CRA authorised representative under Art. 18: tasks and when it pays off

What is a CRA authorised representative under Art. 18?

A CRA authorised representative is a person or company established in the EU that performs certain tasks on behalf of a manufacturer, above all vis-à-vis the authorities. Art. 18 of Regulation (EU) 2024/2847, the Cyber Resilience Act, allows manufacturers to appoint such a representative. The appointment is generally voluntary. Art. 18 applies from 11 December 2027.

Three features define the role of the CRA authorised representative:

• Established in the EU: The authorised representative must be resident or established in the EU. It can be an individual or a company.
• Written mandate: The manufacturer appoints the authorised representative by written mandate. The authorities can request a copy of this mandate.
• Acting on behalf of the manufacturer: The authorised representative performs the tasks specified in the mandate and acts for the manufacturer in doing so.

The role is also often referred to as the EU authorised representative, and the English version of the Regulation uses the term "authorised representative". Both refer to the same role.

The authorised representative is of particular interest to manufacturers based outside the EU. The Cyber Resilience Act also covers them insofar as their products with digital elements are made available on the EU market, such as connected devices or software.

Whether an economic operator responsible in the EU is also required depends on other product legislation. For certain product groups, this is required by the EU Market Surveillance Regulation (EU) 2019/1020, but this obligation does not follow from the CRA alone.

The manufacturer specifies in the mandate exactly what the authorised representative takes on.

What are the tasks of a CRA authorised representative?

A CRA authorised representative, also known as an EU authorised representative, performs the tasks that the manufacturer specifies in the written mandate. Art. 18 CRA prescribes three minimum tasks, whereas certain key manufacturer obligations may not be delegated. Art. 18 applies from 11 December 2027.

Depending on the procedure used to assess the conformity of the product, the manufacturer can additionally delegate individual administrative tasks to the authorised representative. The mandate thus determines, within the statutory limits, which obligations under the Cyber Resilience Act the authorised representative assumes.

The three tasks the mandate must cover as a minimum

The mandate must enable the authorised representative to perform these three tasks vis-à-vis the market surveillance authorities, i.e. the authorities that monitor product safety in the EU:

• Keeping documents available: The authorised representative keeps the technical documentation and the EU declaration of conformity available to the authorities. With the declaration of conformity, the manufacturer confirms that its product meets the requirements. The documents must remain available for at least ten years after the product has been placed on the market or for the support period, whichever is longer. During the support period, the manufacturer must deal with security vulnerabilities in the product.
• Providing information: If an authority makes a reasoned request for evidence, the authorised representative provides all the information and documentation needed to demonstrate that the product meets the requirements.
• Cooperating on risks: At the request of the authorities, the authorised representative cooperates in any action taken to eliminate risks posed by a product covered by its mandate.

Which obligations remain with the manufacturer

Responsibility for the conformity of the product remains with the manufacturer, as do the key manufacturer obligations that Art. 18 CRA excludes from delegation. The manufacturer itself remains responsible for ensuring that its product meets the security requirements of the CRA and is designed and manufactured accordingly.

This also includes drawing up the technical documentation, assessing the conformity of the product and ensuring that every unit from series production meets the requirements. For the EU declaration of conformity and the CE marking, the authorised representative can take on individual administrative tasks if the mandate expressly provides for this. It then acts on behalf of and under the responsibility of the manufacturer.

The reporting obligation for actively exploited vulnerabilities and serious security incidents has applied since 11 September 2026 and is addressed to the manufacturer. Reports can be submitted by persons whom the manufacturer has authorised to do so on the reporting platform of ENISA, the EU Agency for Cybersecurity. This role on the platform, referred to there as "Assigned Representative", is not automatically an authorised representative under Art. 18.

The authorised representative is therefore the authorities' point of contact, while the manufacturer continues to bear responsibility for the product.

When is a CRA authorised representative worthwhile?

A CRA authorised representative is particularly useful for manufacturers based outside the EU that offer their products on the EU market. It is the point of contact for market surveillance authorities in the EU, and its seat can help determine which body coordinates the manufacturer's reports. Art. 18 CRA applies from 11 December 2027.

An authorised representative offers these advantages to manufacturers outside the EU that sell in the EU:

• Point of contact in the EU: Market surveillance authorities can address requests for evidence and requests for cooperation to a body in the EU that knows the manufacturer and its products. They can still contact the manufacturer directly.
• Influence on the competent reporting body: If a manufacturer has no main establishment in the EU, the seat of its authorised representative can determine which CSIRT coordinator is competent, i.e. which national body coordinates reports on vulnerabilities and security incidents. The prerequisite is that the authorised representative acts for most of the manufacturer's products.
• Documents available to the authorities: The authorised representative keeps the declaration of conformity and technical documentation available to the authorities throughout the entire retention period. Art. 18 does not specify where the documents must be stored.

Which CSIRT coordinator is competent follows a fixed order and cannot be freely chosen. The first criterion is the manufacturer's main establishment in the EU, i.e. the location where decisions related to the cybersecurity of its products are predominantly taken. If this location cannot be determined or these decisions are taken outside the EU, the EU establishment with the highest number of employees is decisive.

