Skip to content
CRA Reporting Desk

CRA Article 14 for non-EU manufacturers: who reports, which CSIRT

If you place connected products or software on the EU market from the US, UK, Asia or elsewhere, Article 14 still names you as the reporter. Your importer does not file the early warning for you. An authorised representative does not quietly absorb the duty. Here is what actually changes when you have no main establishment in the Union — and what you should lock down before the 24-hour clock starts.

The short version

  • Duty-holder: the manufacturer under Article 3(13) — no EU company required. Live since 11 September 2026.
  • Not your importer's job: Article 19/20 are separate; they do not replace Article 14. See importers and distributors.
  • CSIRT without EU HQ: Article 14(7) cascade — authorised representative → importer → distributor → users. Details in which CSIRT.
  • Same clocks: 24-hour early warning, 72-hour notification, then the final-report rules for the vulnerability or severe-incident track.
Track your Article 14 clockOpen the deadline calculator

Manufacturer status does not require an EU seat

Article 3(13) defines a manufacturer as the natural or legal person who develops or manufactures products with digital elements, or has them designed, developed or manufactured, and markets them under its name or trademark — whether for payment, monetisation or free of charge. There is no "established in the Union" limb in that definition. Article 14(1) and 14(3) then say a manufacturer shall notify actively exploited vulnerabilities and severe incidents via the single reporting platform. If you are that manufacturer for products placed on the Union market, the reporting chain is yours even when your HQ, PSIRT and engineering sit outside the EU.

What changes is the CSIRT end-point, not the obligation

Article 14(7) first points notifications to the CSIRT of the Member State where you have your main establishment in the Union — where decisions related to the cybersecurity of your products are predominantly taken (or, if that cannot be determined, where you have the establishment with the highest number of employees in the Union).

Where you have no main establishment in the Union, the same paragraph sets a strict fallback, based on information available to you:

  1. Member State of the authorised representative acting for the highest number of your products with digital elements;
  2. failing that, of the importer placing the highest number of those products on the market;
  3. failing that, of the distributor making the highest number available on the market;
  4. failing all of those, where the highest number of your users are located — and you may keep using that same CSIRT for later cases once chosen.

That cascade chooses the postbox. It does not reassign who must send the early warning. Record the facts for each product family in advance; see the full routing checklist on which CSIRT do you notify.

Authorised representative vs Assigned Representative

Two different "AR" labels confuse third-country teams:

  • Authorised representative (Article 3(15) / Article 18) — an EU-established person with a written mandate for specified tasks. Useful for market-surveillance contact and often the first step in the Article 14(7) cascade. Article 18(2) keeps certain Article 13 manufacturer duties out of any mandate; it does not make Article 14 optional for you. If you want them to help submit notifications, put that in the mandate expressly — and still treat the manufacturer as the obligated party.
  • Assigned Representative (ENISA SRP) — a platform user role (Primary / Secondary) with EU Login who submits notifications on the Single Reporting Platform. Appointing a legal authorised representative does not create SRP access. See CRA Assigned Representative.

Importers and distributors are not a reporting escape hatch

Non-EU makers often assume "our EU importer handles compliance filings." For Article 14 that is wrong. Importers and distributors must inform the manufacturer and, in significant-risk cases, market surveillance authorities — they do not file the manufacturer's Article 14 chain on the SRP. Full breakdown: Article 14 for importers and distributors. If an EU brand commissions you as ODM and sells under its trademark, that brand is usually the manufacturer for those units — see white-label and OEM/ODM.

Same clocks as everyone else

From awareness of an actively exploited vulnerability or a severe incident affecting product security: early warning within 24 hours, fuller notification within 72 hours, then the final report (14 days after a corrective or mitigating measure is available for an exploited vulnerability; within one month after the 72-hour notification for a severe incident). Awareness is not "first email landed" — see when the clock starts. Deadline overview: reporting deadlines explained. Official submission still goes through the ENISA Single Reporting Platform.

Questions people ask

Does Article 14 apply if our company has no EU legal entity?
Yes, if you are the manufacturer placing products with digital elements on the Union market. Article 3(13) defines manufacturer by who develops or manufactures (or has them designed/manufactured) and markets under its name or trademark — with no EU-establishment requirement. Article 14 addresses that manufacturer. Having no EU company changes which CSIRT end-point you use under Article 14(7); it does not remove the duty.
Can our EU importer file the Article 14 report instead of us?
No. Article 14 is a manufacturer obligation submitted via the ENISA Single Reporting Platform. Importers have separate Article 19 duties (inform the manufacturer without undue delay; alert market surveillance authorities where there is significant cybersecurity risk). Appearing in the Article 14(7) fallback order only helps pick which CSIRT receives the manufacturer's notification — it does not move the filing onto the importer. See our importers and distributors guide.
Does appointing an authorised representative transfer Article 14 to them?
No automatic transfer. Article 18 lets you appoint an EU-established authorised representative by written mandate for specified tasks. Article 18(2) blocks putting certain Article 13 design and vulnerability-handling duties into that mandate; it does not say Article 14 moves off the manufacturer. The mandate can expressly authorise help with notifications, but Article 14 still addresses the manufacturer. An authorised representative is also not the same as an ENISA SRP Assigned Representative.
Which CSIRT do we notify if we have no main establishment in the Union?
Article 14(7): use the electronic notification end-point of the CSIRT designated as coordinator in the Member State determined, on information available to you, in this order — (a) authorised representative acting for the highest number of your products; else (b) importer placing the highest number; else (c) distributor making the highest number available; else (d) where the highest number of your users are located. For point (d), you may keep using the same CSIRT for later cases once chosen. Work this out before an incident — the 24-hour early warning does not leave room to invent the route under pressure.
When did reporting start for non-EU manufacturers?
The same date as for EU manufacturers: Article 14 reporting duties apply from 11 September 2026. Being established outside the Union does not delay that clock. Open-source software stewards are on a different calendar (Article 24(3) from 11 December 2027) — that is not a third-country manufacturer carve-out.
What should we decide before the first exploited vulnerability?
At minimum: which legal entity is the manufacturer for each product; whether you have any Union main establishment for cybersecurity decisions; your Article 14(7) cascade facts (authorised representative, lead importer/distributor, user geography); who holds EU Login / SRP Assigned Representative access; and how you will timestamp awareness. Then practice the 24h / 72h / final-report chain on the free desk or deadline calculator — filing still goes through ENISA's platform.

Lock the route, then run the clocks

Enter your awareness time in the free desk or deadline calculator and get the 24-hour, 72-hour and final-report dates for this case. No sign-up; data stays in your browser. Pair that with a written Article 14(7) routing note so the team is not choosing a CSIRT inside the early-warning window.

Track your Article 14 clockOpen the deadline calculator

Workflow support, not legal advice. Whether you are the manufacturer for a given product, how Article 18 mandates interact with live filings, and which Member State your Article 14(7) cascade selects are determinations for qualified counsel. Claims above track Regulation (EU) 2024/2847 Articles 3(13)/(15), 14 and 18 as reproduced on secondary OJ sources (e.g. headlesslaw / springlex). Confirm against the Official Journal text (EUR-Lex) and current Commission / ENISA guidance before relying on this for a live case.