REP27 · CRA · Authorised representative
Regulation (EU) 2024/2847 · article 18 · article 14
Most compliance pages would tell you this appointment is mandatory. It is not, and saying otherwise would be the fastest way to lose your trust. Article 18 says a manufacturer may, by written mandate, appoint an authorised representative. What makes it matter is Article 14: when a manufacturer has no main establishment in the Union, the CSIRT that receives the 24-hour report is determined first by the Member State of the authorised representative, then the importer, then the distributor. Without a mandate, the one thing you have to do in 24 hours starts with a question about where to send it.
Article 18Article 1424 hours11 September 2026Optional
Read the last row. A manufacturer outside the Union with no representative, no importer and no distributor of record has no predictable route, and the clock is 24 hours. The mandate is not a legal requirement; it is the difference between a procedure and a scramble.
A product with digital elements made available on the Union market, whose intended or reasonably foreseeable use includes a data connection. Medical devices, motor vehicles, aviation and marine equipment have their own regimes and are excluded.
Default, important class I or II, or critical, from Annexes III and IV. The class decides whether you self-assess or go through a notified body, and no representative changes that.
Optional under Article 18(1). The reason to sign is Article 14(8) and the reason not to is if you already have a main establishment in the Union.
A written mandate with an entity established in the Union, accepting at least the tasks in Article 18(3).
The EU declaration of conformity and the technical documentation at the disposal of market surveillance for ten years or the support period, whichever is longer.
| Task | What it means in practice |
|---|---|
| Keep the EU declaration of conformity available | We hold the copy you give us and produce it on a reasoned request |
| Keep the technical documentation available | Same, for ten years or the support period, whichever is longer |
| Provide information on a reasoned request | Everything necessary to demonstrate conformity, in the language of the authority |
| Cooperate on corrective action | On any measure taken to eliminate the risks of the product covered by the mandate |
| Produce the mandate itself | To market surveillance authorities on request |
December 2024, with a phased application that is the reason for the confusion in the market.
The reporting obligations apply: actively exploited vulnerabilities and severe incidents, through the single reporting platform run by ENISA.
The provisions on notified bodies apply, which is what allows conformity assessment bodies to be designated in time.
The regulation applies in full: essential requirements, CE marking, technical documentation, the lot.
Reporting obligations reach products made available before December 2027 as well. That surprises people, and it is in the text.
The practical consequence for a manufacturer outside the Union is that the reporting route needs to exist before September 2026, while the full conformity work has until the end of 2027. Those are different projects with different lead times, and treating them as one is why teams start late on both.
A manufacturer outside the Union with no main establishment there, selling products with digital elements into Europe, whether hardware with firmware or software sold commercially.
A company whose European route to market is through resellers or marketplaces, where no single importer would obviously receive a report.
Anyone who has read Article 14(8) and does not want the first 24 hours of an incident spent identifying an authority.
A manufacturer with a real main establishment in the Union. The reporting route already runs through that Member State.
Products excluded from the regulation: medical devices, in vitro diagnostics, motor vehicles, civil aviation and marine equipment, each with their own regime.
Free and open-source software developed or supplied outside a commercial activity, which is largely outside the regulation.
| We do | We do not |
|---|---|
| Sign the Article 18 mandate within 24 hours of the intake call | Perform conformity assessment: that is a notified body's role for important class II and critical products |
| Hold the declaration of conformity and technical documentation | Draw them up. Article 18(2) puts that with the manufacturer |
| Produce them to market surveillance on a reasoned request | Report your vulnerabilities: the 24-hour warning needs facts only your team has |
| Cooperate on corrective measures | Design your security or generate your SBOM |
| Issue a certificate with a verification code | Issue a CE mark or anything resembling one |
| Answer in eight languages, same working day | Advise on national implementing measures |
The appointment is optional and it is the cheapest insurance in the regulation. It costs €490 a year, takes 24 hours, and it fixes in advance the single question you cannot afford to research during an incident: which CSIRT receives the report. Everything else the CRA asks of you — secure design, vulnerability handling, the SBOM, the support period, the documentation, the reporting itself — stays inside your company, and any provider telling you otherwise has not read Article 18(2).
