What Article 3(15) and Article 18 actually say
Article 3(15) defines an authorised representative as a natural or legal person established within the Union who has received a written mandate from a manufacturer to act on its behalf in relation to specified tasks. Article 18(1) confirms a manufacturer may appoint one by written mandate. Article 18(3) requires the representative to perform the tasks in that mandate, to provide a copy of the mandate to market surveillance authorities on request, and that the mandate allow at least: keeping the EU declaration of conformity and technical documentation available for the retention period in Article 18(3)(a); providing conformity information and documentation on a reasoned authority request; and cooperating on action to eliminate risks from products covered by the mandate.
Article 18(2) is the hard stop: obligations in Article 13(1) to (11), Article 13(12) first subparagraph, and Article 13(14) shall not form part of the mandate. Core cybersecurity design, vulnerability-handling and related manufacturer duties stay with the manufacturer even when an EU contact is appointed. Appointment under Article 18 is optional in the CRA text itself — other product or market-surveillance regimes may still require an EU economic operator; assess those separately.
Article 14 still names the manufacturer
Article 14 obliges manufacturers to notify actively exploited vulnerabilities and severe incidents having an impact on the security of the product with digital elements — early warning within 24 hours of becoming aware, fuller notification within 72 hours, then the final report on its own trigger — through ENISA's Single Reporting Platform. The duty attaches to the manufacturer under Article 3(13). Article 18 does not rewrite Article 14 into an authorised-representative filing statute. A mandate can expressly authorise help with notifications; it does not make the representative the default duty-holder or pause the clocks.
From 11 September 2026 those clocks apply under Article 71(2) / Recital 126, including for in-scope products already placed under Article 69(3). Appointing counsel or an EU office for market-surveillance contact is useful — it is not a Dec 2027 holiday and not a GPSR- style escape. Deadline overview: Article 14 reporting deadlines.
The trap: “our EU AR files Article 14 for us”
Three failure modes dominate triage. First: teams treat “authorised representative” and “Assigned Representative” as one badge — so they appoint an Article 18 mandate and assume SRP access exists, or they create an SRP AR account and assume Article 18 duties are covered. They are different instruments. Platform roles: CRA Assigned Representative on the SRP.
Second: non-EU manufacturers assume the Article 18 person (or the EU importer) owns the early warning. Article 14 stays on the manufacturer; Article 14(7) only uses the authorised representative as the first CSIRT-routing fallback when there is no Union main establishment. Routing detail: which CSIRT do you notify and Article 14 for non-EU manufacturers. Importers and distributors have separate Article 19/20 duties — not a substitute filing: importers and distributors.
Third: white-label / OEM-ODM chains assume “whoever has the EU AR” is the manufacturer. Manufacturer status follows who places the product under whose name or trademark (Article 3(13)), not who holds the Article 18 mandate. See white-label and OEM/ODM.
Keep the three roles on separate lines
| Role | Source | What it does for Article 14 |
|---|---|---|
| Manufacturer | Art 3(13) | Owns the Article 14 duty and clocks |
| Authorised representative | Art 3(15) / Art 18 | Mandate tasks + Art 14(7) CSIRT fallback; not automatic filer |
| Assigned Representative | ENISA SRP | Platform submitter (EU Login); not the Art 18 role |
Before the first exploited vulnerability: write down manufacturer entity per product, Article 14(7) routing facts, who holds EU Login / SRP Assigned Representative access, and who decides reportability and awareness time. Practice the chain on the free desk — filing still goes through ENISA.
Questions people ask
- Is a CRA Article 18 authorised representative the same as an ENISA SRP Assigned Representative?
- No. Article 3(15) / Article 18 define a Union-established person with a written mandate for specified manufacturer tasks (market-surveillance contact, documentation, cooperation). ‘Assigned Representative’ is ENISA’s Single Reporting Platform user role for people who submit Article 14 notifications with EU Login. One appointment does not create the other.
- Does appointing an authorised representative transfer Article 14 reporting off the manufacturer?
- No automatic transfer. Article 14 addresses the manufacturer. Article 18 lets you mandate specified tasks; Article 18(2) blocks certain Article 13 design and vulnerability-handling duties from the mandate and does not say Article 14 moves. The mandate can expressly authorise help with notifications, but the manufacturer remains the obligated party.
- What must an Article 18 mandate cover at minimum?
- Article 18(3): keep the EU declaration of conformity and technical documentation available to market surveillance authorities for at least 10 years after placement or for the support period, whichever is longer; on a reasoned request, provide information and documentation needed to demonstrate conformity; and cooperate, at authority request, on action to eliminate risks from products covered by the mandate. The representative performs only tasks specified in the mandate and must provide a copy of it on request.
- What cannot go into an Article 18 mandate?
- Article 18(2): obligations in Article 13(1) to (11), Article 13(12) first subparagraph, and Article 13(14) shall not form part of the mandate — so core design, development, production, risk assessment, component due diligence, vulnerability handling and related manufacturer duties stay with the manufacturer.
- How does an authorised representative affect which CSIRT we notify?
- For manufacturers without a Union main establishment, Article 14(7) uses the Member State of the authorised representative acting for the highest number of that manufacturer’s products as the first fallback before importer, distributor and user geography. That chooses the CSIRT end-point for the manufacturer’s own filing — it does not make the authorised representative the Article 14 duty-holder. See our which-CSIRT and non-EU manufacturer guides.
- Who actually clicks submit on the Single Reporting Platform?
- An ENISA SRP Assigned Representative (Primary / Secondary) with a personal EU Login account — a platform operational role validated by the coordinating CSIRT. That person may be your employee, counsel, or someone else you trust with the keyboard; they are not automatically your Article 18 authorised representative, and your Article 18 mandate does not by itself create SRP access. See our Assigned Representative guide.