CRA for Non-EU Manufacturers: Why the Authorised Representative Is Optional and How Article 14(7) Picks Your CSIRT

Short answer: If you make products with digital elements outside the EU and sell them into it under your own name or trademark, the Cyber Resilience Act applies to you as the manufacturer. Most of its duties apply from 11 December 2027, but since 11 September 2026 you have had to send an early warning within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident. The CRA itself does not force you to appoint an authorised representative. Article 18(1) says a manufacturer “may” appoint one. What the CRA does fix, if you have no main establishment in the EU, is which national CSIRT receives your reports, through a four-step ladder in Article 14(7): authorised representative, then importer, then distributor, then the Member State with the highest number of your users. Appointing an authorised representative is the step you control most directly, for as long as the mandate stays in force, and on the once-per-manufacturer reading we explain below, it outranks the other three. Edge case 2 explains how we read the representative, importer and distributor steps before their own CRA duties apply in December 2027.

This guide sets out who does what in a non-EU supply chain, when other EU product law still requires an EU-based operator, how to work through the CSIRT ladder with evidence, and the edge cases the text leaves open. It builds on our Cyber Resilience Act compliance guide, which covers scope, CE marking and conformity assessment.

This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.

Disclosure: we sell a CRA template pack covering applicability and reporting, mentioned once below. Every statement about the law here is sourced to EU legislation, the Commission or ENISA, and we label our own readings and practical advice as such.

Which situation are you in?

Plain-language summary: your route depends on two facts. Do you have any establishment in the EU, and who puts your product in front of EU buyers? Find your row, then read the sections that apply.

Your set-up	Who is the CRA manufacturer (product under your name or trademark unless stated)?	Coordinator CSIRT for Article 14 reports
Non-EU company, EU subsidiary that takes product-security decisions	You	The main establishment test, if the subsidiary counts as your establishment (Article 14(7) defines “main establishment” but not “establishment”, nor whether a subsidiary counts; for a subsidiary that takes no security decisions, see edge case 1)
Non-EU company with no EU establishment, authorised representative appointed	You	Member State of the authorised representative acting for the highest number of your products (rung a)
No EU establishment, no representative, hardware shipped through an EU importer (EU distributors may also be involved)	You. The importer has its own Article 19 duties from 11 December 2027	Member State of the importer placing the highest number of your products (rung b)
No EU establishment, no representative and no EU importer, on our reading, typically software or licences sold through EU resellers or distributors (an EU business bringing in your hardware is usually your importer)	You	Member State of the distributor making the highest number of your products available (rung c)
No EU establishment, software only, sold or downloaded directly by EU users, with no representative, importer or distributor for any of your products	You	Member State with the highest number of your users (rung d)
An EU importer or distributor sells your product under its own brand	The importer or distributor (on our reading, the Article 3 definition now; Article 21 from 11 December 2027)	Its own main establishment

One quick test for “does the CRA reach us at all”: if your product with digital elements (its intended purpose or reasonably foreseeable use includes a direct or indirect data connection to a device or network, and isn’t excluded under Article 2, as medical devices are) is made available on the EU market in the course of a commercial activity, the product is in scope, and you are its manufacturer if it is marketed under your name or trademark. Where your headquarters sits is irrelevant. Market surveillance rules treat an online offer as making the product available in the EU when it targets EU end users, under Article 6 of Regulation (EU) 2019/1020 on market surveillance, which Article 52(1) of the CRA applies to its products.

Four roles, and what the CRA actually asks of each

Plain-language summary: you keep the design, vulnerability-handling and reporting duties. An authorised representative holds documents and talks to authorities, and, on our reading of Article 18(2), can help you file if its mandate says so, but the reporting duty stays yours. An importer checks your paperwork before it ships your product. A distributor checks the CE marking and passes problems back to you.

