Do I Need an Authorised Representative if I Manufacture Outside the EU? Providers & 2026 Prices

• Non-EU manufacturers selling in the EU must appoint an authorised representative under CRA Article 18.
• The duty applies from 11 September 2026 for products with digital elements.
• REP27 — Europe Services, SE offers CRA representation from €490/year.
• Competitor prices: kadano €999/year, Euverify GBP 590/year (prices verified October 2026).
• Appointment is not needed for EU-established manufacturers or some non-commercial open source stewards.
• The representative handles vulnerability reporting and communication with EU authorities.

Updated 18 October 2026 · 4 sources checked

Providers compared

Prices as published on each provider's website on 18 October 2026, excluding VAT unless stated. Each row links to its source.

What the Law Requires: CRA Article 18 and Your Obligations

The EU Cyber Resilience Act (CRA) introduces new obligations for manufacturers of products with digital elements. Article 18 of the CRA, enforceable from 11 September 2026, requires any manufacturer established outside the EU to appoint an authorised representative within the Union if they sell such products in the EU. This applies to both B2B and B2C sales, including SaaS, IoT, software, and hardware vendors.

• Who must appoint: Any non-EU manufacturer selling directly to EU buyers, regardless of whether the sale is to businesses or consumers.
• Who is exempt: Manufacturers already established in the EU, importers or distributors placing products on the market under their own name, and some non-commercial open source stewards (with reduced obligations).
• Legal basis: Article 18(1) CRA for the representative, Article 14 for vulnerability reporting, and Article 3 for scope of application.

The representative acts as the official point of contact for EU authorities, handling vulnerability reporting (Article 14) and market surveillance communications. Failure to appoint is a standalone infringement, subject to significant fines. For context, under GDPR, similar failures have led to fines up to EUR 525,000 (Locatefamily.com case).

Appointment must be in writing and specify the scope (Article 18(3)). The representative’s Member State determines which national CSIRT (Computer Security Incident Response Team) receives vulnerability reports. If you do not appoint, the importer or distributor may become the default contact, which can complicate sales and compliance.

For Swiss obligations, REP27 provides a free assessment with every paid plan, but only if all four Swiss criteria are met is a Swiss representative required. REP27 does not act as a Swiss representative but provides a declaration of exemption if not required.

How to Choose an Authorised Representative: Key Criteria and Provider Comparison

Choosing the right authorised representative is critical for compliance and smooth market access. Here are the main factors to consider:

• Legal entity and registration: Verify that the provider is a registered EU company. REP27 is Europe Services, SE, registered in Prague since 2014 (IČO 03571785).
• Mandate scope: The mandate should be strictly limited to Article 18(3) duties. No provider can legally cover Article 13 duties under the CRA.
• Transparency: Renewal prices and included services should be published and confirmed in writing before payment. REP27 publishes all renewal prices and scope upfront.
• Verification: Look for a verifiable certificate (e.g., QR code, public verification page) to demonstrate compliance to authorities and customers.
• Support and communication: Confirm the provider’s process for forwarding requests, supported languages, and response times. REP27 guarantees forwarding within two business days and provides privacy notice wording in 8 languages.

Compare what is included, not included, and any extra fees:

Always ask for a written breakdown of what is covered, especially if the provider does not publish this information. This avoids surprises and ensures you only pay for what you need.

What the Price Really Includes & Hidden Costs in CRA Representation

Most providers’ published prices cover only the legal mandate and basic communication duties. The largest costs in CRA compliance are usually internal: engineering, documentation, SBOM (Software Bill of Materials) generation, and ensuring a support period of at least five years for security updates. For important class II or critical products, a notified body assessment is required, which is far more expensive than the representative’s fee.

REP27’s pricing is transparent: €490/year for CRA only, €690/year for CRA+GDPR, and €990/year for CRA+GDPR+NIS2, with lower renewal rates. The mandate includes a written Article 18 appointment, a verifiable certificate, a staffed vulnerability reporting desk, and request forwarding. It does not include conformity assessment, testing, SBOM generation, or incident reporting—these are always the manufacturer’s responsibility or require a notified body.

Hidden costs to watch for:

• Silent renewals or unclear renewal pricing (common in the market).
• Per-request fees for forwarding authority communications or vulnerability reports.
• Limits on included services, such as number of requests or languages supported.
• Liability limits and exclusions buried in terms and conditions.

