A CRA authorised representative (AR) is an EU-established person or company that a manufacturer can appoint by written mandate to hold compliance documents, answer reasoned authority requests, cooperate with market surveillance, and carry out any further tasks the mandate names. Appointment is optional under the Cyber Resilience Act, including for non-EU manufacturers. The role is useful when a manufacturer wants an EU regulatory contact, but the mandate cannot include product cybersecurity, vulnerability handling, drawing up the technical documentation, or series-production procedures, and it does not transfer importer duties away from the importer.
Summary
- Appointment is optional. CRA manufacturers may appoint an authorised representative, but the CRA does not require one as a condition for EU market access.
- The mandate has a minimum and a limit. At a minimum the AR must be able to hold the EU Declaration of Conformity and technical documentation, provide them to authorities on reasoned request, and cooperate on risk-elimination actions. The mandate can add other tasks, such as arranging conformity assessment, drawing up the declaration of conformity or submitting reports, if it says so in writing.
- Some duties cannot be in the mandate. Product cybersecurity, risk assessment, vulnerability handling, security updates, drawing up the technical documentation, and series-production procedures are excluded by Article 18(2).
- Importer duties are separate. An importer exists by supply-chain fact; an AR exists only by written mandate. One EU entity can hold both roles, but the paperwork and duties are distinct.
- Penalty exposure follows the duty breached. Manufacturer-duty breaches sit in the top penalty tier; AR-mandate breaches sit in the importer/distributor tier.
- Deadlines matter. Manufacturer reporting has applied since 11 September 2026; most AR-relevant operational readiness belongs with the 11 December 2027 regime start.
Should you appoint an authorised representative?
Choosing an authorised representative is an operational decision, not a CRA market-access requirement. The factors below cover the typical reasoning. None of them creates a legal obligation; the CRA does not penalise the absence of an AR.
| Factor | Lean toward appointing | Lean toward not appointing |
|---|---|---|
| Manufacturer EU presence | Manufacturer is established outside the Union and has no EU office that can credibly take market surveillance correspondence. | Manufacturer is EU-established, or has an EU subsidiary that already handles regulatory correspondence. |
| Other EU instruments | Product is also covered by MDR, which requires an AR for non-EU medical-device manufacturers, or you already use a RED compliance representative or service provider. Reusing the same firm for CRA scope can simplify operations. | Product falls only under the CRA, with no parallel MDR AR obligation and no existing RED representative arrangement. |
| Authority correspondence | You want correspondence with market surveillance authorities to flow through a local EU contact in the relevant Member State language and timezone. | You are comfortable handling reasoned-request responses directly from the manufacturer's headquarters. |
| Document custody | You want the 10-year retention of the DoC and technical documentation held by an EU-established custodian. | You already operate an internal evidence platform that keeps the documentation accessible to authorities on request. |
| Importer route | Multiple EU importers and distributors, and you want a single named AR across the channel rather than splitting accountability. | Single trusted EU importer who already runs importer verification and document retention. |
Most non-EU manufacturers in regulated sectors end up appointing an AR because the operational simplification is worth more than the mandate fee, not because the CRA forces them to.
What the Mandate Can Cover
The written mandate makes the AR a document custodian and authority interface at a minimum. Article 18(3) says it must allow the AR to do at least the three tasks below, and the AR performs the tasks the mandate specifies.
| Task | What the AR does |
|---|---|
| Document custody | Hold the EU Declaration of Conformity and technical documentation for at least 10 years after market placement, or for the support period, whichever is longer. |
| Authority requests | Provide the information and documentation needed to demonstrate conformity when a market surveillance authority makes a reasoned request. |
| Risk cooperation | Cooperate with market surveillance authorities, at their request, on actions taken to eliminate product risks. |
| Further tasks, if the mandate says so | Article 18(2) does not exclude carrying out or arranging conformity assessment, drawing up the EU Declaration of Conformity, affixing the CE marking, or Article 14 reporting, so the mandate can include them. If a task is not written into the mandate, the AR does not have it. |
The mandate is also itself a controlled document: the AR must provide a copy to market surveillance authorities on request.
