EC REP vs Importer: Responsibilities Under CRA, RED, and MDR

If you build hardware outside the EU and want to sell it inside the EU, two acronyms decide most of your compliance paperwork: EC REP (the EU Authorised Representative) and Importer. They are not synonyms. They are not interchangeable. And under the Cyber Resilience Act, the Radio Equipment Directive and the Medical Device Regulation, mixing them up is one of the cleanest ways to end up with a non-compliant placement and a market surveillance file.

This article maps both roles side by side across the three regulations most non-EU hardware manufacturers will hit in 2026 and 2027. For background on the broader EC REP role, see our EU Authorised Representative (EC REP) guide. For the CRA timeline, see CRA timeline and reporting obligations.

The legal definitions, side by side

EU product law splits responsibility along the supply chain. The manufacturer designs and stands behind the product. The importer is the business that places it on the EU market in its own name. The authorised representative is a stand-in for a non-EU manufacturer that lets EU authorities reach the manufacturer through an EU postal address.

Under the CRA, an authorised representative is governed by Article 18 of Regulation (EU) 2024/2847, which begins: "A manufacturer may, by a written mandate, appoint an authorised representative." CRA importers are governed by Article 19.

Under the RED, Article 11(1) of Directive 2014/53/EU uses the same construction: "A manufacturer may, by a written mandate, appoint an authorised representative." RED importer obligations are in Article 12.

Under the MDR, Article 11 of Regulation (EU) 2017/745 governs the authorised representative, and Article 13 governs the importer.

The pattern is consistent: the EC REP exists because of a written mandate; the importer exists because of a commercial act (placing on the market). Same product, two different roles, often two different companies.

What the EC REP must do — and what they cannot do

Under CRA Article 18(3)(a) the authorised representative must "keep the EU declaration of conformity referred to in Article 28 and the technical documentation referred to in Article 31 at the disposal of the market surveillance authorities for at least 10 years after the product with digital elements has been placed on the market or for the support period, whichever is longer." That retention rule mirrors the manufacturer's obligation and ties the EC REP directly to the Declaration of Conformity 101 workflow and the Technical File 101 you produce.

Under RED Article 11(2)(a), the EC REP must "keep the EU declaration of conformity and the technical documentation at the disposal of national market surveillance authorities for 10 years after the radio equipment has been placed on the market." No support-period extension — RED uses a flat 10-year clock.

Under MDR Article 11(5), the liability bar is sharply higher: "Where the manufacturer is not established in a Member State and has not complied with the obligations laid down in Article 10, the authorised representative shall be legally liable for defective devices on the same basis as, and jointly and severally with, the manufacturer." This joint and several liability is unique to MDR among the three regulations compared here.

What the EC REP cannot do is also fixed by law. RED Article 11(1) is explicit: "The obligations laid down in Article 10(1) and the obligation to draw up technical documentation laid down in Article 10(3) shall not form part of the authorised representative's mandate." CRA Article 18(2) carries the same logic: the design and development obligations of Article 13 cannot be delegated.

In short: the EC REP cannot design the product, cannot manufacture it, and cannot author the technical file. The EC REP can only act on a finished, manufacturer-signed compliance package.

What the Importer must do

The importer's role is verification and traceability. Under RED Article 12(1): "Importers shall place only compliant radio equipment on the market." The corresponding MDR rule is in Article 13(1): importers shall place on the Union market only devices that are in conformity with the regulation, and Article 13(2) requires them to verify the CE marking, the EU declaration of conformity, manufacturer identification, authorised representative designation, labelling/instructions for use, and UDI assignment before placing the device on the market.

Identification on the product is the second pillar. Under CRA Article 19(4) importers must "indicate their name, registered trade name or registered trademark, the postal address, email address or other digital contact" on the product with digital elements or its packaging. MDR Article 13(3) uses parallel language and requires importers to indicate their name, registered place of business and contact details on the device or its packaging, without obscuring the manufacturer's labelling.

