EU CRA Authorized Representative — Appointed in 48 Hours
By RiskImmune™ Regulatory Team, CRA Representative Services, RiskImmune™ · Last updated 2026-04-24
The EU Cyber Resilience Act (CRA) requires every non-EU manufacturer placing products with digital elements on the EU market to appoint an EU-based Authorized Representative under CRA Article 18. The Authorized Representative holds technical documentation, receives regulator requests, cooperates with market surveillance authorities, and is named on the EU Declaration of Conformity. RiskImmune is a software-native CRA Representative serving non-EU manufacturers including IoT device makers, industrial control system vendors, embedded software developers, and connected hardware producers. We are appointed within 48 hours via a bilateral Authorized Representative Mandate, provide 10-year secure technical file hosting, handle vulnerability reporting to ENISA within 24 hours, and carry professional indemnity insurance covering our representative duties. Pricing is per product SKU: Starter at €2,400 per product per year, Portfolio at €28,000 for up to 25 products, and Enterprise from €65,000 for unlimited products. CRA vulnerability reporting obligations apply from 11 September 2026; full CRA application from 11 December 2027.
What is an EU Authorized Representative under the Cyber Resilience Act?
Under CRA Article 18, every non-EU manufacturer placing products with digital elements on the EU market must appoint an EU-based Authorized Representative. This Representative holds technical documentation, receives regulator requests, cooperates with market surveillance authorities, and is the named legal point of contact for the product's CRA compliance. Without one, the product cannot legally be placed on the EU market.
Which products require a CRA Authorized Representative?
The CRA applies to 'products with digital elements' — any software or hardware product with network connectivity or the ability to process data. This includes IoT devices, industrial control systems, embedded software, networking equipment, connected appliances, and standalone commercial software. Medical devices (MDR), motor vehicles, and aviation equipment are excluded as they are covered by sector-specific legislation.
How quickly can RiskImmune be appointed as CRA Representative?
RiskImmune completes the appointment process within 48 hours: intake form submission at H+0, scope review at H+4, mandate signing at H+24, technical file upload at H+36, and live confirmation with EU Declaration of Conformity naming text at H+48. This compares with 4–8 weeks for EU law firms and 2–6 months for notified bodies.
What are the CRA deadlines for non-EU manufacturers?
CRA vulnerability reporting obligations apply from 11 September 2026 — manufacturers must notify ENISA of actively exploited vulnerabilities within 24 hours. Full CRA application including conformity assessment, CE marking, and Authorized Representative appointment requirements apply from 11 December 2027. Non-compliance penalties reach €15M or 2.5% of global annual turnover.
What does RiskImmune's CRA Representative service include?
RiskImmune CRA Representative service includes: full CRA Article 18 representation, 10-year technical file hosting in a secure EU-based archive, 24-hour vulnerability reporting to ENISA, regulator notice and enforcement handling, annual compliance attestation, EU Declaration of Conformity naming, and professional indemnity insurance covering representative duties.