The definitions in Article 3 of the Cyber Resilience Act, Regulation (EU) 2024/2847 are precise, and most mistakes come from loose readings of them:

Role	Definition (Article 3)	Core duties	Maximum fine (Article 64)
Manufacturer	Develops or manufactures the product, or has it made, and markets it under its own name or trademark	Annex I requirements, Article 13 obligations, Article 14 reporting	EUR 15 million or 2.5% of total worldwide annual turnover, whichever is higher (Annex I, Articles 13 and 14)
Authorised representative	Established within the Union, holds a written mandate to act on the manufacturer’s behalf for specified tasks	Article 18(3) minimum: keep the declaration of conformity and the technical documentation you drew up available, answer reasoned requests, cooperate with authorities	EUR 10 million or 2% of total worldwide annual turnover, whichever is higher (Articles 18 to 23)
Importer	Established in the Union, places on the market a product bearing the name or trademark of someone established outside the Union	Article 19 pre-market checks, own contact details on the product, inform you of vulnerabilities, inform market surveillance authorities of a significant cybersecurity risk	EUR 10 million or 2%, whichever is higher
Distributor	Any other supplier in the chain that makes the product available without changing its properties	Article 20: verify CE marking and documents, inform you of vulnerabilities	EUR 10 million or 2%, whichever is higher

Timing matters here. Article 71(2) brings forward only Article 14 (from 11 September 2026) and Chapter IV (from 11 June 2026). Everything else, including Articles 18 to 23 and the Article 64 fines themselves, applies from 11 December 2027 (for the Article 3 definitions, see the reading below). So the reporting duty applies now, while the fines in this table, and the representative, importer and distributor duties, apply from December 2027. Article 14 is worded in terms of the Article 3 roles (manufacturer, authorised representative, importer, distributor), so our reading is that those definitions already apply for reporting purposes.

The authorised representative is optional under the CRA

Article 18(1) reads: “A manufacturer may, by a written mandate, appoint an authorised representative.” Treat any summary that calls it a duty for non-EU manufacturers with caution: the Official Journal text says “may”. Compare NIS2, where Article 26(3) of Directive (EU) 2022/2555 says a listed digital provider outside the Union “shall designate a representative”. Our guide to NIS2 Article 26 jurisdiction covers that representative route. The two regimes differ on this point, so don’t carry the NIS2 or GDPR habit across.

If you do appoint one, Article 18(2) limits what the mandate may cover. The core duties in Article 13(1) to (11) (design, risk assessment, vulnerability handling, support period and security updates), the technical documentation in Article 13(12), first subparagraph, and the series-production conformity duty in Article 13(14) cannot be handed over. Article 14 is not on that list, so on our reading a mandate can include filing tasks. The reporting obligation itself is still addressed to the manufacturer, and so are the Article 64(2) fines for missing it, which apply from 11 December 2027.

Optional under the CRA, but other product law often requires an EU-based operator

“Optional” does not mean you can sell connected hardware with no EU party behind it. Article 4 of Regulation 2019/1020 says a product covered by the laws listed in Article 4(5) may be placed on the market only if an economic operator established in the Union is responsible for it: an EU manufacturer, an importer, an authorised representative or a fulfilment service provider. That list includes the Radio Equipment Directive 2014/53/EU, the EMC Directive 2014/30/EU and the Low Voltage Directive 2014/35/EU. The CRA’s Article 66 added the CRA to Annex I of Regulation 2019/1020, not to the Article 4(5) list.

The General Product Safety Regulation (EU) 2023/988 doesn’t fill the gap either. Its “responsible person” rule in Article 16 sits in Chapter III, Section 1, and Article 2(1) switches that section off for products subject to specific requirements under Union harmonisation legislation.

Our reading (an interpretation, not settled law): Wi-Fi, Bluetooth or mains-powered products will in practice need an EU-based operator because of RED, EMC or LVD. Software supplied on its own, with no hardware, has no equivalent requirement in the texts we checked. That is the typical case where the CSIRT ladder runs past the importer rung, to rung (c) for software sold through EU resellers or to rung (d) for direct sales, and where the CRA questions for software vendors selling into the EU become concrete.

