Authorised Representatives: EU Presence for Non-EU Manufacturers

Article 18 applies to manufacturers established outside the European Union who place products with digital elements on the EU market. This includes manufacturers in countries such as the United States, China, South Korea, Japan, Taiwan, and any other non-EU jurisdiction whose products are sold in the EU.

The requirement exists because EU regulatory enforcement relies on the ability of national authorities to contact and interact with responsible legal entities within their jurisdiction. A manufacturer established in a third country cannot easily be reached by an EU market surveillance authority, cannot be summoned before EU courts in the ordinary way, and may not be subject to EU financial penalties. The authorised representative solves this problem by providing an EU-based point of accountability.

The authorised representative must be formally designated in writing by the manufacturer before the product is placed on the EU market. This designation is a prerequisite for CE marking, not an afterthought.

The authorised representative has significant legal responsibilities under Article 18. Key obligations include:

Register with market surveillance authorities: The authorised representative's name and address must appear in the EU Declaration of Conformity and in the product's user-facing information, enabling authorities and consumers to contact them.

Maintain the technical file: The authorised representative must hold a copy of the technical documentation and EU Declaration of Conformity and be able to provide them to national authorities on request, typically within a short timeframe (often 10 working days under similar EU regulations).

Cooperate with authorities: When national market surveillance authorities require information, conduct investigations, or require corrective action, the authorised representative is the primary point of contact and must cooperate fully.

Relay Article 14 notifications: Where the manufacturer must report a vulnerability under Article 14, the authorised representative may be responsible for ensuring these notifications reach the relevant national CSIRT.

Notify the manufacturer of enforcement actions: If authorities take corrective action or require product withdrawal, the representative must promptly inform the manufacturer.

The authorised representative must be a legal entity or natural person established in the EU. They can be a specialist compliance service provider, an EU subsidiary of the manufacturer, an importer who takes on this role, or a dedicated EU regulatory representative firm.

When choosing a representative, manufacturers should consider:

Competence: Does the representative understand cybersecurity product regulation and the CRA specifically? Authorised representative services provided by general compliance firms may not have the technical depth needed for CRA.

Liability: The authorised representative can incur personal liability for CRA violations where the manufacturer has failed to comply. Representatives should have adequate indemnification arrangements and professional liability insurance.

Accessibility: National authorities may require urgent responses. The representative must be reachable quickly and be able to respond within required timeframes.

Mandate scope: The written mandate between manufacturer and representative must clearly define what the representative is authorised to do, particularly whether they can make compliance decisions on behalf of the manufacturer or merely relay communications.

Article 18 and Article 13 create two overlapping categories: authorised representatives and importers. Both have EU-based obligations, but they serve different functions.

The authorised representative is specifically appointed by the manufacturer through a written mandate and acts as the manufacturer's legal representative for regulatory purposes. The importer is the entity that physically places the product on the EU market by importing it into EU territory.

In practice, the same entity can be both the authorised representative and the importer. An EU distributor who imports a US manufacturer's products and is also formally appointed as the authorised representative wears both hats simultaneously.

Where they are different entities, the obligations differ: the importer has specific obligations under Article 13 related to verification before placing products on the market, while the authorised representative has the broader mandate to interact with authorities on the manufacturer's behalf.

When an authorised representative relationship ends - because the representative withdraws, the manufacturer terminates the mandate, or the representative entity ceases to exist - the manufacturer must appoint a replacement before continuing to place products on the EU market. Products already on the market under a previous representative's watch do not become non-compliant simply because the representative changes, but ongoing market activity requires a valid representative at all times.

Changes of authorised representative must be reflected in updated EU Declarations of Conformity and in product documentation where the representative's contact details are provided. Where the CE marking documentation references the former representative, updated documentation must be prepared and made available.

Manufacturers should ensure authorised representative agreements include clear provisions for continuity obligations during transition periods to avoid regulatory gaps.