EC REP cost guide 2026: what you pay, what you get, what to avoid

There is no published EU price list for Authorised Representative services. Rates vary from a few hundred euros per year for a low-risk RED radio product to five-figure annual fees for a complex Class III medical device — and most of that variance is not provider markup. It is the statutory workload. This guide explains what an EC REP is paid to do under RED, MDR and the Cyber Resilience Act, what drives the premium, and how to verify a quote against the law before you sign.

Before the prices, the role itself. We covered the basics of the AR's mandate in the EU Authorised Representative (EC REP) guide, the document the AR holds in the Declaration of Conformity 101, and the file the AR keeps available in the technical file 101. This article assumes you already know you need an AR — and now want to know what you should pay.

What the EC REP is legally paid to do

The starting point for any pricing conversation is the statutory definition. Under the Radio Equipment Directive, an authorised representative is "any natural or legal person established within the Union who has received a written mandate from a manufacturer to act on his behalf in relation to specified tasks" (Directive 2014/53/EU Article 2(13)). Regulation (EU) 2019/1020, the horizontal market-surveillance regulation, uses essentially the same definition in Article 3(12).

Two consequences follow from that definition. First, the AR must be EU-established — a holding-company letterhead in Dublin is not enough if the operations sit outside the Union. Second, the mandate is written. Regulation 2019/1020 Article 4(2)(c) makes that explicit by requiring "an authorised representative who has a written mandate from the manufacturer designating the authorised representative to perform the tasks set out in paragraph 3 on the manufacturer's behalf". Verbal arrangements, side letters, or generic distribution agreements do not satisfy this requirement.

The legal scope of work — and therefore the legitimate cost basis — is whatever the relevant regulation puts in the AR's mandate. The three regulations covered in this guide each define that scope differently.

RED: mostly passive, retention-driven

For radio equipment, the AR's statutory tasks are short. RED Article 11(2)(a) requires the AR to "keep the EU declaration of conformity and the technical documentation at the disposal of national market surveillance authorities for 10 years after the radio equipment has been placed on the market". That is the headline obligation: hold the DoC and technical file, hand them over on request.

Crucially, RED Article 11(1) draws a line that providers sometimes blur: "The obligations laid down in Article 10(1) and the obligation to draw up technical documentation laid down in Article 10(3) shall not form part of the authorised representative's mandate." Translation: drafting the technical file is the manufacturer's job. An AR may charge for storing it; it may not charge for writing it under the AR mandate.

What that means for pricing: a RED-only AR quote should reflect (a) a fixed annual retention fee, (b) an address-of-record service, (c) the cost of handling occasional market-surveillance enquiries, and (d) a small premium for the 10-year tail risk after you stop selling the product. If you see a RED-only quote that includes "technical file preparation" as part of the AR fee, ask the provider to separate it out — it is a different service.

For background on what the AR is actually storing, the technical file 101 covers the document structure and technical file retention requirements covers the post-placement period.

MDR: liability-driven, the most expensive tier

Medical-device AR pricing is in a different bracket because the liability profile is different. Under the Medical Device Regulation, where the manufacturer is established outside the EU, designation of a sole authorised representative is a condition of market access — see Regulation (EU) 2017/745 Article 11(1). The designation constitutes the mandate, and per MDR Article 11(2) it must be accepted in writing and cover at least the same generic device group.

The AR's tasks include verification, not just retention. MDR Article 11(3)(a) requires the AR to verify that the EU DoC and technical documentation have been drawn up and, where applicable, that an appropriate conformity assessment procedure has been carried out. Article 11(3)(h) requires the AR to terminate the mandate if the manufacturer acts contrary to its obligations — meaning the AR is not a passive mailbox but an active compliance check.

The pricing driver, though, is liability. MDR Article 11(5) provides that where the manufacturer is not established in a Member State and has not complied with its obligations, the AR is jointly and severally liable with the manufacturer for defective devices. That is a real, insurable risk — and it is why reputable MDR ARs carry product-liability cover and price it into the annual fee. A "low-cost" MDR AR quote without disclosed insurance limits is not a competitive offer; it is a different product.

