Assigned Representative is not the CRA's authorised representative
The names are close, which causes confusion. An authorised representative is a role in the Cyber Resilience Act itself: a person established in the EU whom a manufacturer appoints by written mandate to carry out specified tasks for it. Article 14(7) also uses it as one of the tests for which CSIRT a manufacturer without an EU main establishment reports to.
An Assigned Representative is a user role on ENISA's platform: someone who submits and updates notifications for the manufacturer. Having an authorised representative does not make them your platform AR, and your AR does not need to be your authorised representative. Validation procedures vary between CSIRTs, so ask yours what it expects as evidence that an AR may act for you.
Primary and Secondary ARs
| Primary AR | Secondary AR | |
|---|---|---|
| How many | One per manufacturer | Up to 20 |
| How they join | Registers directly, picks the CSIRT and enters the manufacturer | Accepts an email invitation from a Verified Primary AR within 7 days |
| Submit and update notifications | Yes | Yes |
| Manage the association | Invites and removes Secondary ARs, removes own association | Removes own association; can claim the Primary role, subject to CSIRT approval |
| Drafts | Visible only to the AR who saved them | |
Who sees which notifications: ENISA's FAQ says every AR of the same manufacturer can view and update its notifications, whoever submitted them, so a colleague can pick up the next stage. ENISA's interface guidance says a Secondary AR sees only the notifications it submitted. Until ENISA aligns the two, check in your own account before you plan a handover between people.
Registering when you need to submit
Per ENISA's registration guidance, the Primary AR:
- opens portal.cra-srp.enisa.europa.eu and selects the Assigned Representative role;
- selects the CSIRT designated as coordinator, which the manufacturer must identify under Article 14(7);
- authenticates with EU Login and accepts the legal agreement;
- confirms the personal details pulled from EU Login, which cannot be edited in the platform;
- enters the manufacturer name and any additional information.
The account is active straight away, the manufacturer entity is created, and the association goes to the CSIRT for validation. A misspelt manufacturer name creates a separate entity; ENISA says you can register again with the correct name, and ask the CSIRT to reject the wrong one if it was verified by mistake.
What to decide before your first incident
- Who will be Primary AR, and their stand-in. Backups can only be invited after verification, so your first notification may depend on one person being reachable.
- Personal EU Login accounts with MFA for both, tested now. Accounts are personal, so a shared team mailbox account does not fit the model.
- The exact manufacturer name to register, written down where the submitter can find it.
- Your CSIRT designated as coordinator and the reasoning. Which CSIRT do you notify?
- An internal case owner who decides reportability and the awareness time and approves the content. The AR is the person at the keyboard, not the decision-maker.
- What goes in each report, prepared as templates so the AR is pasting approved text. CRA SRP fields checklist
- Leavers: when an AR leaves, remove their association. A Primary AR can remove Secondary ARs once the association is Verified.
Questions people ask
- What is an Assigned Representative on the CRA Single Reporting Platform?
- A person who submits and updates Article 14 notifications on behalf of a manufacturer on ENISA's Single Reporting Platform. Each uses a personal EU Login account with multi-factor authentication. The CSIRT designated as coordinator validates whether they are authorised to act for that manufacturer.
- Is an Assigned Representative the same as an authorised representative under the CRA?
- No. 'Assigned Representative' is the platform's name for a user who submits notifications. An authorised representative is a separate role in the Cyber Resilience Act, appointed by a manufacturer by written mandate to carry out specified tasks on its behalf. One does not automatically make someone the other.
- How many Assigned Representatives can a manufacturer have?
- One Primary AR and up to 20 Secondary ARs, according to ENISA's FAQ. The Primary AR can invite Secondary ARs only once its association with the manufacturer shows as Verified.
- Can an Assigned Representative submit before the CSIRT validates them?
- Yes. Validation runs in parallel with reporting. ENISA says an AR whose manufacturer association is still unverified can submit up to 20 notifications for that manufacturer before verification becomes mandatory.
- Should we register our Assigned Representatives in advance?
- ENISA advises registering and starting validation only when you need to submit a notification, to limit the CSIRTs' workload. What you can do in advance is create EU Login accounts with MFA for the people who will submit, and decide who the Primary AR and their stand-in will be.
- What happens if a Secondary AR invitation is not accepted?
- The invitation link expires 7 days after it is sent and the user's status becomes 'Invitation Expired'. The Primary AR then has to send a new invitation.