Cyber Resilience Act Authorized Representative: Obligations, Prices & Selection (2026)

• Obligation for non-EU producers selling in the EU (art. 18 CRA)
• Published prices: from €490 to €999/year (October 2026)
• Representative manages relations, documentation, and authority notifications
• Does not include assessments, tests, or SBOM: only mandate and forwarding
• Provider comparison with transparent prices: REP27, Kadano, Euverify
• Fines up to €10 million or 2% of global turnover

Updated 23 October 2026 · 8 sources checked

Providers compared

Prices as published on each provider's website on 23 October 2026, excluding VAT unless stated. Each row links to its source.

Legal Requirements: CRA Representative Obligation (art. 18)

The Cyber Resilience Act (CRA) introduces a new obligation for all producers of products with digital elements who are not established in the European Union but intend to place such products on the EU market. According to article 18, these producers must appoint a authorized representative through a written mandate. The representative acts as a single point of contact between the non-EU producer and European surveillance authorities, with specific responsibilities:

• Maintain the EU declaration of conformity and technical documentation for at least 10 years after marketing or for the entire declared support period, if longer.
• Provide information and documentation to surveillance authorities upon request, demonstrating product compliance.
• Cooperate with authorities to eliminate risks associated with digital products covered by the mandate.

The law applies to all producers regardless of country of origin if the products are intended for the EU market (source). Importers, distributors, and marketplaces not acting as producers are not subject to this obligation. Failure to appoint a representative can result in fines up to €10 million or 2% of global turnover, in addition to marketing bans.

The appointment is not just a formality: authorities can request technical documentation and the declaration of conformity at any time via the representative. In case of security incidents, the representative must be able to promptly respond to competent authorities' requests.

How to Choose the CRA Representative: Criteria, Comparison, and Differences

Choosing the authorized representative for the CRA is strategic, both for compliance and efficient management of authority requests. Key criteria to consider include:

• Mandate clarity: The mandate must be limited to responsibilities under art. 18, without unauthorized extensions (e.g., assessments or tests assigned by law to others).
• Transparent pricing: Ensure the price is published and renewal terms declared upfront to avoid surprises in following years.
• Verifiable certificate: Prefer providers offering a public and verifiable certificate (e.g., QR code) to prove appointment during audits or checks.
• Forwarding process: Ask how authority requests are handled, in which languages, and expected response times.
• Exclusions and limits: A reputable provider clearly lists what is included and excluded, avoiding ambiguity on assessments, tests, SBOM, or technical support.

Comparison table of inclusions/extra fees:

Also consider additional services like product catalog screening (useful for many references) and the possibility to cover multiple regulations (e.g., GDPR, GPSR) with one provider.

What the Price Really Includes: Visible and Hidden Costs

Published prices from providers cover exclusively the written representation mandate and management of surveillance authority requests. They do not include:

• Compliance assessments (task of notified bodies, not the representative)
• Security testing, SBOM generation, or technical support
• Preparation or review of technical documentation
• Legal consulting or training (unless specifically offered, e.g., Comply.Land)

Inclusions table:

Beware of hidden costs: some providers do not publish renewal prices or apply fees for extra requests, provider changes, or out-of-mandate services. Always request a written offer including renewal price and termination conditions.

Finally, note that the representative cost is only a small part of CRA compliance: major expenses relate to technical adjustments, documentation generation, and for higher-class products, certification by notified bodies.

Hidden Costs and What to Ask Before Signing

Before signing a mandate with a provider, clarify these points to avoid surprises:

• Renewal price: Request it clearly stated in the contract or written offer, not only on the website.
• Extra request fees: Check for additional costs for handling out-of-hours requests, urgencies, or provider changes.
• Mandate scope: The mandate must cover only art. 18; offers including assessments, tests, or other services conflict with the regulation.
• Verifiable certificate: A public certificate (e.g., QR code) helps prove appointment during audits or authority requests.
• Response times: Ask about forwarding times for requests and whether the service operates during holidays and outside business hours.

Decision table:

Always ask for a written list of what is included, excluded, and any extra fees. A transparent provider will provide this information without hesitation.

How the Appointment Works: Step by Step and Practical Checklist

The CRA representative appointment follows a clear procedure, which you can start well before sanctions come into effect (December 2027):

1. Verify your status: Are you a non-EU producer selling digital products in Europe? If yes, proceed.
2. Identify covered products: Map all digital products intended for the EU market and verify they fall within the CRA scope.
3. Prepare documentation: Prepare the EU declaration of conformity and technical documentation required by the regulation.
4. Select the provider: Choose from providers with published prices and transparent mandates (see table above).
5. Request the mandate: Fill out the online form or send a written request. Receive the signed mandate (often with eIDAS electronic signature).
6. Register the representative: Enter representative data in your internal policies, runbook, and technical documentation.
7. Operational management: In case of authority requests, the representative receives and forwards communication within expected times (e.g., 2 working days for REP27).

Checklist for today:

1. Verify your legal status and served markets
2. Gather and update technical documentation
3. Request quotes from multiple providers
4. Compare inclusions, exclusions, and renewal prices
5. Sign the mandate and update your internal procedures

Risks, Fines, and What Happens Without a Representative

Failure to appoint an authorized representative entails significant risks:

• Fines: Up to €10 million or 2% of global turnover, whichever is higher (source).
• Marketing ban: Products may be withdrawn from the EU market or blocked at customs.
• Delays and inefficiencies: Without a clear contact point, authority requests may reach distributors, customers, or importers, causing delays and reputational damage.
• Complications in incidents: In case of vulnerabilities or security incidents, lacking a representative can slow response and worsen legal and commercial consequences.

Decision scenario:

Timely appointment reduces sanction risks and ensures quick handling of authority requests, crucial in security incidents with tight deadlines (e.g., 24 hours for exploited vulnerability notification).

What Providers Usually Don’t Say: Limits, Exclusions, Risks

Many providers do not highlight key aspects of CRA representation service:

• Assessments and tests excluded: No representative can perform compliance assessments, security tests, or generate SBOMs: these are separate tasks, often much costlier, assigned to notified bodies or the producer.
• Mandate limited by law: The mandate must cover only art. 18; any extension (e.g., managing art. 13 obligations) is prohibited by the regulation.
• Renewal price not always transparent: Some providers do not publish renewal prices or charge fees for provider changes or extra requests.
• Limited liability: The representative is responsible only for forwarding and document retention, not for technical compliance or product security.
• Response times and languages: Not all providers specify response times or supported languages: a crucial detail for effective authority request management.

Always request a written list of exclusions and service conditions to avoid misunderstandings and non-compliance risks.

Practical Scenarios: Three Real Examples and the Simplest Solution

• USA SaaS: A US company offers cloud software to EU clients. It must appoint a CRA representative, prepare technical documentation and declaration of conformity. It can choose a provider with a transparent mandate and fixed price (e.g., REP27 or Euverify). No assessment needed if the product is basic class and harmonized standards apply.
• Amazon Seller China: A Chinese manufacturer sells IoT devices on Amazon to EU customers. It must appoint a CRA representative even if the marketplace handles logistics. The representative must be indicated in technical documentation and product policies. The marketplace does not cover this obligation.
• UK Online Shop: A UK online store sells smart hardware in the EU. Post-Brexit, it is considered non-EU and must appoint a CRA representative, prepare documentation, and choose a provider with verifiable mandate. If also selling on marketplaces, it remains responsible as producer.

In all cases, the simplest solution is to choose a provider with published price, written mandate, and fast appointment process (e.g., REP27: designation in 24 hours, QR certificate, fixed price).