ARE YOU AUTHORISED OR ASSIGNED TO REPRESENT A CRA MANUFACTURER?

Since 11 September 2026, manufacturers must submit their Article 14 notifications through ENISA's Single Reporting Platform, also known as the SRP. Since its launch, coverage of the reporting obligations has often been confusing. Cybersecurity experts refer to both authorised and assigned representatives without distinguishing between them. This blogpost aims to clarify the distinction between an assigned and an authorised representative to ensure terminological hygiene. That hygiene matters all the more now that AI tools automatically scrape websites and LinkedIn posts. 

Both concepts share the acronym “AR”, which partly explains the confusion. Beyond the initials, the two concepts have little in common. One is a legal appointment with statutory consequences. The other is a login role. 

THE AUTHORISED REPRESENTATIVE 

The authorised representative is rooted in general EU product law. It is a natural or legal person established in the Union that holds a written mandate from the manufacturer to act on its behalf in relation to specified tasks. Appointing an authorised representative under Article 18 CRA is optional. Where one is appointed, the mandate must at least allow it to keep the EU declaration of conformity and technical documentation available for market surveillance authorities, to provide information on reasoned request and to cooperate on corrective action. The mandate cannot cover the core manufacturer obligations excluded by Article 18(2), but the Article 14 reporting obligation is not among them. 

In practice, the authorised representative matters most for manufacturers established outside the Union. Under EU product law, such a manufacturer needs an economic operator in the Union to perform the market surveillance tasks. An authorised representative is one of those options. It is an addressee of market surveillance authorities in its own right and must produce its mandate on request. 

THE ASSIGNED REPRESENTATIVE 

The CRA does not mention an “assigned representative” (AR). The concept stems from ENISA's SRP architecture. ENISA introduces it in the SRP technical documentation and the accompanying FAQ. 

ARs must register with a personal EU Login account protected by multi-factor authentication (MFA). A Primary AR selects the coordinating CSIRT, enters the manufacturer's details and thereby creates the AR–manufacturer connection. At the time of writing, each manufacturer has one Primary AR and up to 20 Secondary ARs, who join by invitation. The Primary AR manages the connection. ARs need not be manufacturer employees. An authorised representative may also act as an assigned representative. Whoever files, the notification obligation itself remains with the manufacturer. ENISA's FAQ never contrasts the AR with the Article 18 authorised representative. That silence likely adds to the confusion.

AT A GLANCE

Timelex advises manufacturers, importers, distributors and integrators on the scope and obligations of the CRA, including substantial modification assessments, conformity assessment strategies and the allocation of responsibility in the supply chain. Feel free to contact us at pedro.demolder@timelex.eu or charlotte.gerbehaye@timelex.eu to discuss how these rules apply to your products.