Cyber Resilience Act representation for connected products

For reporting, yes. If a vulnerability in something you sold in 2024 is being actively exploited today, the 24-hour duty applies. Products placed on the market before 11 December 2027 are otherwise exempt from the substantive requirements unless substantially modified.

No. Article 18 makes it voluntary, unlike GPSR. What it changes is practical: without one, Article 14(7) decides your reporting route by cascade — your importer, then your distributor, then wherever most of your users are. With one, it is fixed and predictable.

We hold your Declaration of Conformity and technical documentation for authorities for ten years or the support period, answer reasoned requests from market surveillance authorities, cooperate on risk-elimination action, and produce the mandate on request. With Reporting Cover we also draft and submit your Article 14 notifications.

Article 18(2) puts product security, the cybersecurity risk assessment, the SBOM, the support period, security updates, drawing up the technical documentation and the legal responsibility for reporting outside any mandate. Those stay with you and no representative can take them on.

A weakness in your product that someone is actually using against it, with evidence of real-world exploitation — not simply a flaw that exists. A flaw nobody is exploiting is not reportable under Article 14. You still fix it, but no 24-hour clock starts.

Something that has happened which affects the security of the product itself — for example an attacker reaching your build system and signing a malicious update. An outage, a bug, or a breach of your office email that does not touch product security is not a severe incident.

From the moment anyone in your organisation had enough information to reasonably conclude the vulnerability is being exploited or the incident has occurred. Not when the investigation finishes, and not when you tell us.

A CSIRT designated as coordinator and ENISA, at the same time, through the single reporting platform. All three stages — early warning, notification, final report — go to both.

Yes. Article 14(8) is a separate duty: you must inform impacted users about the vulnerability or incident and any mitigation they can apply. If you don’t do it in time, the notified CSIRT may do it for you. We help draft the notice; issuing it stays with you.

Products where the security stakes are higher: routers, modems and switches; smart locks, security cameras, baby monitors and alarms; health-monitoring wearables; connected toys with camera, microphone or location tracking; operating systems, browsers, password managers, VPNs and antivirus. Class I needs a notified body unless harmonised standards are applied in full; Class II always does.

No. The CRA is EU law and there is no UK equivalent. Connected consumer products sold in Great Britain fall under the PSTI regime instead.

£590 a year for the Article 18 representation service, and £390 a year for Reporting Cover, which includes one notification cycle. £980 for both, excluding VAT. It runs on top of a Euverify plan.

Because it is a separate legal appointment with a separate mandate and a standing on-call obligation, not a document module. PPWR conformity is something the platform generates; CRA representation is something a person is accountable for at 2am.

No, and we’re careful about that line. We confirm your documents and processes exist and cover what the Regulation asks for. Detailed assessment — risk assessments prepared for you, penetration testing, code review, SBOM generation — is specialist work, and we introduce you to security partners who price it directly with you.

Penalties under the CRA reach €15 million or 2.5% of worldwide turnover for breaches of the essential requirements and the Article 13 and 14 obligations. Market surveillance authorities can also require corrective action, restrict availability or withdraw a product from the market.