A manufacturer selling a connected device into Europe rarely has only this obligation. Seeing them together prevents the two classic mistakes: paying twice for the same thing, and discovering the fourth one during an audit.
| Regulation | What it governs | Representative | Where it shows |
|---|---|---|---|
| Cyber Resilience Act | Security of the product with digital elements | Optional, Article 18 | Technical documentation and the reporting route |
| GPSR 2023/988 | Physical safety of the product | Mandatory, Article 16 | Printed on the label |
| GDPR 2016/679 | Personal data of people in the Union | Mandatory, Article 27 | Privacy notice |
| Data Act 2023/2854 | Access to data generated by product use | Mandatory if not established in the Union | Pre-contractual information |
| NIS2 2022/2555 | Security of services you operate | Mandatory, Article 26(3) | Entity registration |
Only one of those five is optional, and it is this one. That is worth saying plainly, because a market that describes every mandate as compulsory eventually gets ignored. The reason to sign the CRA mandate is operational, not legal: it removes a variable from the worst 24 hours your team will have.
Hardware, firmware, standalone software, and whether any remote data processing is integral to the product.
Default, important I or II, critical, from Annexes III and IV. This decides your assessment route and your timeline, not the mandate.
If a real entity of yours is, the reporting route already runs through it and you do not need this.
Direct, through resellers, through marketplaces. Where no single importer of record exists, the mandate matters more.
Article 27, Article 16, NIS2 or Data Act designations, so that renewal dates and correspondence land in one place.
Because Article 14(8) does not leave the question open. Without a representative, your report is routed through the importer or the distributor's Member State, meaning a CSIRT you did not choose, in a language you may not operate in, reached through a partner you now depend on during an incident. The mandate replaces that chain with one known address, decided calmly in advance.
A distributor can be the routing point by default, but it has not agreed to be your compliance interface, it holds none of your technical documentation and it has no duty to answer market surveillance about your product. Relying on it is relying on somebody else's goodwill on the worst day of your year.
The Cyber Resilience Act does not require you to appoint anyone, and we will not pretend otherwise. What it does is decide, in Article 14(8), that a manufacturer without an establishment in the Union reports through the Member State of its authorised representative, failing that its importer, failing that its distributor. Signing the Article 18 mandate replaces a chain you do not control with one address you chose. It costs €490 a year, takes 24 hours, covers retention of your documentation and cooperation with market surveillance, and expressly cannot cover the design, vulnerability handling and documentation duties that Article 18(2) leaves with you.
No. Article 18(1) says a manufacturer may appoint one by written mandate. It differs from the medical devices and radio equipment regimes, where the appointment is required.
Article 14(8): where a manufacturer has no main establishment in the Union, the CSIRT receiving the 24-hour report is determined first by the Member State of the authorised representative.
Keeping the declaration of conformity and technical documentation available for ten years or the support period, providing information on reasoned request, cooperating on corrective measures, and producing the mandate itself.
Article 18(2) excludes the substantive manufacturer obligations in Article 13. Secure design, vulnerability handling and drawing up the documentation stay with you.
11 September 2026. The regulation applies in full from 11 December 2027.
Actively exploited vulnerabilities and severe incidents affecting the security of the product, through the single reporting platform.
The reporting obligations reach products with digital elements made available on the market, including those placed before December 2027.
Medical devices, in vitro diagnostics, motor vehicles, civil aviation and marine equipment, which are covered by their own legislation.
Up to €15 million or 2.5% of worldwide annual turnover for breaches of the essential requirements and the manufacturer obligations.
For important class II and critical products, yes. Default products are self-assessed under module A. The representative has no role in assessment.
Yes, as part of the vulnerability handling requirements in Annex I, part II. It is generated by your build process, not by us.
At least five years, unless the expected product lifetime is shorter, and it must be communicated to the user.
No. The early warning needs facts only your team holds, and the platform is designed for the manufacturer to use.
They apply to different things: the CRA to products you sell, NIS2 to services you operate. A company can be caught by both.
Software developed or supplied outside a commercial activity is largely outside the regulation, with a lighter regime for open-source stewards.
Any Member State. It becomes the state whose CSIRT coordinates your reporting, so consistency with your other mandates helps.
Within 24 hours of a short intake call confirming the product class and scope.
€490 a year for the CRA mandate, with a combined price when held with the other designations.
Related: the reporting clock · what is in scope
Europe Services, SE in Prague as your Article 18 authorised representative, signed within 24 hours, holding your documentation and answering market surveillance in eight languages.
Request this service