EC REP cost guide 2026: what you pay, what you get, what to avoid

There is no published EU price list for Authorised Representative services. No independently checked provider-price sample is supplied here. Request current itemised quotations and compare scope, exclusions, response arrangements and retention commitments.

Before the prices, the role itself. We covered the basics of the AR's mandate in the EU Authorised Representative (EC REP) guide, the document the AR holds in the Declaration of Conformity 101, and the file the AR keeps available in the technical file 101. This article assumes you already know you need an AR — and now want to know what you should pay.

What the EC REP is legally paid to do

The starting point for any pricing conversation is the statutory definition. Under the Radio Equipment Directive, an authorised representative is "any natural or legal person established within the Union who has received a written mandate from a manufacturer to act on his behalf in relation to specified tasks" (Directive 2014/53/EU Article 2). Regulation (EU) 2019/1020, the horizontal market-surveillance regulation, uses essentially the same definition in Article 3(12).

Two consequences follow from that definition. First, the AR must be EU-established — a holding-company letterhead in Dublin is not enough if the operations sit outside the Union. Second, the mandate is written. Regulation 2019/1020 Article 4(2)(c) makes that explicit by requiring "an authorised representative who has a written mandate from the manufacturer designating the authorised representative to perform the tasks set out in paragraph 3 on the manufacturer's behalf". Verbal arrangements, side letters, or generic distribution agreements do not satisfy this requirement.

The legal scope of work — and therefore the legitimate cost basis — is whatever the relevant regulation puts in the AR's mandate. The three regulations covered in this guide each define that scope differently.

RED: retention, responses and cooperation

For radio equipment, check every minimum task in Article 11(2), including reasoned information requests and cooperation on eliminating risks. RED Article 11(2)(a) requires the AR to "keep the EU declaration of conformity and the technical documentation at the disposal of national market surveillance authorities for 10 years after the radio equipment has been placed on the market". That is the headline obligation: hold the DoC and technical file, hand them over on request.

Crucially, RED Article 11(1) draws a line that providers sometimes blur: "The obligations laid down in Article 10(1) and the obligation to draw up technical documentation laid down in Article 10(3) shall not form part of the authorised representative's mandate." Translation: drafting the technical file is the manufacturer's job. An AR may charge for storing it; it may not charge for writing it under the AR mandate.

What that means for pricing: a RED-only AR quote should reflect (a) a fixed annual retention fee, (b) the agreed contact and response arrangements, (c) the cost of handling occasional market-surveillance enquiries, and (d) a small premium for the 10-year tail risk after you stop selling the product. If you see a RED-only quote that includes "technical file preparation" as part of the AR fee, ask the provider to separate it out — it is a different service.

For background on what the AR is actually storing, the technical file 101 covers the document structure and technical file retention requirements covers the post-placement period.

MDR: verification, retention and liability

Medical-device AR pricing is in a different bracket because the liability profile is different. Under the Medical Device Regulation, where the manufacturer is established outside the EU, designation of a sole authorised representative is a condition of market access — see Regulation (EU) 2017/745 Article 11(1). The designation constitutes the mandate, and per MDR Article 11(2) it must be accepted in writing and cover at least the same generic device group.

The AR's tasks include verification, not just retention. MDR Article 11(3)(a) requires the AR to verify that the EU DoC and technical documentation have been drawn up and, where applicable, that an appropriate conformity assessment procedure has been carried out. Article 11(3)(h) requires the AR to terminate the mandate if the manufacturer acts contrary to its obligations — meaning the AR is not a passive mailbox but an active compliance check.

The pricing driver, though, is liability. MDR Article 11(5) provides that where the manufacturer is not established in a Member State and has not complied with its obligations, the AR is jointly and severally liable with the manufacturer for defective devices. That is a real, insurable risk — and it is why reputable MDR ARs carry product-liability cover and price it into the annual fee. A "low-cost" MDR AR quote without disclosed insurance limits is not a competitive offer; it is a different product.

Retention under MDR also runs long: Article 10(8) requires the documentation to be kept available to competent authorities for at least 10 years after the last device has been placed on the market, and at least 15 years for implantable devices. An AR fee that does not cover the full retention tail is not a complete service.

CRA: the new and least settled tier

The Cyber Resilience Act (Regulation (EU) 2024/2847) permits appointment of an authorised representative for products with digital elements. The headline mechanic mirrors RED and MDR. CRA Article 18(1) states simply: "A manufacturer may, by a written mandate, appoint an authorised representative."

