What a non-EU manufacturer must arrange under the Cyber Resilience Act
A manufacturer outside the EU keeps full responsibility for its own controls, even when its products reach EU users through importers or distributors. Article 18 requires it to appoint an authorised representative in the EU by written mandate, but that mandate cannot cover the design, risk assessment and vulnerability handling duties in Article 13(1) to (11). Those obligations stay with the manufacturer, and the authorised representative's role is limited to what the mandate allows: keeping the EU declaration of conformity and technical documentation available to authorities for 10 years or the support period, whichever is longer in the mandate's terms, providing conformity information on reasoned request, and cooperating on actions to eliminate product risks. Ask counsel to confirm the exact wording of the mandate against Article 18(3) before signing.
The practical answer depends on three facts: whether the company has an EU main establishment, how it sells (directly, through importers, through distributors or through online marketplaces), and how many EU subsidiaries sell or support the product under one group. Where there is no EU main establishment, Article 14(7) sets an order for choosing the CSIRT that receives notifications: the authorised representative first, then the importer, then the distributor, then the Member State where most users are located. Confirm this order against the regulation for each product line, because the route determines which national CSIRT you deal with from the reporting start date of 11 September 2026.
Importers and distributors will ask you for proof of conformity before they place your product on the market, and Article 19 makes them check it. Expect requests for the CE marking, the EU declaration of conformity and the Annex II user information, and prepare them in advance. Article 21 also matters: if an importer or distributor puts a product on the market under its own name or trademark, or substantially modifies it, it takes on manufacturer duties. Agree in writing which party carries each vulnerability notice, since Article 19(5) requires importers to pass vulnerabilities to you without undue delay. For a group with several EU subsidiaries, ENISA's platform FAQ states that one notification per actively exploited vulnerability or severe incident is sufficient, so assign one internal owner to coordinate that single filing.
How importers and distributors check a product before it reaches the EU market
An importer is the economic operator that places a product from a non-EU manufacturer on the EU market. Under Article 19(1), the importer may place only compliant products on the market. Under Article 19(2), before doing so, the importer must confirm that the manufacturer carried out the conformity assessment, drew up the technical documentation, affixed the CE marking and supplied the EU declaration of conformity and the Annex II user information. Article 19(4) then requires the importer to show its own name, registered trade name or trademark, postal address and an email or other digital contact on the product, its packaging or an accompanying document. Article 19(5) adds two reporting duties: inform the manufacturer without undue delay of any vulnerability the importer becomes aware of, and inform market surveillance authorities immediately if the product presents a significant cybersecurity risk.
- Conformity proof: Ask for the EU declaration of conformity and evidence that the assessment route was completed before shipment.
- Technical documentation: Confirm the manufacturer holds it and can produce it on request.
- Labelling data: Supply the importer's details in the form Article 19(4) requires, so the importer can print them on the product or packaging.
- Vulnerability feedback: Agree a channel and response time for vulnerability reports the importer passes to you.
- Market surveillance: Expect the importer to notify authorities if a risk is significant, so keep your own record of defects and fixes.
Check with the importer which of these items it needs in writing before it signs its first shipment, and keep the list on file.
A distributor makes a product available on the EU market without being the manufacturer or importer. Its duties are narrower than an importer's, but it must act with due care. In practice, a distributor checks that the CE marking is affixed, that the EU declaration of conformity and Annex II user information accompany the product, and that the manufacturer and importer details are on the product or its documentation. If something is missing or the product appears non-compliant, the distributor should not make it available until the gap is closed, and it should tell the manufacturer or importer. The distributor's checks are only as good as the paperwork you give it, so the manufacturer's job is to make the compliance information easy to verify.
- Visible marking: Confirm the CE marking and the importer details appear on the product or packaging.
- Accompanying documents: Provide the declaration of conformity and Annex II user information in the languages the destination market requires.
- Traceability: Give each batch or model a unique identifier so the distributor can match stock to documents.
- Recall and corrective support: Agree how the distributor will pass on corrective actions and withdrawals.