Which CSIRT gets your report: the Article 14(7) ladder

Plain-language summary: every report goes through ENISA’s Single Reporting Platform, addressed to one national coordinator CSIRT. The main establishment test comes first. If you have no main establishment in the Union, you work down a four-step ladder and take the first step that applies to you.

Article 14(7) first asks where your main establishment is, and only then turns to the ladder. A manufacturer’s main establishment is in the Member State “where the decisions related to the cybersecurity of its products with digital elements are predominantly taken”. If that Member State cannot be determined, it is the Member State of “the establishment with the highest number of employees in the Union”. If the manufacturer has no main establishment in the Union, the notification goes to the coordinator CSIRT in the first Member State on this list that applies, “based on the information available to the manufacturer”:

Rung	Member State where…	What you count (models or units: see edge case 4)	Evidence to keep
(a)	…the authorised representative acting for the highest number of your products is established	Products covered by each written mandate	Signed mandates, product lists annexed to them
(b)	…the importer placing the highest number of your products on the market is established	Products each EU importer places on the market	Importer contracts, shipment or sell-in data per importer
(c)	…the distributor making available the highest number of your products is established	Products each EU distributor makes available	Reseller agreements, channel sales reports
(d)	…the highest number of your users are located	Users per Member State	Licence, activation or telemetry counts by country, with the date and method

For a non-EU manufacturer with no establishment in the EU, the ladder is not optional. Throughout this guide we apply it once per manufacturer, the reading suggested by the wording “products with digital elements of that manufacturer”; edge case 4 covers the alternative. Two drafting details matter in practice. The ladder is strictly ordered, so, on the once-per-manufacturer reading, a representative who covers one minor product line beats an importer that moves most of your volume. And the last subparagraph lets you keep filing with the same CSIRT for later reports only when you used rung (d). For rungs (a) to (c) the text gives no such permission. Our reading is that you should re-check the ladder before each notification, because a new importer or a terminated mandate can move your CSIRT.

Getting this wrong has a cost. ENISA’s SRP frequently asked questions (FAQ 18; page updated 15 October 2026) say that if the wrong coordinator is selected, “the notification may be invalidated and will need to be resubmitted to the correct CDaC” (CSIRT designated as coordinator). With a 24-hour early warning, a resubmission can cost you the deadline.

A worked example

Take a US maker of connected cameras plus a desktop management app, with no EU entity. A German company, its only EU importer, places the cameras on the EU market, and a Dutch distributor resells some of them. EU customers download the app directly. The company has no authorised representative.

• Today: rung (a) is empty. Rung (b) applies because an importer exists, so reports go to Germany’s coordinator CSIRT, CERT-Bund at the BSI. Our reading: that holds even for an exploited flaw in the app alone, because Article 14(7) counts “products with digital elements of that manufacturer” rather than the product affected. See edge case 4 for the alternative reading.
• Alternative A, it signs an Irish authorised representative whose mandate covers only the app: rung (a) now applies and outranks the importer, so reports go to Ireland’s NCSC.
• Alternative B, the German importer later rebrands the cameras as its own: the importer becomes the manufacturer for those cameras, because, on our reading, it markets them under its own trademark and so meets the Article 3 definition of manufacturer (Article 21 says so expressly from December 2027), and reports through its own main establishment. The US company still reports for the app. If it has no representative, its only remaining own-brand product reaches users directly (the Dutch distributor now resells the importer’s brand), so rung (d), the Member State with the highest number of its app users, decides. If it has the Irish representative from Alternative A, rung (a) keeps Ireland.

Alternative A is the strategic point. Changing importers or distributors can also move your CSIRT, but those are commercial decisions with other consequences. On the once-per-manufacturer reading, appointing an authorised representative is the one move that settles the question directly, while the mandate stays in force, because rung (a) overrides the others. Pick the Member State whose CSIRT you can work with during a 24-hour incident (language, published contact channel, helpdesk hours), and record why. ENISA’s list of CSIRTs designated as coordinators gives a link for each of the 27 coordinator CSIRTs, some to contact pages and some to CRA or vulnerability-handling pages.

