Roles

The CRA Authorised Representative (Article 18): What It Is, What It Isn't, and Whether You Need One

Last updated · July 21, 2026

This article is general guidance on the Cyber Resilience Act, not legal advice. Confirm specifics against Regulation (EU) 2024/2847 and seek qualified legal counsel for your situation.

Key points

Under the CRA, appointing an EU authorised representative is optional - unlike the Medical Devices Regulation (MDR Art. 11) or the Radio Equipment Directive (RED Art. 5), which make it mandatory for non-EU manufacturers.
An authorised representative is a formally appointed administrative contact point, not a compliance shortcut. The manufacturer keeps full responsibility for the substantive cybersecurity obligations.
The written mandate must at minimum cover four specific tasks set out in Article 18(3) - but it cannot delegate the core Article 13 obligations.
Even though appointment is optional, there are practical reasons why many non-EU manufacturers choose to appoint one - including CSIRT routing for the Article 14 reporting obligations that start 11 September 2026.
The authorised representative is a distinct economic operator from the importer. The two roles are often confused but carry different duties and arise in different ways.

The first thing most people get wrong: it is not mandatory

If you have worked with EU medical devices or radio equipment, your instinct will be that a non-EU manufacturer must appoint an EU authorised representative before placing products on the market. That instinct is wrong for the CRA.

Under Article 18(1) of Regulation (EU) 2024/2847, a manufacturer may, by written mandate, appoint an authorised representative - the appointment is explicitly optional. The Commission's own summary of the legislative text confirms that "the manufacturer may appoint, by written mandate, an authorised representative, to perform some of the tasks of the manufacturer."

This is a deliberate policy choice, and it matters. Compare it with the MDR: under Article 11 of Regulation (EU) 2017/745, where the manufacturer of a device is not established in a Member State, the device may only be placed on the Union market if the manufacturer designates a sole authorised representative. The Radio Equipment Directive takes the same mandatory approach. The CRA does not.

Why does the CRA take a different line? Partly because the CRA already places direct obligations on importers and distributors - economic operators who are already present in the EU supply chain. The regulation does not need to force a separate representative into every supply chain to ensure there is always an EU-established party who can be held accountable.

That said, "optional" does not mean "irrelevant." There are good practical reasons to appoint one, which we cover below.

What an authorised representative actually is

Under the CRA, an "authorised representative" means a natural or legal person established within the Union who has received a written mandate from a manufacturer to act on its behalf in relation to specified tasks.

The key words are established within the Union and written mandate. The authorised representative must be physically based in the EU (or EEA). The mandate must be in writing - a verbal arrangement or a general agency agreement does not qualify. And the mandate defines the scope: the authorised representative only does what the mandate says.

Think of it as an administrative bridge. An authorised representative is an EU-established party a non-EU manufacturer can appoint to hold technical documentation and act as the point of contact for market surveillance authorities - it is an administrative bridge, not a transfer of liability; the manufacturer remains responsible for actual compliance.

What the mandate must cover - and what it cannot

The four minimum tasks (Article 18(3))

The CRA sets a floor. Whatever else the mandate says, it must at minimum allow the authorised representative to:

Keep the documentation available. Hold the EU Declaration of Conformity and the technical documentation at the disposal of market surveillance authorities for at least 10 years after the product with digital elements has been placed on the market, or for the support period, whichever is longer.
Provide information on reasoned request. On a reasoned request from a market surveillance authority, provide all the information and documentation necessary to demonstrate the conformity of the product.
Cooperate on risk-elimination actions. Cooperate with market surveillance authorities on any actions taken to eliminate risks posed by the product.
Provide a copy of the mandate. Provide a copy of the mandate to market surveillance authorities upon request.

These four tasks are the minimum. The mandate can go further - for example, it can authorise the authorised representative to handle Article 14 vulnerability and incident reporting on the manufacturer's behalf, which is practically useful for non-EU manufacturers who want a single EU-based reporting contact.

What the mandate cannot include

This is the critical constraint. The obligations laid down in Article 13(1) to (11), Article 13(12) first subparagraph, and Article 13(14) shall not form part of the authorised representative's mandate.

In plain terms: the core manufacturer obligations cannot be delegated. The authorised representative cannot be made responsible for:

Ensuring the product meets the essential cybersecurity requirements in Annex I (secure-by-design, vulnerability handling, SBOM, etc.)
Drawing up the technical documentation
Carrying out or commissioning the conformity assessment
Signing the EU Declaration of Conformity

An authorised representative does not sign the EU Declaration of Conformity; under Article 28 the act of declaring conformity stays with the manufacturer, though the authorised representative may be named on the DoC and hold it for authorities.