- Own-name risk: Warn the distributor that selling under its own brand changes its role under Article 21.
Ask each distributor to confirm in writing which of these checks it performs and what it will do when a document is missing.
Article 21 treats an importer or distributor as a manufacturer when it places a product on the market under its own name or trademark, or when it substantially modifies a product already on the market. In that case, the operator takes on the manufacturer obligations of Articles 13 and 14, including the vulnerability handling, technical documentation and reporting duties. A non-EU manufacturer should check this before a partner begins private labelling or customizing its product, because the manufacturer's handover package changes. The question of whether a change is substantial is covered separately, but a partner's own-brand launch alone triggers the role change.
- Private labels: A partner selling under its own brand becomes a manufacturer for that product.
- Substantial modification: A partner that changes a product materially may also take on the manufacturer role.
- Contract terms: Put the role consequences in the distribution or import agreement, including who holds the technical documentation.
- Documentation split: Agree which party keeps the design, risk assessment and vulnerability records.
- Reporting lines: Confirm who files Article 14 notifications if both parties could be treated as manufacturers.
Before any own-brand or customization arrangement is signed, ask counsel to confirm the role each party will hold under Article 21.
Which CSIRT receives reports when there is no EU main establishment
This sequence tells a manufacturer without an EU main establishment which Member State's CSIRT receives its Article 14 notifications, and records the reasoning so the choice can be defended to authorities. It ends with a single notification routed through the Single Reporting Platform.
Confirm whether an EU main establishment exists
The compliance lead checks whether the manufacturer has a main establishment in the EU, meaning the place where its cybersecurity decisions are predominantly taken. Legal counsel or the board secretary should confirm this from the corporate structure, not from a mailing address. The output is a written statement recording the answer and the evidence behind it, such as where the product security decisions are approved. If an EU main establishment exists, the routing in the next step is the one that applies and the Article 14(7) order does not.
Identify where cybersecurity decisions are predominantly taken
Where the manufacturer has an EU main establishment, or where the group's cybersecurity decisions are taken within the EU, the relevant Member State is the one where those decisions are predominantly taken. The compliance lead records the Member State, the decision-making body or role, and the documents that show where product security decisions are approved. Ask the parent company to confirm this in writing if decisions are made outside the EU. The output is a recorded Member State with its supporting reasoning.
Apply the Article 14(7) fallback order
If the manufacturer has no EU main establishment, Article 14(7) sets the order. The compliance lead first checks whether the manufacturer has appointed an authorised representative under Article 18 and, if so, uses the Member State where that representative is established. If there is no representative, the next candidate is an importer, then a distributor, then the Member State where most users of the product are located. The output is a note showing which step applied and why earlier steps did not.
Record the chosen Member State and reasoning
The compliance lead writes down the selected Member State, the Article 14(7) step that produced it, and the facts relied on, such as the appointment letter or the importer's registered address. The record should also name the CSIRT designated as coordinator in that Member State. Review the record whenever the appointment of a representative, the importer relationship or the distribution footprint changes. The output is a dated routing decision that counsel can review if an authority asks how the CSIRT was chosen.
Submit through the Single Reporting Platform
ENISA launched the initial operating capability of the CRA Single Reporting Platform on 11 September 2026, the day manufacturer reporting obligations began. The manufacturer submits its early warning and notification through the platform, which routes the report to the coordinator CSIRT that the manufacturer identified. The coordinator CSIRT receives it, and it is made available to ENISA at the same time. The output is a platform submission reference that the compliance lead stores with the routing record.
Make one notification per event across the group
Where a corporate group has several EU subsidiaries or a parent outside the EU, ENISA's platform guidance says only one notification is required per actively exploited vulnerability or severe incident. The group must coordinate internally so that a single report is filed through the chosen route, and the responsibility for that coordination rests with the manufacturer. The output is an internal instruction naming the one filing entity and the person who approves each submission.