Five edge cases the text leaves open

Plain-language summary: the ladder looks mechanical, but five common set-ups don’t map onto it cleanly. Where official guidance is silent we say so and give the reading we would document.

1. A non-EU parent with an EU subsidiary that makes no security decisions. Say all product-security decisions are taken at a US headquarters, and a sales subsidiary sits in Spain. One reading: no Member State is where decisions are “predominantly taken”, so the headcount fallback points to the Spanish entity and the ladder never applies. The other reading: decisions are taken outside the Union, so the manufacturer has no main establishment in the Union and the ladder applies. The first reading also assumes a separately incorporated subsidiary counts as the manufacturer’s “establishment”, and the CRA doesn’t define that term. ENISA’s FAQ 8 confirms one notification per event “even when a manufacturer has multiple branches or subsidiaries in the EU and/or its parent company is headquartered outside the EU”, but doesn’t say which CSIRT that implies. Document both readings and the facts behind your choice.

2. The roles in rungs (a) to (c) before 11 December 2027. Article 71(2) applies Article 14 from 11 September 2026 but Articles 18 to 23, including the representative, importer and distributor duties in Articles 18 to 20, only from 11 December 2027. So during the transition the ladder refers to roles whose CRA obligations don’t apply yet. ENISA’s FAQ 18 applies the ladder without any transitional caveat. Our reading is that the importer and distributor rungs are factual tests (who places or makes available your products), so they work now, and an authorised representative mandate can be signed now.

3. Marketplaces and app stores. Recital 78 of the CRA states that a provider that “provides only online intermediation services” and is merely an online marketplace “does not qualify as one of the types of economic operator”. The same entity becomes a distributor if it also distributes the product. Recitals are not binding, but our reading is that it signals a pure marketplace listing shouldn’t count for rung (c). Assess each channel on its facts; the recital calls for case-by-case assessment where an entity, such as a fulfilment service provider, may play more than one role.

4. What “highest number of products” means, and what is being counted. The text doesn’t say whether to count product models or units shipped. For a manufacturer with one high-volume model and many low-volume ones, the two methods can point to different Member States. Nor does it say expressly whether the ladder runs once per manufacturer or separately for the affected product; the wording “products with digital elements of that manufacturer” suggests the former, which is the reading we use in the worked example. On the alternative per-product reading, you would apply the ladder to the affected product’s own channels, so an exploited flaw in a directly downloaded app could go to rung (d) even while an importer handles your hardware. Pick a method, apply it consistently and write it into your determination record.

5. Counting users for rung (d). “Users” isn’t defined for this purpose either. Activations, active licences, telemetry and billing addresses all give defensible numbers. Use whichever you can produce on demand, keep the dated figure, and remember that rung (d) is the one rung where you may stay with the first CSIRT for later reports.

On the platform: “AR” doesn’t mean authorised representative

Plain-language summary: on ENISA’s Single Reporting Platform, “AR” means Assigned Representative, a named person who files reports. It is not the Article 18 authorised representative. Mixing up the two creates gaps in your on-call rota.

Under ENISA’s FAQ 9, every filer is an “Assigned Representative” with a personal EU Login account and multi-factor authentication. Each manufacturer has one Primary AR and up to 20 Secondary ARs. The Primary AR registers by selecting the coordinator CSIRT, and that CSIRT validates the person-to-manufacturer link. Only once the association shows as “Verified” can the Primary AR invite Secondary ARs. Up to 20 notifications can be submitted before verification becomes mandatory, and ENISA advises registering only when a notification is needed. FAQ 9 sets out no EU-residence or employment condition for Assigned Representatives, but the coordinator CSIRT validates each person-to-manufacturer link, so confirm with it before relying on non-EU staff or a person at your importer. The platform is in English only (FAQ 24).

The Commission’s CRA reporting page describes the routing for the usual case: the notification goes to the CSIRT where the manufacturer has its main establishment, and that CSIRT shares it “without delay” with the CSIRTs of the other Member States where the product is available. For a manufacturer without a main establishment, Article 14(7) substitutes the CSIRT the ladder selects. You file once. The ladder only decides where the file lands first. For the clocks and the content of each filing, see our guide to CRA reporting requirements.