Retention under MDR also runs long: Article 10(8) requires the documentation to be kept available to competent authorities for at least 10 years after the last device has been placed on the market, and at least 15 years for implantable devices. An AR fee that does not cover the full retention tail is not a complete service.

CRA: the new and least settled tier

The Cyber Resilience Act (Regulation (EU) 2024/2847) introduces an EC REP obligation for products with digital elements. The headline mechanic mirrors RED and MDR. CRA Article 18(1) states simply: "A manufacturer may, by a written mandate, appoint an authorised representative."

The minimum task list in Article 18(3) is more demanding than RED's. Article 18(3)(a) requires the AR to "keep the EU declaration of conformity referred to in Article 28 and the technical documentation referred to in Article 31 at the disposal of the market surveillance authorities for at least 10 years after the product with digital elements has been placed on the market or for the support period, whichever is longer". The "or the support period, whichever is longer" clause matters: for a product with a 15-year declared support window, the AR is holding the documentation for 15 years, not 10.

Article 18(3)(c) requires the AR to "cooperate with the market surveillance authorities, at their request, on any action taken to eliminate the risks posed by a product with digital elements covered by the authorised representative's mandate". Cooperation is not a paper exercise — it implies bandwidth, language coverage, and an SLA for responding to authority requests.

A practical pricing note: the original article number cited in some provider material is "CRA Article 13". That article is the manufacturer-obligations article; AR obligations live in Article 18. If a provider quotes you against the wrong article, treat it as a sign their compliance reading is dated. For the broader CRA timeline see the CRA timeline and reporting obligations; for the application dates, CRA Article 71(2) confirms application from 11 December 2027, with Article 14 reporting from 11 September 2026 and Chapter IV (notification of conformity assessment bodies) from 11 June 2026.

What drives the CRA AR premium: the penalty tail

The single biggest factor that should change a CRA AR quote between now and 2027 is the penalty regime. CRA Article 64(2) provides for "administrative fines of up to EUR 15 000 000 or, if the offender is an undertaking, up to 2,5 % of the its total worldwide annual turnover for the preceding financial year, whichever is higher" for breach of the essential cybersecurity requirements (Annex I) and the obligations in Articles 13 and 14. Those are manufacturer obligations — but the AR's mandate exposes them to the same regulatory machinery.

Article 64(3) covers the AR obligations directly: non-compliance with Articles 18 to 23 (among others) "shall be subject to administrative fines of up to EUR 10 000 000 or, if the offender is an undertaking, up to 2 % of its total worldwide annual turnover for the preceding financial year, whichever is higher". And Article 64(4) targets the supply of incorrect or misleading information at up to EUR 5,000,000 or 1% of turnover.

A CRA AR who reads these articles carefully will price liability cover and process discipline into the fee. A CRA AR who has not yet read them will quote you a number that looks attractive today and a process that fails an Article 14 deadline two years from now. The fee gap is the cost of reading the regulation.

For more on the technical scope the AR will be standing behind, see the CRA Annex I explainer, the 24-hour reporting clock, and the operational September 2026 reporting checklist.

Common mistakes when buying EC REP services

Three patterns recur in quotes our customers send us to review.

First, the "address-of-record" bundle that mislabels itself. A €299/year quote that promises "RED, MDR, CRA, all directives covered" is rarely a real AR service for any of them. It is usually a mail-forwarding service with an AR appointment letter. The Article 18(3) cooperation obligation under the CRA, the Article 11(3) verification obligation under MDR, and the 10-year retention obligation under both regulations cannot be performed by a mailbox.

Second, the consulting bundle. A quote that includes "DoC drafting" or "technical file preparation" in the AR fee blurs a line that RED Article 11(1) explicitly draws. The manufacturer drafts the file; the AR holds it. Bundle services where you want, but get them itemised, because the regulatory accountability for the contents stays with you regardless of who you paid to write them.