REP27 states all renewal prices upfront and lists exclusions clearly. Always request written confirmation of what is included and excluded before signing with any provider.

How Appointment Works: Step-by-Step Guidance and Decision Matrix

Appointing an authorised representative is a straightforward but essential process. Here’s a practical guide:

1. Assess your establishment: Confirm your company is established outside the EU and sells products with digital elements in the EU.
2. Check your obligations: Determine if your products fall under the CRA and if you are the manufacturer, not just an importer or distributor.
3. Choose a provider: Compare providers based on legal entity, price, scope, and transparency. Request written details of what is included.
4. Sign the mandate: Enter into a written agreement specifying Article 18 duties. REP27 issues the designation within 24 hours, with a verifiable certificate.
5. Update your compliance documents: Add the representative’s details to your technical files, privacy notices, and vulnerability reporting runbooks.
6. Prepare for reporting: Ensure your team knows the process for 24-hour vulnerability reporting starting 11 September 2026.

Decision Matrix

Always confirm in writing who is acting as the representative, especially if using importers or distributors.

Risks, Fines, and What Providers Usually Do Not Say

Risks of Non-Compliance: Not appointing an authorised representative can result in enforcement actions and substantial fines. Under GDPR, failure to appoint a representative led to a €525,000 fine for Locatefamily.com. The CRA provides for standalone infringements, and fines can reach up to EUR 10 million or 2% of worldwide annual turnover for non-compliance with Article 18.

What providers usually do not say:

• Mandate limitations: The representative’s role is strictly limited to forwarding communications and acting as a contact point. They do not perform conformity assessments, product testing, or SBOM generation—these are always the manufacturer’s responsibility.
• Exclusions: REP27 clearly lists what is not included: conformity assessment, testing, SBOM, and incident reporting. Many providers do not publish such exclusions, leaving buyers at risk of misunderstanding their obligations.
• Renewal and per-request fees: Silent renewals and hidden per-request fees are common. Always demand written confirmation of renewal prices and any additional charges.
• Liability: Representatives generally limit their liability to forwarding requests and providing documentation. They do not take on any engineering or security duties.
• Notice periods: Notice periods for termination or switching providers are rarely disclosed upfront. REP27 offers a switching price and a single renewal date for bundled mandates.

To avoid surprises, always request a detailed service description, including all exclusions and limitations, before committing to a provider.

Realistic Scenarios & Simplest Compliant Routes: Practical Examples

• US SaaS company: A SaaS provider based in the US sells subscriptions to EU customers. From 11 September 2026, it must appoint an EU authorised representative for CRA Article 18 duties. The simplest route is to choose REP27 for €490/year, which provides a written mandate, verifiable certificate, and a staffed reporting desk. The company adds the representative’s details to its privacy notice and vulnerability reporting runbook.
• Chinese Amazon seller: A Chinese manufacturer sells branded IoT devices on Amazon to EU customers. If Amazon acts as the importer of record, the obligation to appoint a representative falls on Amazon. If the seller is the manufacturer and sells under its own brand, it must appoint an authorised representative. REP27, kadano, or Euverify are options. The seller should confirm in writing with Amazon who is the economic operator.
• UK online shop: A UK-based retailer sells smart home devices to EU consumers. As a non-EU manufacturer, it must appoint an EU authorised representative for CRA compliance. REP27 offers bundled mandates (CRA+GDPR+NIS2) for €990/year, simplifying compliance across multiple regulations. The retailer signs the mandate, updates its compliance files, and prepares for 24-hour vulnerability reporting.

Checklist for Buyers

1. Confirm your company’s country of establishment and whether you are the manufacturer.
2. Determine if your products are sold in the EU and fall under the CRA.
3. Check if your importer or distributor is acting as the economic operator; if not, you must appoint a representative.
4. Compare providers for transparency, scope, and price. Request written confirmation of what is included and excluded.
5. Sign a written mandate and obtain a verifiable certificate.
6. Update your compliance documentation, privacy notices, and vulnerability reporting runbooks with the representative’s details.
7. Train your team on 24-hour vulnerability reporting obligations starting 11 September 2026.
8. Review renewal terms, notice periods, and any extra fees before committing.