Article 18 · pricing · scope of service
Nobody in this market publishes prices, which is convenient for the seller and useless for the buyer. Ours is €490 a year for the Article 18 mandate, less when it sits alongside your other designations, and this page sets out exactly what that buys. It also sets out what it does not buy, because the expensive parts of Cyber Resilience Act compliance are conformity assessment and engineering, and no representative can absorb either.
€490RenewalMulti-mandateNo assessmentNo testing
The mandate is the smallest line on that chart and the only one we sell. If your product is important class II or critical, the notified body assessment will cost more than everything else on this page put together, and you should budget for it first.
| What you take | First year | Renewal |
|---|---|---|
| CRA authorised representative alone | €490 | €440 |
| CRA and Article 27 GDPR representative | €690 | €590 |
| CRA, Article 27 and NIS2 | €990 | €850 |
| Adding the Article 16 GPSR responsible person | +€200 | +€180 |
| Switching from another provider | Switch price | Standard renewal |
One invoice, one renewal date, and the renewal price stated before you pay the first one. That last point separates this market more than any feature list: a first year at a token price with a silent renewal is the standard trick, and asking the question in writing is the standard defence.
Self-assessment. The cost is internal engineering time: essential requirements, documentation, SBOM, update mechanism, support period commitment. The external spend can be close to zero beyond the mandate.
Free if you apply harmonised standards in full; a notified body route if you do not. The standards work is the variable.
Always a notified body. Budget in the thousands, plan for months, and start before the queue forms in 2027.
Notified body and possibly a European cybersecurity certification scheme. The most expensive route, for a short list of products.
The support period is the hidden cost: at least five years of security updates, resourced and budgeted like a product line rather than a project.
Ours is Europe Services, SE, IČO 03571785, Prague, in the Czech commercial register since 2018. Check it before you pay.
It should be. A mandate claiming to cover Article 13 duties is claiming something Article 18(2) forbids.
In writing, before the first invoice. Ours is on this page.
A code checkable on a public page, without contacting the provider.
Ask for the process, the languages and the hours. Vagueness here is the whole risk.
A provider that cannot list exclusions has not thought about scope, which is the part you are actually buying.
The honest framing: this is a one-page document plus a duty to answer. It is cheap because it should be, and it is worth signing because of what it prevents rather than what it contains.
| What it prevents | Cost if it happens |
|---|---|
| Spending the first hours of an incident finding the right CSIRT | Part of a 24-hour deadline you cannot extend |
| Documentation requests reaching an office in another time zone | Days added to a market surveillance exchange |
| Procurement stalling on "who represents you in the EU?" | Weeks in an enterprise sales cycle |
| A distributor being treated as your reporting route by default | Reports going somewhere you do not control |
| Four mandates on four renewal dates with four providers | One lapsing quietly, which is the failure we see most |
€490 a year, €440 on renewal, less in a bundle, for a written Article 18 mandate, retention of your declaration of conformity and technical documentation for ten years or the support period, cooperation with market surveillance, a verifiable certificate and a desk that answers in eight languages. Conformity assessment, testing, SBOM generation and incident reporting are not included and cannot be, and any provider pricing them into a representative mandate is selling you something the regulation does not allow it to perform.
Companies underestimate this in a predictable pattern: they budget for the certificate and forget the five years of updates behind it.
| Line | Typical size | Who provides it |
|---|---|---|
| Representative mandate | Hundreds per year | Us |
| Notified body assessment | Thousands, per product family | A designated conformity assessment body |
| Security testing | Thousands per engagement | Specialist security firms |
| SBOM tooling and pipeline work | Engineering time | Your team |
| Update infrastructure | Engineering time, then ongoing | Your team |
| Five years of security updates | The largest line, spread over years | Your team |
| Documentation and DoC | Weeks of technical writing | Your team, possibly with a consultant |
The honest ratio: the mandate is roughly one per cent of what CRA compliance costs a hardware company, and it is the only line we can sell you. We would rather you knew that before signing than felt misled after.
You do not need this mandate. The reporting route already runs through your Member State.