Keep the routing current for active obligations
The Article 14 obligations already apply, so the routing must be ready before an event occurs and not only after one. The compliance lead tests the routing on a schedule, confirms that the named contacts and platform access still work, and updates the record when the representative or distribution arrangements change. The output is a dated check log that shows the routing was valid when a notification might have been needed. Confirm current platform procedures on the ENISA pages before relying on them.
One notification per event across a corporate group
A manufacturer outside the EU with several EU subsidiaries, or a parent company abroad, has to settle how a reportable event reaches the authorities. ENISA's platform FAQ says one notification is required per actively exploited vulnerability or severe incident, and coordinating that internally is the manufacturer's job. The cards below set out the decisions that make that single report work in practice.
Name one reporting entity
Choose the single legal entity that files the Article 14 notification and holds the reporting obligation for the group. Confirm that this entity is named in the manufacturer's records and that its contact details are available for the platform. Subsidiaries should not each file on their own initiative, since the FAQ calls for one notification per event. Record which entity carries the duty and why, so an assessor or authority can see the choice was deliberate.
Agree internal escalation paths
Define how a signal from a subsidiary, support team or security researcher reaches the reporting entity. Write down who receives the first signal, who decides whether it is an actively exploited vulnerability or a severe incident, and how quickly that decision must be made. Test the path with a tabletop exercise before an event occurs. Without a documented path, two entities may each report the same event or neither may report it.
Decide the CSIRT route
Determine which CSIRT receives the notification. Under Article 14(7), a manufacturer with no EU main establishment follows an order that starts with the authorized representative, then the importer, then the distributor, and then the Member State where most users are. Confirm which Member State applies to the group's facts and document the reasoning. The chosen route should match the entity that holds the reporting duty.
Keep a record of each decision
Keep a dated written record of the reporting entity, the escalation path, the CSIRT route and the reasons for each. Store it with the technical documentation and update it when subsidiaries, product lines or representatives change. The record shows how the group met its duty and helps when a market surveillance authority asks why a notification came from one entity and not another.
Assign internal coordination ownership
Name one person or team that coordinates across entities during an event, including the parent company, subsidiaries, the authorized representative and any importers. The FAQ places internal coordination on the manufacturer, so this role cannot be left to assumption. Confirm that the coordinator has authority to pull in technical staff and that the role has a deputy who can act outside working hours.
Who owns what: manufacturer, representative, importer and implementation partner
The manufacturer remains accountable for the product and cannot hand that accountability to anyone else. Under Article 18, the design, risk assessment and vulnerability handling obligations in Article 13(1) to (11) cannot form part of any representative mandate. The manufacturer therefore decides the cybersecurity risk assessment, sets the Annex I requirements that apply, runs vulnerability handling for the whole support period and takes the conformity decisions, including choosing the assessment route and signing the EU declaration of conformity.
- Risk assessment: The manufacturer documents the cybersecurity risk assessment and the reasons for any requirement it considers not applicable.
- Vulnerability handling: The manufacturer runs the Annex I Part II processes and the Article 14 reporting duty for its own products.
- Conformity decisions: The manufacturer selects the conformity assessment module and affixes the CE marking.
- Technical documentation: The manufacturer keeps the technical documentation current.
- Coordination: Where several group entities are involved, the manufacturer coordinates internally so that one notification goes out per event.
Confirm with counsel which legal entity is the manufacturer for each product line before assigning these duties.
A manufacturer established outside the EU may appoint an authorised representative in the Union by written mandate. The mandate is a legal instrument, so its wording, scope and liability terms should be reviewed by counsel. Article 18(3) sets minimum content: the representative must be able to keep the EU declaration of conformity and technical documentation available to authorities for 10 years or the support period, whichever is longer under the text, provide conformity information on reasoned request, and cooperate with authorities on actions to eliminate product risks.
- Documents: The representative holds the EU declaration of conformity and technical documentation for the required period.
- Information requests: It provides conformity information to market surveillance authorities on reasoned request.
- Risk cooperation: It cooperates on actions that eliminate product risks.
- Limits: It cannot take over the Article 13(1) to (11) design, risk assessment or vulnerability handling duties.
- Reporting: Article 14(7) makes the representative the first point in the order used to choose the notifying CSIRT when there is no EU main establishment.