The minimum CRA task list is set out in Article 18(3). Article 18(3)(a) requires the AR to "keep the EU declaration of conformity referred to in Article 28 and the technical documentation referred to in Article 31 at the disposal of the market surveillance authorities for at least 10 years after the product with digital elements has been placed on the market or for the support period, whichever is longer". The "or the support period, whichever is longer" clause matters: for a product with a 15-year declared support window, the AR is holding the documentation for 15 years, not 10.

Article 18(3)(c) requires the AR to "cooperate with the market surveillance authorities, at their request, on any action taken to eliminate the risks posed by a product with digital elements covered by the authorised representative's mandate". Cooperation is not a paper exercise — it implies bandwidth, language coverage, and an SLA for responding to authority requests.

A practical pricing note: the original article number cited in some provider material is "CRA Article 13". That article is the manufacturer-obligations article; AR obligations live in Article 18. If a provider quotes you against the wrong article, treat it as a sign their compliance reading is dated. For the broader CRA timeline see the CRA timeline and reporting obligations; for the application dates, CRA Article 71(2) confirms application from 11 December 2027, with Article 14 reporting from 11 September 2026 and Chapter IV (notification of conformity assessment bodies) from 11 June 2026.

What drives the CRA AR premium: the penalty tail

The single biggest factor that should change a CRA AR quote between now and 2027 is the penalty regime. CRA Article 64(2) provides for "administrative fines of up to EUR 15 000 000 or, if the offender is an undertaking, up to 2,5 % of the its total worldwide annual turnover for the preceding financial year, whichever is higher" for breach of the essential cybersecurity requirements (Annex I) and the obligations in Articles 13 and 14. Those are manufacturer obligations — but the AR's mandate exposes them to the same regulatory machinery.

Article 64(3) covers the AR obligations directly: non-compliance with Articles 18 to 23 (among others) "shall be subject to administrative fines of up to EUR 10 000 000 or, if the offender is an undertaking, up to 2 % of its total worldwide annual turnover for the preceding financial year, whichever is higher". And Article 64(4) targets the supply of incorrect or misleading information at up to EUR 5,000,000 or 1% of turnover.

A CRA AR who reads these articles carefully will price liability cover and process discipline into the fee. A CRA AR who has not yet read them will quote you a number that looks attractive today and a process that fails an Article 14 deadline two years from now. The fee gap is the cost of reading the regulation.

For more on the technical scope the AR will be standing behind, see the CRA Annex I explainer, the 24-hour reporting clock, and the operational September 2026 reporting checklist.

Common mistakes when buying EC REP services

Three patterns recur in quotes our customers send us to review.

First, a service label or low fee does not establish compliance capability. Ask the provider to show how it will fulfil the actual mandate tasks, respond to authorities and retain accessible records. Do not infer a service’s adequacy from an unverified price threshold.

Second, the consulting bundle. A quote that includes "DoC drafting" or "technical file preparation" in the AR fee blurs a line that RED Article 11(1) explicitly draws. The manufacturer drafts the file; the AR holds it. Bundle services where you want, but get them itemised, because the regulatory accountability for the contents stays with you regardless of who you paid to write them.

Third, the missing exit clause. Under MDR Article 11(3)(h) the AR is required to terminate the mandate if you act contrary to your obligations. A reasonable contract will mirror that and define what happens to the technical file on termination. A contract without exit terms locks you into a single AR or forces you to abandon your retention chain when switching — a compliance gap you do not want.

For more on the kinds of mistakes that compound into formal notices, see top 10 CE marking mistakes.

Using Cenitia for this work

Cenitia helps prepare evidence-linked working drafts within its supported regulatory catalogue. Confirm the product scope, actual applied standards and completed assessments, and review the result before issuance. Source-change alerts prompt a review; they do not certify conformity, automatically reissue a signed declaration or guarantee monitoring of every national rule and standard edition.

Related from the Library

• EU Authorised Representative (EC REP) guide
• Declaration of Conformity 101
• Technical file 101
• Technical file retention requirements
• CRA timeline and reporting obligations

Further reading

• Directive 2014/53/EU (RED) — Article 2 and Article 11
• Regulation (EU) 2017/745 (MDR) — Article 10 and Article 11
• Regulation (EU) 2019/1020 — Article 3 and Article 4
• Regulation (EU) 2024/2847 (CRA) — Article 18, Article 64, Article 71
• EUR-Lex summary: horizontal cybersecurity requirements for products with digital elements