Third, the missing exit clause. Under MDR Article 11(3)(h) the AR is required to terminate the mandate if you act contrary to your obligations. A reasonable contract will mirror that and define what happens to the technical file on termination. A contract without exit terms locks you into a single AR or forces you to abandon your retention chain when switching — a compliance gap you do not want.

For more on the kinds of mistakes that compound into formal notices, see top 10 CE marking mistakes.

How Cenitia helps

Cenitia is built around the same statutory mapping this article uses. When you generate a Declaration of Conformity in Cenitia, the platform records which regulations apply, which AR mandate clauses they trigger, and which retention windows the AR is committing to. When a regulation amends — for example, when an Article 14 reporting clarification is published in the Official Journal — every DoC and AR mandate Cenitia holds for affected products is flagged for review.

That means when you compare EC REP quotes, you can compare them against the same machine-checked mandate scope you used to generate the DoC. No more reading three regulations and hoping the provider read them too. The platform does the cross-reference, the provider quotes against it, and the cost of an AR is the cost of the work the regulation actually requires — no more, no less.

Frequently asked questions

What is a reasonable annual fee for an EU Authorised Representative in 2026?

There is no statutory price. Market rates vary widely because the AR's obligations vary by regulation. A RED-only AR for a low-risk radio product is a fundamentally different service from a Class III MDR AR with joint and several liability under MDR Article 11(5) or a CRA AR responsible for a 10-year-plus support period under Article 18(3)(a). Compare quotes against the tasks the AR is legally required to perform, not against headline annual numbers.

Does the EC REP need product-liability insurance?

The Cyber Resilience Act and RED do not explicitly require AR insurance, but under MDR Article 11(5) the AR can be held jointly and severally liable with a non-EU manufacturer for defective devices where the manufacturer has not complied. Most reputable MDR ARs therefore carry product-liability cover. For RED and CRA products, insurance is a commercial choice — but a provider with no cover at all is taking risk you may not want to share.

Why is the CRA EC REP article number different from what some providers cite?

The Cyber Resilience Act (Regulation (EU) 2024/2847) places the authorised representative obligations in Article 18, not Article 13. Article 13 is the manufacturer-obligations article. Some early provider marketing material conflates the two. Check the regulation text directly: Article 18(1) is the AR appointment provision, Article 18(3) lists the minimum tasks.

Can the EC REP draft my technical file as part of the fee?

Under RED Article 11(1), the obligation to draw up technical documentation is explicitly excluded from the AR's mandate — it cannot be delegated. A provider may offer technical-file drafting as a separate consulting service, but it is not an AR task and must not be bundled into the AR fee in a way that implies the AR is responsible for the file's contents.

How long must the EC REP keep my documents?

Retention requirements differ by regulation. RED Article 11(2)(a) requires 10 years after the radio equipment was placed on the market. CRA Article 18(3)(a) requires at least 10 years after placing on the market, or the support period — whichever is longer. MDR retention follows Article 10(8). The AR fee must cover the full retention period, not just the active sales period.

What CRA fines is the AR exposed to?

Under CRA Article 64(3), non-compliance with the AR obligations in Article 18 (alongside other provisions) is subject to administrative fines of up to EUR 10,000,000 or 2% of total worldwide annual turnover, whichever is higher. The highest tier (Article 64(2), up to EUR 15,000,000 or 2.5%) applies to breach of the essential cybersecurity requirements in Annex I and Articles 13 and 14 — those are manufacturer obligations, but they shape the AR's risk exposure under the mandate.

Related from the Library

• EU Authorised Representative (EC REP) guide
• Declaration of Conformity 101
• Technical file 101
• Technical file retention requirements
• CRA timeline and reporting obligations

Further reading

• Directive 2014/53/EU (RED) — Article 2 and Article 11
• Regulation (EU) 2017/745 (MDR) — Article 10 and Article 11
• Regulation (EU) 2019/1020 — Article 3 and Article 4
• Regulation (EU) 2024/2847 (CRA) — Article 18, Article 64, Article 71
• EUR-Lex summary: horizontal cybersecurity requirements for products with digital elements

Last reviewed: 5 July 2026. Cited regulations watched continuously by Cenitia — when one amends, this article is flagged for update.