Confirm the mandate text, the retention period and the contact details that will appear on the product or its documents.
Importers and distributors sit between the manufacturer and the market, and the regulation gives them their own checks before a product is sold. Under Article 19, an importer may place only compliant products on the market and must confirm that the manufacturer completed conformity assessment, drew up technical documentation, affixed the CE marking and supplied the EU declaration of conformity and the user information. Article 20 sets parallel duties for distributors. Both parties must act on known vulnerabilities and risks.
- Pre-sale checks: Confirm the conformity assessment, documentation, CE marking, declaration and user information before placing the product on the market.
- Contact details: Name, trade name or trademark, postal address and a digital contact must appear on the product, packaging or an accompanying document.
- Vulnerability notice: Inform the manufacturer without undue delay of any vulnerability found, and inform market surveillance authorities immediately if the product presents a significant cybersecurity risk.
- Becoming a manufacturer: Under Article 21, an importer or distributor that sells under its own name or trademark, or substantially modifies a product, takes on manufacturer duties.
Ask each importer and distributor which checks it performs and keep written records of them.
An implementation partner such as DeployOpen works for the manufacturer on the systems, documentation and evidence that the manufacturer needs. The partner prepares and hands over these materials, and the manufacturer remains the party that decides and signs. DeployOpen plans, implements, documents and supports self-hosted open-source platforms in the client's own infrastructure, and runs security testing. It does not act as the authorised representative unless it is engaged for that role under a separate written mandate, and that mandate remains a legal matter for the parties and their counsel.
- Preparation: Build and document the systems that support the Annex I requirements, the vulnerability handling process and the reporting workflow.
- Evidence: Produce test results, configuration records and documentation that the manufacturer can review and adopt.
- Handover: Hand over materials in agreed formats, scoped in writing before work starts.
- Not included: The partner does not issue reports, attestations or certificates, and does not make the manufacturer's conformity decisions.
- Independent check: Where a route requires an independent auditor or notified body, that body issues any report or certificate.
Before engaging a partner, confirm in the written scope which deliverables it prepares and which decisions remain with the manufacturer.
Independent assessment is separate from preparation. Where a conformity route requires it, a notified body is the body that assesses the product and can issue the certificate, and a market surveillance authority checks products and enforces the regulation. These parties are independent of both the manufacturer and any partner that helped prepare the evidence. Notified bodies are designated by Member States and listed in the Commission's NANDO system. Most products follow self-assessment under module A, so many manufacturers will not need a notified body.
- Route check: Confirm with the notified body or the Commission guidance whether the product needs a third-party route at all.
- Notified body listing: Check that the body appears in NANDO for the relevant scope before contracting.
- Independence: Keep preparation work and assessment work with separate parties so the assessor can review the evidence without conflict.
- Authority contact: Market surveillance authorities may request information and products at any time.
- Timing: Confirm with the chosen body how it schedules assessment and what it will need from the manufacturer.
Ask the notified body for its written assessment scope and fee basis before preparing evidence for it.
Questions non-EU manufacturers ask about CRA representation and reporting
Can our EU authorised representative also run our vulnerability handling?
No. Under Article 18, a manufacturer can appoint an authorised representative by written mandate, but the design, risk assessment and vulnerability handling obligations in Article 13(1) to (11) cannot form part of that mandate. The representative must be able to keep the EU declaration of conformity and technical documentation available to authorities for 10 years or the support period, whichever is longer, provide conformity information on reasoned request, and cooperate on actions to eliminate product risks. Your organization keeps ownership of the vulnerability process, and the mandate should say so in writing. Ask your representative to show exactly which duties sit in the mandate and which stay with your own engineering and PSIRT teams.
Do importers need to check our technical documentation before selling our products in the EU?
