What is an EU Authorized Representative?
An EU Authorized Representative (AR) is a natural or legal person established within the European Union, formally appointed by a non-EU manufacturer through a written mandate to act on their behalf for specific regulatory tasks. The AR serves as the essential link between the manufacturer and EU regulatory authorities.
The Cyber Resilience Act (CRA), the Radio Equipment Directive (RED), and the EU AI Act each allow a manufacturer or provider to appoint an Authorized Representative by written mandate. The AI Act makes this appointment mandatory for non-EU providers of high-risk AI systems and, with an exemption for certain open-source models, of general-purpose AI models. Separately, Article 4 of the EU’s Market Surveillance Regulation (EU) 2019/1020 requires a responsible economic operator established in the EU for products covered by the legislation listed in its Article 4(5). That list includes the RED, the EMC Directive 2014/30/EU, the Low Voltage Directive 2014/35/EU and the RoHS Directive 2011/65/EU, but not the CRA. For manufacturers without their own EU entity, appointing an Authorized Representative is the most direct way to meet this requirement.
Why do non-EU manufacturers need an Authorized Representative?
Some EU regulations require that products placed on the European market have a responsible economic operator within the EU that authorities can reach. Article 4 of the Market Surveillance Regulation (EU) 2019/1020 sets this obligation for products covered by the legislation listed in its Article 4(5): such a product may be placed on the market only if an economic operator established in the EU is responsible for it. Many electrical and electronic products fall under the RED, the EMC Directive, the Low Voltage Directive or the RoHS Directive, subject to each directive’s scope, and therefore need such an operator. The General Product Safety Regulation applies the same rule to the consumer products it covers. If you manufacture these products outside the EU, that operator can be your importer, an Authorized Representative or, where no other such operator is established in the EU, a fulfillment service provider. The CRA does not create this obligation: under its Article 18, appointing an Authorized Representative is optional.
Where this obligation applies, products without an EU-based economic operator can be blocked at customs, removed from online marketplaces, or subject to enforcement actions with no local point of contact to coordinate a response. For these products, a reliable EU presence is a condition for market access.
The role of the Authorized Representative under the CRA
Article 18 of the Cyber Resilience Act (Regulation (EU) 2024/2847) allows manufacturers to appoint an Authorized Representative by written mandate. The mandate must allow the AR to perform at least the following:
- Document retention: Keep the EU declaration of conformity and technical documentation available for market surveillance authorities for at least 10 years after the product has been placed on the market, or for the duration of the support period, whichever is longer.
- Information provision: Upon a reasoned request from a market surveillance authority, supply all information and documentation necessary to demonstrate the conformity of the product.
- Cooperation with authorities: Work with market surveillance authorities on any action taken to address risks posed by a product covered by the mandate.
The AR does not take on the manufacturer’s core product development and security obligations (those in Article 13(1) to (11), Article 13(12) first subparagraph, and Article 13(14) are explicitly excluded from the mandate). The manufacturer remains responsible for design, development, vulnerability handling, and security updates.
Regulations where an EU Authorized Representative plays a role
Several EU regulations either require or enable the appointment of an Authorized Representative for non-EU manufacturers:
- Cyber Resilience Act (CRA) – Regulation (EU) 2024/2847. Article 18 allows manufacturers to appoint an AR by written mandate for products with digital elements. The CRA uses “may,” so the appointment is optional. Article 66 of the CRA adds the CRA to Annex I of the Market Surveillance Regulation (EU) 2019/1020, which brings CRA products under its market surveillance rules. It does not add the CRA to the Article 4(5) list that triggers that regulation’s requirement for an EU-established economic operator.
- Radio Equipment Directive (RED) – Directive 2014/53/EU. Article 11 similarly allows manufacturers to appoint an AR by written mandate. For non-EU manufacturers of radio and wireless equipment, the AR holds the declaration of conformity and technical documentation, and cooperates with national market surveillance authorities.
