Must third-country manufacturers appoint one?

The CRA puts it as an option: a manufacturer may appoint an authorised representative in writing. In practice it is still the obvious route for suppliers without an establishment in the Union, because market surveillance authorities need a contact there. Otherwise the importer effectively takes on that role.

Which duties can the representative not take on?

The obligations under Article 13(1) to (11), Article 13(12) first subparagraph, and Article 13(14) are expressly not part of the mandate. These include, in particular, developing to the essential cybersecurity requirements, the risk assessment, and vulnerability handling. An authorised representative is outward-facing representation, not an outsourcing of responsibility.

What must the mandate contain as a minimum?

Article 18(3) names three tasks the mandate has to enable at a minimum. The representative must be able to keep the EU declaration of conformity and the technical documentation available to market surveillance authorities (for at least ten years from placing on the market or for the support period, whichever is longer), to provide authorities, on reasoned request, with all information and documentation needed to demonstrate conformity, and to cooperate with market surveillance authorities, at their request, on action taken to eliminate the risks a product poses. On request it also supplies those authorities with a copy of the mandate.

Cyber Resilience Act

Authorised representative

Legal definition Art. 3(15) CRA

“a natural or legal person established within the Union who has received a written mandate from a manufacturer to act on its behalf in relation to specified tasks”

Regulation (EU) 2024/2847, Art. 3(15) CRA

The authorised representative is the manufacturer’s extended arm inside the Union. Two features define the role: establishment within the Union, and acting on the basis of a written mandate.

The written form is not a formality. The mandate is the document defining the scope of representation. Market surveillance authorities may request a copy of it.

What the mandate must at minimum allow

The manufacturer sets the scope, but not freely. Article 18(3) requires the mandate to enable at least three tasks. Two of them concern documents:

Keeping the documents available: the EU declaration of conformity and the technical documentation, for market surveillance authorities, for at least ten years from placing on the market or for the duration of the support period, whichever is longer.
Responding to authorities: on reasoned request, providing all information and documentation necessary to demonstrate conformity.

The third minimum task is cooperation with the market surveillance authorities, at their request, on any action taken to eliminate the risks posed by a product covered by the representative’s mandate. Everything beyond that is negotiable.

What expressly stays with the manufacturer

The Cyber Resilience Act (CRA) draws the line unambiguously: the obligations under Article 13(1) to (11), Article 13(12) first subparagraph, and Article 13(14) are not part of the mandate. A manufacturer cannot delegate that its product meets the essential cybersecurity requirements, that a risk assessment is produced and maintained, or that vulnerabilities are handled throughout the support period.

That is the decisive point for expectations: an authorised representative creates reachability and document availability in the Union. It does not create compliance.

Relation to the importer

Both roles sit in the Union but serve different purposes. The Importer places the product on the market and carries its own verification duties. The authorised representative places nothing on the market; it represents the manufacturer towards authorities.

A third-country supplier can have both side by side and usually will, because the roles answer different questions: who brings the product to market, and who can authorities talk to?

Choosing one

Because the mandate covers retention over ten years and more, the durability of the representative is a genuine selection criterion. A mandate that ends when a service provider changes leaves a gap exactly where authorities look first.

Practical questions

: The CRA puts it as an option: a manufacturer may appoint an authorised representative in writing. In practice it is still the obvious route for suppliers without an establishment in the Union, because market surveillance authorities need a contact there. Otherwise the importer effectively takes on that role.
: The obligations under Article 13(1) to (11), Article 13(12) first subparagraph, and Article 13(14) are expressly not part of the mandate. These include, in particular, developing to the essential cybersecurity requirements, the risk assessment, and vulnerability handling. An authorised representative is outward-facing representation, not an outsourcing of responsibility.
: Article 18(3) names three tasks the mandate has to enable at a minimum. The representative must be able to keep the EU declaration of conformity and the technical documentation available to market surveillance authorities (for at least ten years from placing on the market or for the support period, whichever is longer), to provide authorities, on reasoned request, with all information and documentation needed to demonstrate conformity, and to cooperate with market surveillance authorities, at their request, on action taken to eliminate the risks a product poses. On request it also supplies those authorities with a copy of the mandate.

This glossary is for orientation and does not constitute legal advice. The wording of Regulation (EU) 2024/2847 prevails.