The manufacturer cannot outsource its way out of CRA compliance by appointing an authorised representative. If the product does not meet the essential requirements, the manufacturer is liable - not the representative.

The authorised representative holds documents and liaises with authorities. It does not — and legally cannot — take on the manufacturer's obligation to build a secure product, maintain an SBOM, handle vulnerabilities, or draw up the technical documentation. Appointing one does not substitute for doing the compliance work.

Authorised representative vs importer vs distributor

These three economic operators are frequently confused. The table below sets out the key differences. For a full treatment of importer and distributor obligations, see our post on what importers and distributors must do under the CRA.

	Authorised Representative	Importer	Distributor
How they arise	Only if formally appointed by written mandate	By default — whoever places a non-EU product on the EU market under their own name/trademark	By default — whoever makes a product available in the supply chain without being manufacturer or importer
EU establishment required?	Yes — must be established in the EU	Yes — must be established in the EU	No specific establishment requirement
Core obligation	Administrative contact point; holds documentation; liaises with market surveillance authorities	Verify manufacturer compliance before placing product on market; own verification duties	Check CE marking and documentation are present before making product available
Can take on manufacturer obligations?	No — Article 13 core obligations explicitly excluded from mandate	In some cases yes — if they place product under own name or substantially modify it	In some cases yes — if they place product under own name or substantially modify it
Exists without formal appointment?	No — only exists if manufacturer appoints one	Yes — arises automatically from the act of importing	Yes — arises automatically from the act of distributing
Signs the EU Declaration of Conformity?	No — manufacturer signs; AR may be named and hold it	Only if they become the manufacturer	Only if they become the manufacturer

The most important practical distinction: a company can become an importer by default, simply by placing a non-EU manufacturer's product on the EU market. An authorised representative, by contrast, only exists if the manufacturer takes the deliberate step of appointing one in writing.

Why non-EU manufacturers often appoint one anyway

Given that appointment is optional, why do many non-EU manufacturers choose to do it? There are four concrete reasons.

1. CSIRT routing for Article 14 reporting

This is the most time-sensitive reason. Reporting obligations set out in Article 14 apply from 11 September 2026 - more than a year before full CRA compliance is required. From that date, manufacturers must report actively exploited vulnerabilities and severe incidents to ENISA and the relevant national CSIRT via the Single Reporting Platform.

For a non-EU manufacturer with no EU establishment, the CSIRT routing follows a cascade. For a manufacturer with no main establishment in the EU, the reference country for CSIRT routing is, in order: the Member State of the EU authorised representative acting for the largest number of products, then the Member State of the primary importer, then the primary distributor.

In practice, "if you have an Authorised Representative, your reference country is where your representative is established, and the analysis ends there." Appointing an authorised representative before September 2026 gives a non-EU manufacturer a fixed, predictable reporting anchor - rather than leaving the routing to depend on whichever importer happens to be handling the most volume at the time of an incident.

2. A single, stable EU point of contact

Market surveillance authorities across 27 Member States can initiate contact. Without an authorised representative, they may approach the importer, the distributor, or attempt to reach the manufacturer directly from outside the EU. An authorised representative gives authorities a named, EU-based contact who can respond promptly and who holds the documentation they need.

3. Credibility and smoother market surveillance interactions

Having a named EU contact on the technical documentation and Declaration of Conformity signals to buyers, distributors, and authorities that the manufacturer has invested in its EU compliance infrastructure. It is not a legal requirement, but it can reduce friction during market surveillance checks.

4. Flexibility across multiple importers

A non-EU manufacturer selling through several EU importers may prefer to centralise the documentation-holding function with a single authorised representative, rather than relying on each importer to maintain its own copy of the technical file.

Who can act as an authorised representative?

Any natural or legal person established in the EU can act as an authorised representative, provided they accept the mandate in writing. In practice, the role is typically filled by:

A specialist regulatory services firm offering authorised representative services across multiple clients and product categories
An EU-based subsidiary of the non-EU manufacturer (provided it is genuinely established in the EU and not just a registered address)
An EU-based distributor who also accepts a formal mandate - though this creates a dual role that needs careful structuring

The authorised representative does not need to be a cybersecurity expert. The role is administrative: holding documents, responding to authority requests, and cooperating on risk-elimination actions. What matters is that the person or company is reliably reachable, understands the documentation they are holding, and has a clear process for escalating authority requests to the manufacturer promptly.

