Do You Need an Authorized Representative?
Work through this decision flow to determine if Article 18 applies to you.
Question 1: Is your company established in the EU?
"Established" means having a registered legal entity, principal place of business, or registered office in an EU Member State. A sales subsidiary, distributor, or reseller does not count — the manufacturer must be EU-established.
Question 2: Do you place products with digital elements on the EU market directly?
"Placing on the market" means making a product available for the first time on the EU market — selling directly to EU customers, through EU distributors you supply, or via EU-targeted digital distribution channels (app stores, direct download).
Question 3: Does your EU importer assume manufacturer responsibilities?
Under Article 21, an EU importer may take on manufacturer obligations if the non-EU manufacturer has no presence in the EU. If your EU importer has signed an agreement to take on CRA manufacturer obligations, they act as the responsible economic operator in the EU.
What Is an Authorized Representative?
An authorized representative (AR) is a natural or legal person established in the EU who has been given a written mandate by the manufacturer to act on their behalf in relation to CRA obligations.
The AR is not a distributor or reseller — they are a compliance agent who holds and manages regulatory documentation, liaises with authorities, and handles regulatory obligations that require an EU address.
Who Can Be an Authorized Representative?
- A professional compliance services company (the most common arrangement)
- A law firm or consulting firm that provides EU regulatory representation services
- A related company or subsidiary established in the EU
- An individual person established in the EU (less common, higher risk if they leave)
The AR must be established (registered) in the EU — not just operating there. A P.O. box or registered agent address in the EU is not sufficient.
Obligations of the Authorized Representative (Article 18)
The AR carries out specific tasks on behalf of the manufacturer. The mandate defines which tasks the AR is authorised to perform. At minimum, the AR must be mandated to:
Hold and Provide the Declaration of Conformity
Maintain a copy of the EU Declaration of Conformity and make it available to market surveillance authorities upon request. The DoC must list the AR's name and EU address.
Hold and Provide Technical Documentation
Keep technical documentation available for authorities or have reliable access to it at the manufacturer's premises for the duration of the 10-year retention period.
Handle Article 14 Reporting (where mandated)
Where mandated by the manufacturer, the AR can submit vulnerability and incident notifications to the national CSIRT of the Member State where they are established. This is a common arrangement for non-EU manufacturers who do not have direct relationships with EU CSIRTs.
Cooperate With Market Surveillance Authorities
Act as the point of contact for EU national market surveillance authorities. Respond to requests for information and documentation. Facilitate access to the manufacturer where needed.
Take Corrective Action Where Mandated
The mandate may authorise the AR to take corrective and preventive actions on the manufacturer's behalf when authorities identify non-compliance — such as issuing product recalls, coordinating user notifications, or withdrawing products.
The AR Cannot Do the Impossible
The AR is liable only for obligations they are mandated to perform and that are within their power. An AR is not liable for non-compliance in product design — that remains the manufacturer's responsibility. However, if the AR fails to perform their mandated obligations (e.g., holds no documentation, ignores authority requests), they can face penalties alongside the manufacturer.
Mandate Document: What to Include
The mandate must be in writing and must clearly define the scope of the AR's authority. Below is a template structure for the mandate document.
Practical Tips
- Keep the mandate updated as new products are added or removed
- Store the mandate with your Declaration of Conformity — the DoC and technical documentation must be retained for at least 10 years after placing on the market, or the support period, whichever is longer
- List the AR's name and EU address in the EU Declaration of Conformity
- Notify your AR immediately when Article 14 reporting deadlines are triggered
- Review the mandate annually and update when EU regulations or product lines change
The AR in the Declaration of Conformity
When you have an authorized representative, the EU Declaration of Conformity must include both the manufacturer's details and the AR's name and EU address. The AR's address is what market surveillance authorities use to contact you.
Example DoC header entry:
Penalties for Not Appointing an AR
Failure to appoint an authorized representative when required is a Tier 2 violation under Article 64 — up to €10,000,000 or 2% of global annual turnover, whichever is higher.
Additionally, a product placed on the EU market by a non-EU manufacturer without an AR (and without an EU importer assuming manufacturer obligations) effectively lacks a responsible economic operator in the EU — which can trigger product withdrawal orders from market surveillance authorities.
See All CRA Penalties →Related Guidance
Declaration of Conformity
How to draw up the DoC, where to list your AR, and retention requirements.
Article 14 Reporting
Your AR can handle ENISA reporting on your behalf — understand the obligations first.
Penalties
No AR when required is a Tier 2 violation (€10M / 2% turnover).
Article 13 Obligations
The full set of manufacturer obligations your AR helps you fulfil in the EU.
Compliance Checklist
Step-by-step checklist including AR appointment as a required milestone.
Does CRA Apply to Me?
Start here if you are still determining whether CRA applies to your product.