also need GDPR Article 27 or GPSR Article 16 representation, some providers (e.g., REP27) offer combined packages at a reduced rate.

Decision Matrix:

Always request a written mandate and certificate before placing products on the EU market.

What the Price Really Includes: Provider Comparison

Prices and included services vary significantly. Article 18 mandates are typically the lowest external cost in CRA compliance, but many providers do not publish full details. Below is a comparison of what is included, not included, or may incur extra fees for each provider (as of October 2026):

For most manufacturers, the Article 18 mandate is a one-page document plus a duty to forward requests. Conformity assessment, technical testing, and SBOM generation are separate costs and not included in basic representative fees.

Hidden Costs and Exclusions

While the Article 18 mandate is a legal necessity, it is only a small part of total CRA compliance costs. The most expensive elements—conformity assessment, notified body fees, technical documentation, and support period—are not included in most representative packages. Here’s what to watch for:

• Conformity Assessment Fees: For important class II or critical products, notified body or certification scheme costs can be in the thousands of euros and require months to complete. Budget for these separately.
• Technical Documentation: Providers like Reglyze and EmberKat offer technical file generation, SBOM ingest, and documentation gap analysis, but these are not part of standard representative mandates.
• Renewal and Per-Request Fees: Some providers may charge higher renewal rates or per-request/reporting fees. Always request written confirmation of renewal pricing and any extra charges before signing.
• Notice Periods and Liability Limits: Silent renewals and unclear cancellation policies can lead to unexpected expenses. Liability for compliance failures is often excluded or limited by the representative.
• Support Period Costs: The law requires at least five years of security updates and vulnerability handling, which must be resourced and budgeted like a product line.

REP27 is transparent about what is not included: legal advice, technical assessment, and SBOM generation are outside the mandate. Always clarify exclusions and hidden costs with any provider.

How Appointment Works: Step by Step

Appointing an Article 18 representative and achieving CRA compliance involves several concrete steps. Here is a practical, actionable process for non-EU manufacturers:

1. Determine if Your Products Are in Scope: Identify all products with digital elements (hardware, software, components, or remote data-processing solutions) placed on the EU market.
2. Classify Your Products: Use the CRA’s definitions to determine if your products are default, important class I/II, or critical. This affects your conformity assessment route.
3. Choose a Representative: Select an Article 18 representative with a verifiable EU legal entity. Confirm scope, pricing, and renewal terms in writing.
4. Sign the Mandate: Execute a written mandate (Article 18(3)) with your chosen provider. Obtain a certificate and public verification method.
5. Prepare Documentation: Assemble technical documentation (Annex VII), SBOM, EU Declaration of Conformity, and user instructions in required languages.
6. Set Up a 24-Hour Reporting Channel: Ensure you have a staffed intake channel for vulnerabilities and incidents. Pre-write early warning and notification templates.
7. Register with ENISA: Register your submitters on the ENISA reporting platform. Assign at least two people with access in different time zones.
8. Budget for Ongoing Compliance: Plan for support period costs (minimum five years of updates), conformity assessment (if required), and documentation maintenance.
9. Review and Update Regularly: Schedule periodic reviews of your compliance posture, documentation, and reporting processes.

Following this checklist ensures you are prepared for both the legal and practical demands of CRA compliance.

Risks and Fines for Non-Compliance

The CRA introduces substantial penalties for non-compliance. Breaches of essential cybersecurity requirements or manufacturer obligations can result in fines up to €15 million or 2.5% of total worldwide annual turnover, whichever is higher. These penalties apply to both EU and non-EU manufacturers placing products on the EU market.

• Reporting Failures: Missing the 24-hour vulnerability reporting deadline exposes you to enforcement action. Micro and small enterprises, and open-source stewards, are exempt from fines for late reporting but not from the reporting duty itself.
• Procurement and Market Access Risks: Without an Article 18 representative, procurement processes may stall, and you may be excluded from enterprise sales or public tenders.
• Market Surveillance Actions: Authorities may take action against non-compliant manufacturers, including product withdrawal or recall.
• Distributor/Importer Risks: If you do not appoint a representative, EU importers or distributors may be treated as your reporting route by default, potentially leading to loss of control over compliance communications.
• Silent Lapses: Failure to renew mandates or maintain up-to-date documentation can result in unnoticed lapses, leaving you exposed to enforcement without warning.

Effective compliance is not just about avoiding fines but also about ensuring uninterrupted market access and maintaining trust with customers and partners.

What Providers Usually Do Not Say

Many providers focus on the legal necessity of the Article 18 mandate but may not disclose the full picture. Here’s what is often omitted:

• Mandate Scope: The Article 18 mandate is limited to forwarding requests and acting as contact point. It does not include legal advice, technical assessment, or SBOM generation unless explicitly stated.
• Conformity Assessment: For important class II and critical products, notified body or certification scheme costs are far higher than the representative fee and can require months to complete. These are never included in basic mandates.
• Support Period: The requirement for at least five years of security updates and vulnerability handling is a major operational cost, not covered by any representative service.
• Renewal and Notice Terms: Some providers use low first-year prices with much higher renewals or require long notice periods for cancellation. Always get renewal terms in writing.
• Liability: Representatives typically exclude liability for compliance failures. The manufacturer remains responsible for all obligations under the CRA.

Transparency about what is not included is as important as what is. Always request a full list of exclusions and clarify the provider’s role before signing.

Realistic Scenarios: Which Route Applies?

• US SaaS Company: A SaaS provider based in the US sells software directly to EU customers. The company must appoint an Article 18 representative, prepare technical documentation and SBOM, and set up a 24-hour reporting channel. If the product is default class, self-assessment may suffice; if important or critical, a notified body is needed. The simplest route is to appoint a representative (e.g., REP27), prepare documentation, and register with ENISA.
• Chinese Amazon Seller: A manufacturer in China sells IoT devices under its own name on Amazon to EU buyers. The seller must appoint an Article 18 representative and comply with all CRA requirements. If the product is placed on the market by an EU-based importer, the importer may assume the obligations. If not, the original manufacturer must handle reporting and documentation.
• UK Online Shop: A UK-based retailer ships connected devices to EU customers. The retailer must appoint an Article 18 representative, prepare technical files, and ensure a 24-hour vulnerability reporting process. If selling via an EU distributor who places the product under their own name, the distributor takes on the obligations; otherwise, the UK retailer remains responsible.

For all scenarios, the key is to map sales channels, determine who places the product on the market, and appoint a representative if required. This prevents procurement delays, ensures compliance, and avoids fines.

Checklist: How to Get Compliant Today

1. Map your EU sales channels and identify all products with digital elements.
2. Classify each product (default, important I/II, critical) based on CRA definitions.
3. Determine if you need an Article 18 representative (required for non-EU manufacturers).
4. Request a written mandate and certificate from your chosen provider (e.g., REP27, kadano, Euverify).
5. Prepare technical documentation: Annex VII file, SBOM, EU Declaration of Conformity, user instructions in EU languages.
6. Set up a staffed, 24-hour vulnerability reporting channel. Pre-write early warning and notification templates.
7. Register at least two submitters on ENISA’s reporting platform (in different time zones if possible).
8. Budget for notified body or certification scheme if your product is important class II or critical.
9. Declare and resource a support period of at least five years for security updates and vulnerability handling.
10. Schedule regular compliance reviews and documentation updates.

Following these steps will ensure you are ready for the 2026-2027 CRA enforcement deadlines and avoid costly compliance gaps.