Importers must confirm that the documentation was drawn up, not review its contents in depth. Under Article 19, an importer may place only compliant products on the market and must, before doing so, ensure that you carried out the conformity assessment, drew up the technical documentation, affixed the CE marking and supplied the EU declaration of conformity and the Annex II user information. Importers must also show their name, registered trade name or trademark, postal address and a digital contact on the product, its packaging or an accompanying document. If an importer becomes aware of a vulnerability, it must inform you without undue delay, and inform market surveillance authorities immediately if the product presents a significant cybersecurity risk. Expect importers to ask for these documents before they sign a distribution agreement.
Which CSIRT do we report to if we have no EU office?
Follow the order in Article 14(7). Notifications go to the CSIRT of the Member State where your cybersecurity decisions are predominantly taken. If you have no EU main establishment, the order is your authorised representative, then the importer, then the distributor, then the Member State where most users of the product are located. Determine this before you place a product on the market, because the answer decides which CSIRT receives your early warning and whether that Member State is your reporting point for the whole product line. Record the reasoning in your compliance file so an authority can see how you reached it. Notifications are submitted through ENISA's CRA Single Reporting Platform, which makes them available to ENISA at the same time.
Do our EU subsidiaries each have to file a separate report?
Usually not. ENISA's platform FAQ states that only one notification is required per actively exploited vulnerability or severe incident, even when a manufacturer has several EU subsidiaries or a parent outside the EU. Coordinating the internal decision and the single filing is your responsibility, so the group needs a documented escalation path that names who files, which entity is the manufacturer of record and which CSIRT receives the notification. Subsidiaries should still hold their own role information, such as whether they act as importer or distributor, because those roles carry their own obligations. Test the escalation path in a tabletop exercise before the reporting duty is live for your products.
What will it cost to appoint a representative and meet CRA reporting duties?
No fee figure has been published for this topic, and the answer depends on your scope and the mandate you agree. Cost has several parts: the authorised representative's fee for holding documentation and handling authority requests, the importer and distributor arrangements you negotiate, internal effort for the reporting process and the single group filing, and any external work to prepare evidence. Ask each representative for a written mandate scope, the retention period it covers, the response times it commits to for authority requests, and what is charged for each recurring service. For a fuller breakdown of one-time and recurring costs, read the CRA compliance cost guide and compare quotes against the same written scope.
Can DeployOpen act as our representative or certify our products?
No. DeployOpen does not act as an authorised representative, and it does not issue audit reports, attestations or certifications. An implementation partner can help prepare the systems, controls and evidence that your own team and an independent body will review, such as logging, vulnerability tracking, SBOM workflows and reporting runbooks, delivered under a fixed written scope. Your organization owns its controls and the reporting decisions. Conformity assessment for products in the relevant classes is carried out by a notified body or through the self-assessment route, depending on classification, and only those bodies issue the documents that count. Confirm the role of any partner in writing before work starts.
How DeployOpen works on this
DeployOpen works on the technical side of CRA readiness for manufacturers outside the EU: the systems, controls and evidence that support reporting and manufacturer duties. The manufacturer keeps ownership of its controls, while DeployOpen plans, builds and documents the self-hosted open-source platforms and evidence trail inside the client's own infrastructure. Independent auditors and notified bodies remain the only parties that issue assessment outcomes.
How we scope
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- The written scope names which products, EU entities and reporting routes are covered, including the CSIRT and authorised representative arrangements.
- We confirm which party holds each obligation so the manufacturer, its representative and importers have clear roles.
How we build
- We prepare self-hosted open-source platforms for vulnerability intake, triage and documentation inside your own cloud accounts or data centers.
- We configure internal workflows that route an actively exploited vulnerability or severe incident to a single notification decision across the group.
- We test the reporting workflow, including the 24-hour early warning steps, before it is relied on in a live event.
How we hand over
- We deliver runbooks, configuration records and an evidence index that maps each workflow step to the record it produces.
- We document the notification decision path, naming the owner for each step and the contact points for the authorised representative and importers.
- Handover includes training for the staff who will act during an event, delivered through the written scope.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- We can retest the reporting workflow after platform upgrades or changes to group structure or CSIRT designation.
- Questions on legal duties, notified body selection and regulatory interpretation should go to qualified counsel or the relevant authority.