Medical devices, vehicles, aviation, marine equipment. Different regimes, different providers.
Largely outside the regulation. Buying a mandate would be paying for nothing.
Classify first. If you turn out to be important class II, the notified body engagement matters far more than this.
Nobody sells that legitimately. The report needs facts only your team has.
The CRA does not produce one. The CE mark and the declaration of conformity are what exist.
Yes, annual, for as long as you place products with digital elements on the Union market without an establishment there. It ends the day either fact changes, and we terminate rather than renew when you tell us. There is no multi-year lock-in and no penalty for leaving, because a statutory relationship should never be a trap.
Not a fine: the appointment is optional, so there is no penalty for its absence. The downside is operational. Your 24-hour report is routed through whichever importer or distributor sits in the chain, market surveillance requests reach an office in another time zone, and enterprise procurement stalls on a question you cannot answer with a document. That is a small annual cost against a set of avoidable delays.
€490 for the first year, €440 on renewal, and less when the mandate sits beside your Article 27, NIS2 or GPSR designations. What that buys is the written Article 18 mandate, retention of your declaration of conformity and technical documentation for ten years or the support period, cooperation with market surveillance, a certificate anyone can verify and a desk that answers in eight languages the same working day. What it does not buy is conformity assessment, testing, SBOM generation, secure development work or incident reporting, because Article 18(2) puts those with the manufacturer and no amount of money moves them.
| Line to compare | What a good answer looks like |
|---|---|
| Legal entity and registration number | A named company you can find in a national register |
| First year and renewal together | Both stated in writing before you pay anything |
| Scope of the mandate | Article 18(3) tasks, with Article 13 duties expressly excluded |
| Retention period | Ten years or the support period, whichever is longer |
| Verification | A code checkable on a public page without contacting the provider |
| Languages | The ones market surveillance actually writes in |
| Termination | On notice, without penalty |
The countersigned mandate and a certificate carrying a verification code, ready to send to a customer or an auditor who asks who represents you in the Union.
You send us the declaration of conformity and the technical documentation for the products covered, and we hold them for the retention period.
Our Member State becomes the coordinating CSIRT for your reports under Article 14(8). Write it next to the deadline, not in a folder.
Market surveillance requests reach us, are logged the day they arrive, answered procedurally and forwarded to you the same working day.
A reminder ahead of the date, aligned with your other designations, so nothing lapses in a month nobody watched.
€490 for the first year and €440 on renewal, with lower combined prices when held together with the GDPR, NIS2 or GPSR mandates.
No. The mandate covers the products listed in it, and there is no per-model fee.
The written Article 18 designation, retention of the declaration of conformity and technical documentation, cooperation with market surveillance, a verifiable certificate and a multilingual desk.
Conformity assessment, testing, SBOM generation, secure development work, incident reporting and legal advice.
For important class II and critical products, always. For important class I, only where harmonised standards are not applied in full.
It varies by product and body, and it is typically the largest line in a CRA budget. We do not sell it and cannot quote it.
No. Article 18 makes it optional. It becomes valuable because Article 14 uses it to determine your reporting route.
Yes, on notice. There is no multi-year commitment and no penalty for leaving.
No. Receiving, logging, answering procedurally and forwarding is what the annual price covers.
Each manufacturer signs its own mandate. We issue them separately on one invoice.
Yes, for companies moving an existing mandate from another provider, with no gap in coverage.
Twelve months, renewable, terminable on notice by either side.
One invoice at the stated renewal price, on the same date as your other designations with us.
Yes, for ten years or the support period, whichever is longer, and we produce it on a reasoned request.
No. Article 18(2) puts that with the manufacturer, and it is not a service we offer.
Then do not buy the mandate. We would rather establish that on the intake call than sell you a designation you will cancel.
Within 24 hours of the intake call, with a certificate carrying a verification code.
The Czech Republic, where Europe Services, SE is established. That state's CSIRT becomes your coordinating recipient.
Related: the mandate explained · scope and classes
€490 a year for the Article 18 mandate with Europe Services, SE in Prague, renewal at €440, and a written list of what is excluded.
Request this service