What Cannot Be in the Mandate
Article 18(2) keeps three groups of manufacturer duties out of the mandate: Article 13(1) to (11), the first subparagraph of Article 13(12), and Article 13(14). No mandate wording can add them.
| Excluded cluster | What it covers |
|---|---|
| Product and vulnerability duties | Product cybersecurity, the cybersecurity risk assessment, component due diligence, the support-period determination, security update availability, and substantially-modified-software rules. |
| Technical documentation creation | Drawing up the technical documentation before placing the product on the market is excluded. The AR may hold the resulting file under the mandate but cannot draw it up. |
| Series production controls | The procedures that keep products in a series of production in conformity are excluded. |
The practical line: engineering, risk assessment, vulnerability handling, drawing up the technical documentation, and series-of-production procedures stay with the manufacturer. Carrying out or arranging conformity assessment, the declaration of conformity and the CE marking, and Article 14 reporting are not on the excluded list, so the mandate can include them if it names them. The AR is not a substitute manufacturer.
Authorised Representative vs Importer
The AR role is created by a written mandate. The importer role is created by the commercial supply route when an EU-established person places a non-EU manufacturer's product on the Union market. They do not substitute for each other in either direction.
| Authorised representative | EU importer | |
|---|---|---|
| Trigger | Optional. A manufacturer may appoint an AR by written mandate. | Status by definition. Whoever, established in the Union, places a product bearing a non-EU manufacturer's name or trademark on the market is the importer. |
| Created by | Written mandate from the manufacturer to an EU-established legal or natural person. | The commercial supply route. No appointment, no mandate. |
| Scope | At least: hold the DoC and technical documentation for at least 10 years after placing on the market, or for the support period if that is longer, provide them to market surveillance on reasoned request, and cooperate on corrective action. Further tasks only if the mandate names them. Article 13(1) to (11), drawing up the technical documentation and series-production procedures are excluded. | Verify conformity assessment, CE marking, DoC and user instructions; retain documents for 10 or more years; cooperate with authorities; notify on suspected non-compliance and on awareness of vulnerabilities. |
| Substitutes the other? | No. Appointing an AR does not remove importer obligations from whoever places the product on the EU market. | No. Importer duties exist independently. They neither create nor remove an AR appointment. |
| Same entity allowed? | Yes. One EU-established firm can hold both the AR mandate and the importer role, with separate written paperwork and indemnity covering both. | Same. |
Practical implication: choosing an AR is independent of who imports the product. An EU importer does not relieve the manufacturer of any cybersecurity obligation, and an AR does not relieve the importer of any importer duty. If you want one EU partner to wear both hats, that is allowed; you need a written AR mandate distinct from the commercial supply contract, and indemnity covering both functions.
What to look for when appointing an AR
If your supplier landscape includes incumbents from MDR, RED, or RoHS, that is a reasonable starting point. The CRA-specific checks below are what separates a serviceable AR from one that will struggle when the first authority letter arrives.
| Check | What good looks like |
|---|---|
| Domicile | EU-established legal entity in a Member State, with a registered office and a local point of contact. |
| Insurance | Professional indemnity with coverage explicitly extended to CRA scope and CRA product classifications. |
| Sector experience | Demonstrable track record under MDR, the RED cybersecurity delegated act, or RoHS. These are the firms credibly pivoting into CRA work today. |
| Document custody | Platform meeting the 10-year retention obligation required by the mandate, with a tamper-evident audit trail and authority-ready exports. |
| Accountability | A named natural person accountable to authorities, not a generic legal-team mailbox. |
| Language | Capacity to handle corrective-action cooperation in the language of the relevant Member State authority. |
The mandate itself should specify the CRA mandate tasks in full, restate the duties Article 18(2) excludes, set notice and termination terms, and define handover when the manufacturer changes AR. Have it reviewed by counsel familiar with EU product compliance.
Common pitfalls
| Claim | Why it fails |
|---|---|
| "We are non-EU, so we must appoint an AR." | CRA appointment is optional even for non-EU manufacturers. MDR may require an AR for non-EU medical-device manufacturers; RED has its own economic-operator rules but does not turn CRA appointment into a requirement. |
| "Our EU importer is also our AR; one contract covers both." | The roles are legally distinct. Importer obligations attach to whoever places the product on the market; AR obligations attach to whoever holds the written mandate. Combine the entity if you wish, but paper the two functions separately. |
| "The AR can never draw up our EU Declaration of Conformity." | Article 18(2) excludes only the first subparagraph of Article 13(12), drawing up the technical documentation. The declaration and CE marking are in its third subparagraph, so the mandate can include them. Check what the mandate names. |
| "We delegated vulnerability handling to the AR." | Vulnerability handling falls under Article 13(8), which Article 18(2) excludes from the mandate. The mandate cannot include it. |
| "Reporting can never be in the AR mandate." | Article 18(2) does not exclude Article 14. A mandate can include submitting notifications, but only if it names the task. An AR whose mandate is silent on reporting has not been given it. |
| "Mandate covers all our products forever." | Mandates are written, time-bound, and product-scoped. Update on each new product line, on each substantial change, and on AR change. |
| "We do not need a CRA mandate; our MDR mandate is enough." | The MDR mandate scope is medical-specific and does not automatically attach to CRA duties. Re-paper a CRA-scoped mandate that lists the CRA document-custody and authority-cooperation tasks, any further tasks, and the duties Article 18(2) excludes. |
| "The AR is liable for product defects." | The AR performs the tasks listed in the mandate. Article 18 does not settle product-defect liability, so take legal advice and draft the mandate carefully. |
Frequently asked questions
Is appointing an authorised representative mandatory under the CRA?