Only if the manufacturer has no main establishment in the EU does the authorised representative acting for the largest number of products come into play. This is followed by the importer and the distributor with the largest number of the manufacturer's products and, finally, the EU Member State with the highest number of users. In each case, the information available to the manufacturer is decisive. This order has already applied since 11 September 2026.

For manufacturers outside the EU, an authorised representative thus creates a permanent presence in the EU, the benefit of which depends in each case on the product portfolio and distribution structure.

What should the mandate of a CRA authorised representative contain?

Art. 18 CRA governs the written appointment, the three minimum tasks and which manufacturer obligations cannot be delegated. Manufacturers and authorised representatives should therefore agree contractually themselves on what happens if the authorised representative changes, if the mandate is terminated or when the cooperation ends.

The mandate is a long-term commitment. The documents must remain available for at least ten years after the product has been placed on the market or for the support period, whichever is longer. For long-lived industrial products, these can be very long periods. Although Art. 18 does not apply until 11 December 2027, a mandate concluded today extends well beyond that date.

Art. 18 does not contain a general obligation to register or deposit the mandate with an authority in advance. The authorised representative provides a copy to the market surveillance authorities on request. This is distinct from the registration of users on the ENISA reporting platform.

These five points belong in the mandate of a CRA authorised representative:

• Products and responsibilities: specify exactly which products and versions the mandate covers and who performs which tasks.
• Access to documents: ensure that the declaration of conformity and technical documentation remain available throughout the entire retention period.
• Procedures for authority requests: define how requests for information and cooperation from the authorities are handled and how they quickly reach the manufacturer.
• Change, termination and handover: agree contractually on what happens at the end of the mandate, including the handover of documents.
• Liability and recourse: agree contractually who is responsible for what between manufacturer and authorised representative. Art. 18 does not contain its own liability model, and once the new Product Liability Directive (EU) 2024/2853 has been transposed, the authorised representative may, under certain conditions, also be liable for manufacturers outside the EU.

The first three points arise from the tasks of the authorised representative, while the law itself does not govern the last two. Both are part of a careful implementation of the Cyber Resilience Act.

Conclusion: a CRA authorised representative pays off for manufacturers outside the EU

The authorised representative under the CRA represents a manufacturer in the EU vis-à-vis the market surveillance authorities. The mandate specifies what it takes on within the statutory limits, while responsibility for the conformity of the product remains with the manufacturer. For manufacturers outside the EU, it is a permanent point of contact in the EU, and if there is no main establishment in the EU, its seat can help determine the competent CSIRT coordinator.

Anyone appointing an authorised representative should agree on responsibilities, changes and liability in the contract.

ISiCO as your CRA authorised representative

We advise companies on implementing the Cyber Resilience Act and are also available to manufacturers outside the EU as authorised representatives under Art. 18 CRA. If a manufacturer has no main establishment in the EU and ISiCO acts as authorised representative for most of its products, the German CSIRT coordinator is generally competent: CERT-Bund at the Federal Office for Information Security (BSI). Mandatory reports are submitted via ENISA's central reporting platform.

As your authorised representative, we take on the following tasks in particular:

• Keeping documents available: We keep your technical documentation and EU declaration of conformity available to the authorities throughout the entire retention period.
• Point of contact for the authorities: We receive requests from market surveillance authorities and provide the evidence requested.
• Cooperation on risks: We work with the authorities when risks posed by your products need to be eliminated, in close coordination with you.

Independently of this, we can also act as your EU representative under Art. 27 GDPR on request. This is a separate role with its own legal basis and its own mandate.

Looking for a CRA authorised representative in the EU? Get in touch.

Frequently asked questions

#1 Can our European subsidiary act as authorised representative itself?

Yes, a European subsidiary can take on the role of CRA authorised representative. The Cyber Resilience Act only requires establishment in the EU and a written mandate. It does not require independence from the manufacturer and does not exclude group companies. Within a group, too, the mandate must be in writing, as market surveillance authorities can request a copy.

#2 What is the difference between the CRA authorised representative and the EU representative under the GDPR?

The CRA authorised representative is the point of contact for market surveillance authorities on product safety, while the EU representative under Art. 27 GDPR is the point of contact for data protection supervisory authorities and data subjects. The two roles are based on different legal bases. An EU representative may be required for companies without an establishment in the EU if their data processing falls under Art. 3(2) GDPR, for example because they offer goods or services to people in the EU, and no exemption applies. The same person or company can take on both roles, but the CRA role requires a separate written mandate.

#3 Is an authorised representative also worthwhile for pure software manufacturers?

For software manufacturers outside the EU, a CRA authorised representative can be useful for the same reasons as for hardware manufacturers. The Cyber Resilience Act applies to software as well as to connected devices, including the reporting obligations for vulnerabilities and security incidents. An authorised representative is the point of contact for market surveillance authorities in the EU. Its seat only counts for determining the competent CSIRT coordinator if the manufacturer has no main establishment in the EU and the authorised representative acts for most of its products.

#4 Does one authorised representative cover the entire product portfolio, or do we need several?

A manufacturer can appoint different authorised representatives for different products. The written mandate should then clearly specify which products and versions it covers. If there are several authorised representatives, the decisive factor for the competent reporting body is which of them acts for most of the manufacturer's products.