- EU AI Act – Regulation (EU) 2024/1689. Unlike the CRA and RED, the AI Act is explicit: Article 22 requires non-EU providers of high-risk AI systems to appoint an AR before making their systems available on the EU market. Article 54 sets a similar obligation for non-EU providers of general-purpose AI models, with an exemption for certain free and open-source models that do not present systemic risks.
- General Product Safety Regulation (GPSR) – Regulation (EU) 2023/988. Article 16 requires that a consumer product covered by the GPSR is placed on the market only if a “responsible person,” an economic operator established in the EU, is responsible for it. That role can be filled by a manufacturer established in the EU, an importer, an Authorized Representative or, where no other such operator is established in the EU, a fulfillment service provider. Article 2(1) generally excludes products subject to specific requirements under EU harmonization legislation from Article 16. From December 11, 2027, CRA Article 11 makes an exception for products with digital elements: Article 16 applies to the aspects and risks the CRA does not cover, where the product is not subject to specific safety requirements in other EU harmonization legislation. Whether a given product falls within the GPSR’s scope still needs to be assessed. In effect since December 13, 2024.
Key CRA compliance dates to keep in mind
- 11 June 2026: Conformity assessment body notification requirements take effect.
- 11 September 2026: Vulnerability and incident reporting obligations become mandatory. Manufacturers must notify actively exploited vulnerabilities to the designated CSIRT via ENISA‘s Single Reporting Platform.
- 11 December 2027: Full application of all CRA requirements. Products with digital elements must meet all essential cybersecurity requirements and carry CE marking to be placed on the EU market.
What Meroi Security provides as your EU Authorized Representative
We are established in the Netherlands and registered with the Dutch Chamber of Commerce (KVK). As your designated AR, we provide a defined set of services based on a formal written mandate:
- Regulatory point of contact: We serve as your EU-based contact for market surveillance authorities in the Netherlands and across the EU.
- Documentation management: We store and maintain your EU declaration of conformity, technical documentation, and CE marking records, keeping them available to authorities as required.
- Authority correspondence: We receive and respond to requests from market surveillance authorities on your behalf, coordinating with your team to provide accurate and timely information.
- Cooperation on corrective actions: If authorities identify a risk with your product, we coordinate the response process between your organization and the relevant EU bodies.
- Compliance monitoring: We track regulatory changes that may affect your products and inform you of updates to applicable standards or enforcement practices.
Our role is focused on the specific obligations of an Authorized Representative as defined by the applicable regulations. We do not perform product development, testing, or security engineering on your behalf, though we can connect you with our CRA compliance consulting services for broader support.
Our location and EU presence
Meroi Security is registered in the Netherlands with the Dutch Chamber of Commerce, providing a stable EU legal base for your Authorized Representative needs. Our Dutch registration gives us direct access to the local market surveillance infrastructure and positions us within the EU’s regulatory framework.
We also maintain an operational presence in Taiwan, which means we understand the practical reality of manufacturing and product development in Asia. This helps us bridge the communication gap that sometimes exists between non-EU manufacturers and European regulatory authorities.
Registered address:
Meroi Security
Pastor van Arslaan 6A
5622CK Eindhoven
Netherlands
KVK-nummer: 77783077
BTW-id: NL003236261B11
Scope and limitations
To be upfront about what this service covers: acting as an Authorized Representative means we take on specific, well-defined regulatory obligations on your behalf. It does not transfer your manufacturer responsibilities to us. You remain accountable for product security, vulnerability management, update delivery, and all other obligations that the CRA and related legislation place on manufacturers.
We are also not a notified body or conformity assessment body. If your product requires third-party conformity assessment (for example, CRA Class II Important products or Critical products), that assessment must be conducted by a notified body or, where a European cybersecurity certification scheme is used, by a conformity assessment body under that scheme. We can help coordinate that process, but we do not perform the assessments ourselves.
Contact us to discuss your EU representation needs
If you are a manufacturer based outside the EU and need to appoint an Authorized Representative, get in touch. We will review your product portfolio, discuss which regulations apply, and explain what a mandate arrangement would look like in practice.
Contact us at [email protected]