No. The CRA makes AR appointment optional, even for manufacturers established outside the Union. The operative wording is permissive: a manufacturer may appoint an authorised representative by written mandate. MDR can still require an AR for non-EU medical-device manufacturers where that regime applies; RED may involve an authorised representative by mandate, but that is not a CRA appointment duty.
Why would a non-EU manufacturer still appoint an AR under the CRA?
Operational simplification, not legal compulsion. A single EU-established legal contact point reduces friction with market surveillance authorities, who often prefer correspondence with an entity in their jurisdiction and language. The AR can hold the Declaration of Conformity and technical documentation locally for the required retention period. Many non-EU manufacturers already use an MDR AR or RED compliance representative and find it simpler to extend that arrangement to CRA scope. A named EU AR also shortens authority response cycles when a reasoned request arrives.
What can and cannot be delegated to a CRA authorised representative?
Article 18(2) keeps some duties out of the mandate: Article 13(1) to (11), which includes the essential requirements, risk assessment, vulnerability handling and security updates, drawing up the technical documentation, and the series-of-production procedures. Other tasks can be in the mandate if it says so, for example carrying out or arranging conformity assessment, drawing up the declaration of conformity, or reporting. The AR mandate at minimum must cover three things: holding the DoC and technical documentation for 10 or more years or the support period if longer, providing information and documentation to authorities on reasoned request, and cooperating on action taken to eliminate risks.
What is the difference between a CRA authorised representative and an EU importer?
They are independent roles. An importer is an EU-established person who places a product bearing a non-EU manufacturer's name or trademark on the EU market, and carries importer obligations regardless of whether an AR exists. An AR, when appointed, takes on the tasks listed in the mandate. They are not substitutes: the importer role is triggered by the commercial supply route, the AR role by a written mandate. One EU entity may hold both, with separate paperwork.
Can my EU importer or distributor act as my authorised representative?
Yes. The CRA does not forbid one EU-established entity from holding both a commercial importer or distributor role and an AR mandate. The functions remain legally distinct: the importer or distributor carries duties from the commercial supply relationship, while the AR carries duties from a written mandate. To combine them, paper a separate CRA mandate, carry professional indemnity sufficient for both roles, and keep a clear contractual line between the functions.
Is the AR liable for product defects, or only for documentation duties?
The AR performs the tasks listed in the mandate. Article 18 does not settle product-defect liability, and the excluded manufacturer obligations cannot be folded into the mandate. National law in some Member States may add exposure, so the mandate should be drafted carefully.
Is a CRA authorised representative the same as an MDR or RED authorised representative?
No, the regimes overlap but are not interchangeable. MDR makes AR appointment mandatory for non-EU medical-device manufacturers and imposes broader medical-specific duties including vigilance reporting. RED uses its own authorised-representative and economic-operator framework, but it does not make CRA appointment mandatory. CRA makes appointment optional, with a minimum of documentation, authority requests, and corrective-action cooperation, and with the exclusions in Article 18(2). An incumbent MDR AR or RED compliance representative can be a strong starting point, but the mandate must be re-papered for CRA scope and those exclusions.
Does the AR sign the EU Declaration of Conformity?
Only if the written mandate says so. Article 18(2) excludes the first subparagraph of Article 13(12), which is drawing up the technical documentation. Drawing up the EU Declaration of Conformity is in the third subparagraph, which the exclusion does not cover. See the declaration of conformity page for how an AR is named on the declaration. In every case the AR holds the DoC and the technical documentation at the disposal of market surveillance authorities.
Can I change my AR after appointment?
Yes. The mandate is a contract between the manufacturer and the AR, and either party can terminate subject to its terms. On change, the new AR takes over custody of the technical documentation and Declaration of Conformity, and the manufacturer should update the contact information communicated to market surveillance authorities. Plan for an explicit handover step in the mandate template.