What to do this quarter, by role

Role	Action	Effort
Compliance officer or legal	Map every EU channel per product: importer, distributors, marketplaces, direct sales. Write a one-page Article 14(7) determination naming the rung, the facts and the date, and review it when a contract changes.	Medium
Compliance officer or legal	Decide whether to appoint an authorised representative. If you do, choose the Member State deliberately and list the products in the mandate. Check whether your hardware falls under a directive listed in Article 4(5) of Regulation 2019/1020, such as RED, EMC or LVD, which already requires an EU-based operator.	Medium
CISO or PSIRT lead	Create EU Login accounts with MFA now for at least two people, a lead filer and a back-up in a different time zone, so one can register as Primary Assigned Representative when a notification is needed (ENISA advises registering only then) and file straight away, then invite the other as a Secondary once the CSIRT has verified the link. Store the coordinator CSIRT’s contact channel in the incident runbook.	Low
CISO or PSIRT lead	Make sure importers and distributors know where to send vulnerability information. From 11 December 2027, Articles 19(5) and 20(4) require them to tell you “without undue delay”, which only helps if they have a working contact.	Low
Owner or executive	Decide on the trade-off: a representative needs a written mandate with a party established in the EU (Articles 3 and 18(1)), while having no representative leaves your CSIRT to be set by where your importer or distributors are, or by your user count. Ask for the determination in writing.	Low

Frequently asked questions

Does a non-EU manufacturer have to appoint an authorised representative under the CRA?
No. Article 18(1) says a manufacturer “may” appoint one. Separate laws can still require an EU-based economic operator. Regulation 2019/1020, Article 4, does so for products under the Radio Equipment, EMC and Low Voltage Directives, among others.

Can our EU importer file Article 14 reports for us?
Not in its role as importer. A named person there could be validated as one of your Assigned Representatives, but the duty stays yours. On the platform, filers are Assigned Representatives associated with the manufacturer, and the coordinator CSIRT validates each link. ENISA’s FAQ 9 sets out no residence or employment condition, so confirm with your CSIRT before relying on a person at your importer. You stay responsible for the content and the deadlines.

We have no EU presence and sell software only online. Which CSIRT do we use?
If no authorised representative, importer or distributor exists for any of your products, the Member State with the highest number of your users, under Article 14(7)(d). Keep the dated user count. For rung (d) only, later reports may go to the same CSIRT.

What happens if we report to the wrong CSIRT?
ENISA says the notification may be invalidated and will need to be resubmitted to the correct coordinator (FAQ 18). Determine the rung before an incident, not during one.

Do importers have their own reporting duty to a CSIRT?
Not under Article 14, but they do have a separate duty towards authorities. Under Article 19(5), which applies from 11 December 2027, importers inform the manufacturer of a vulnerability without undue delay, and inform market surveillance authorities immediately where there is a significant cybersecurity risk. Article 14 notifications are the manufacturer’s, unless the importer becomes a manufacturer by selling the product under its own name or trademark (on our reading, the Article 3 definition; Article 21 from 11 December 2027).

Sources

1. Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal text — EUR-Lex. Articles 2, 3, 13, 14(7), 18 to 23, 52, 64, 66 and 71; Recital 78.
2. CRA Single Reporting Platform: Frequently Asked Questions, updated 15 October 2026 — ENISA. FAQs 8, 9, 18 and 24.
3. List of CSIRTs Designated as Coordinators — ENISA.
4. Cyber Resilience Act – Reporting obligations — European Commission, Shaping Europe’s digital future.
5. Regulation (EU) 2019/1020 on market surveillance and compliance of products — EUR-Lex. Articles 4 and 6.
6. Regulation (EU) 2023/988 (General Product Safety Regulation) — EUR-Lex. Articles 2(1) and 16.
7. Directive (EU) 2022/2555 (NIS2) — EUR-Lex. Article 26(3).