CRA authorised representative: does a non-EU manufacturer need one?
Published 2026-11-11
Many manufacturers outside the EU assume an authorised representative is compulsory. Under the CRA, appointing one is optional for the manufacturer, and the role is separate from that of the importer and from Article 14 reporting.
What it is
An authorised representative is a natural or legal person established in the Union who has received a written mandate from the manufacturer to act on its behalf for specified tasks. It must be established in the EU; a company outside the EU cannot hold the role.
Is it mandatory?
Under the CRA a manufacturer may appoint an authorised representative by written mandate; it is not required in every case. If products reach the EU market through an importer, the importer has its own legal obligations. Whether you need a representative depends on your sales and compliance set-up, so take advice from counsel.
Typical mandate tasks
- Keep the EU declaration of conformity and technical documentation available to market surveillance authorities (generally for 10 years or the support period, whichever is longer).
- Provide, on a reasoned request, the information needed to demonstrate conformity.
- Cooperate with authorities on actions addressing risks of the product.
Core manufacturer duties, such as secure design and vulnerability handling, cannot be handed to the representative.
Representative versus Article 14 reporting
An authorised representative does not automatically file vulnerability reports for you. The Article 14 duty rests with the manufacturer and is normally carried out by your own designated person on the ENISA platform. The representative's location can influence which Member State's CSIRT receives the report.
Where Watchpost fits
Watchpost is not an authorised representative or an importer and does not offer EU representation. It monitors, runs the countdown, alerts your team and drafts the English report text for your people to review and submit.
FAQ
Must a manufacturer appoint an EU authorised representative under the CRA?
Not in every case. The manufacturer may appoint one by written mandate; importers have separate obligations.
Can an authorised representative report to ENISA for us?
Its tasks are set by the written mandate. The Article 14 reporting duty remains with the manufacturer and does not pass automatically.
Can a company outside the EU act as authorised representative?
No. The representative must be established in the Union.
More guides
- CRA Article 14: the 24-hour, 72-hour and 14-day reporting steps
- CRA reporting readiness: a checklist for hardware makers
This article summarises the public text of the EU Cyber Resilience Act (Regulation (EU) 2024/2847) for general information. It is not legal advice; rely on the regulation itself and your own counsel.