EC REP for software products — CRA scope and representative mandates

CRA Article 18 permits appointment of an authorised representative; it does not make that appointment mandatory for every software product. Assess software/RDPS scope and the relevant responsible economic operator. A customer’s browser or any dependency on a cloud service does not alone establish CRA remote-data-processing scope.

Authorised representative

A manufacturer may appoint an authorised representative by written mandate. Article 18 restricts transfer of specified manufacturer obligations including design/manufacture and preparation of technical documentation. Annex VIII Part I point 5 permits specified marking/declaration tasks within the mandate. Do not confuse an authorised representative with the alternative responsible economic operators allowed under applicable market-surveillance law.

Scope and exclusions

CRA concerns products with digital elements made available on the EU market whose intended or foreseeable use includes a direct or indirect logical or physical data connection. MDR/IVDR devices and other Article 2 exclusions require separate scope assessment. Assess manufacturer responsibility and the statutory remote-data-processing definition, not cloud dependence alone. Main product requirements apply from 11 December 2027; Article 14 reporting applies from 11 September 2026.

Non-EU manufacturer representative

A manufacturer outside the Union must designate an EU authorised representative under Article 11 before placing relevant devices on the Union market. This is a specific MDR obligation; do not generalise it to every non-EU CE-marked product.

Evidence to keep with the product

Record the intended purpose, responsible economic operator, target market, first placing date and exact hardware/firmware configuration. For each applicable requirement, link the actual test or assessment record, dated standard/specification, scope and reviewer decision. Proposed controls and supplier marketing statements are not evidence that the final configuration has passed an assessment.

Separate an open question from a completed assessment. A report outside the laboratory's relevant scope, a different firmware build or an unverified exemption needs a reasoned decision before it supports a declaration. Keep original evidence and the issued declaration alongside any AI-assisted working draft.

Using Cenitia for this work

Cenitia assists with a limited regulatory catalogue and draft documents. The manufacturer must confirm applicability, actual applied specifications and completed assessment procedures. AI scores are quality signals, not a probability of conformity. Source monitoring raises a review prompt when validated source text changes; it does not automatically verify amendments, update the corpus or monitor every national rule and OJ standard edition. Public QR verification records issuance, not product certification.

Review status

This guide was substantively corrected by Cenitia on 2 October 2026 using the primary references below. It is an editorial summary, not an authoritative legal quotation or an independently signed expert opinion. Product-specific and licensed-standard questions remain subject to a real technical review.

Primary references

• Primary source 1
• Primary source 2