What to put in the written mandate

The mandate is a legal document. It should be drafted carefully, but the CRA gives clear guidance on what it must at minimum contain. A well-structured mandate will typically cover:

Identification of the parties - full legal names and addresses of the manufacturer and the authorised representative
Scope of products - which products (by name, model, or product family) the mandate covers
The four minimum tasks from Article 18(3) - documentation retention, information provision on request, cooperation with market surveillance, and provision of the mandate itself
Any additional tasks - for example, handling Article 14 reporting, or acting as the named contact on the EU Declaration of Conformity
Duration and termination - how long the mandate runs and how either party can end it
Information-sharing obligations - the manufacturer's obligation to keep the authorised representative supplied with up-to-date technical documentation and to notify them of any changes that affect conformity
Governing law - which EU Member State's law governs the agreement

One practical point: the mandate should specify that the manufacturer will keep the authorised representative's copy of the technical documentation current. An authorised representative holding a stale technical file cannot meaningfully respond to a market surveillance authority's request for conformity evidence.

Key dates to plan around

11 September 2026 — Article 14 reporting obligations go live. If you want an authorised representative to anchor your CSIRT routing, the mandate should be in place before this date.

11 December 2027 — Full CRA compliance required for products being placed on the EU market. Technical documentation, conformity assessment, CE marking, and all Article 13 obligations apply from this date.

If you are a non-EU manufacturer planning to appoint an authorised representative, the September 2026 reporting deadline is the more urgent of the two. The documentation-holding function under Article 18(3)(a) is tied to the December 2027 market placement date, but the CSIRT routing benefit is relevant from September 2026 onwards.

Frequently asked questions

help_outlineDoes appointing an authorised representative mean I do not need an importer?expand_more

No. These are separate roles. An importer is whoever places a non-EU manufacturer's product on the EU market under the manufacturer's name or trademark — that role arises from the commercial act of importing, not from any appointment. An authorised representative is an administrative contact point appointed by written mandate. You can have both, either, or (if you sell directly to EU customers without an EU-based intermediary) neither — though selling without any EU-established economic operator creates its own compliance challenges.

help_outlineCan my EU distributor also act as my authorised representative?expand_more

Yes, in principle. A distributor can accept a written mandate to also act as authorised representative. The two roles are legally distinct, so the mandate needs to be clear about which obligations arise from which role. In practice, many smaller non-EU manufacturers use their main EU distributor for this purpose.

help_outlineIf I appoint an authorised representative, do they share liability for my product?expand_more

Under the CRA, the authorised representative's liability is limited to the tasks in the mandate. Unlike the MDR (where the authorised representative can be jointly and severally liable with the manufacturer for defective devices), the CRA does not create the same joint liability structure for the authorised representative. The manufacturer retains primary responsibility for the substantive cybersecurity obligations. Always confirm the liability position with legal counsel for your specific situation.

help_outlineDoes the authorised representative need to be named on the product label or packaging?expand_more

The CRA requires the manufacturer's name and address to appear on the product or its packaging. If an authorised representative is appointed, their name and address should also be included in the technical documentation and may be named on the EU Declaration of Conformity. Check the specific labelling requirements in Article 13(18) and Annex II for your product.

help_outlineWhat happens if I change my authorised representative?expand_more

The CRA does not prescribe a specific change procedure in the same way the MDR does. However, the outgoing representative's obligation to hold documentation at the disposal of authorities runs for the retention period (at least 10 years from market placement, or the support period if longer). The mandate should address what happens to documentation on termination, and the new mandate should be in place before the old one ends to avoid a gap.

help_outlineDoes the CRA apply to me if I only sell software, not hardware?expand_more

Yes, if the software meets the definition of a product with digital elements — broadly, software that has a direct or indirect logical or physical data connection to a device or network. Pure SaaS services with no associated installable software or hardware component are generally outside scope, but embedded software, desktop applications, operating systems, and software components placed on the market separately are all potentially in scope. See our post on CRA product scope for more detail.

The bottom line

The CRA authorised representative is a narrower, more administrative role than its MDR equivalent - and, crucially, it is optional. Non-EU manufacturers are not required to appoint one to place products on the EU market.

But "optional" is not the same as "unimportant." The CSIRT routing benefit alone makes it worth considering before the Article 14 reporting obligations start in September 2026. And for manufacturers selling through multiple EU channels, a single authorised representative provides a cleaner, more predictable compliance structure than relying on the importer cascade.

If you do appoint one, get the mandate right. It needs to cover the four minimum tasks in Article 18(3), it cannot delegate the Article 13 core obligations, and it should include clear information-sharing obligations so the representative always holds current documentation.