Document retention also applies. Under CRA Article 19(6) importers retain a copy of the EU declaration of conformity "for at least 10 years after the product with digital elements has been placed on the market or for the support period, whichever is longer." If you sell an IoT product with a 5-year support period, the retention clock is 10 years; if you commit to a 12-year support period, the retention clock becomes 12 years.

This is why importer record-keeping deserves the same archival rigour as manufacturer record-keeping — see Technical File retention requirements for the underlying workflow.

Regulation (EU) 2019/1020 — the horizontal "responsible economic operator" rule

Even before the CRA, the EU created a horizontal traceability rule for CE-marked products. Article 4(1) of Regulation (EU) 2019/1020 states: "A product subject to legislation referred to in paragraph 5 may be placed on the market only if there is an economic operator established in the Union who is responsible for the tasks set out in paragraph 3 in respect of that product."

Article 4(2) names four eligible roles for that responsible operator: an EU-established manufacturer; an importer (where the manufacturer is not established in the Union); an authorised representative with a written mandate from the manufacturer; or a fulfilment service provider established in the Union where no other operator is established. That means a non-EU manufacturer with no EU importer and no EC REP cannot place an in-scope product on the EU market simply by using a fulfilment service — somebody has to take Article 4 responsibility.

Article 4(3)(a) requires the responsible operator to verify the EU declaration of conformity and technical documentation exist, and to keep the declaration of conformity at the disposal of market surveillance authorities. Article 4(3)(c) requires them to "inform the market surveillance authorities thereof" when there is reason to believe the product presents a risk. Article 4(4) requires their name, registered trade name or trademark, and contact details (including the postal address) to appear on the product, its packaging, the parcel or an accompanying document.

Article 4(5) defines the scope. It includes the RED (2014/53/EU), the Machinery Directive (2006/42/EC), the EMC Directive (2014/30/EU), the Low Voltage Directive (2014/35/EU), the Toy Safety Directive (2009/48/EC) and the PPE Regulation (2016/425), among others. If you ship a radio module into the EU, Article 4 applies regardless of which entity acts as your responsible operator.

Can the same entity be both EC REP and Importer?

Yes — but with care. There is no rule prohibiting an EU subsidiary of a non-EU manufacturer from acting as both the importer (because it places the product on the market) and the authorised representative (because the manufacturer signed a written mandate). What matters is that the legal obligations of both roles are met cleanly.

Two pitfalls to flag:

• Distinct labelling. Under CRA Article 19(4) and MDR Article 13(3) the importer must be identified on the product or packaging. Article 4(4) of Regulation 2019/1020 also requires identification of the responsible economic operator. If a single entity wears both hats, it is usually identified once, but the legal basis on which it is identified — importer vs Article 4 responsible operator — should be documented in the technical file.
• Joint and several MDR liability. If the same entity is both EC REP and importer under MDR and the non-EU manufacturer fails to comply with Article 10, the joint and several liability in Article 11(5) attaches to that EU entity. Combining the roles concentrates risk.

For the deeper EC REP analysis see our EU Authorised Representative (EC REP) guide.

CRA timing: why this matters now

The CRA was published in the Official Journal on 20 November 2024 and entered into force on the twentieth day after publication. Article 71 of Regulation (EU) 2024/2847 confirms that "This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union."

Application is staged:

• 11 June 2026: Chapter IV (Articles 35 to 51 — conformity assessment and notified bodies) applies.
• 11 September 2026: Article 14 (vulnerability reporting obligations) applies.
• 11 December 2027: the rest of the Regulation, including Articles 18 (EC REP) and 19 (Importer), applies.

That means CRA importer and EC REP obligations bite on the same date — 11 December 2027 — but conformity assessment infrastructure is live 18 months earlier. If you intend to use a notified body for a CRA Annex III important or Annex IV critical product, the bodies become available well before the operator obligations apply. See CRA timeline and reporting obligations and CRA December 2027 readiness.

Penalties for getting it wrong

The CRA's penalty regime in Article 64 is three-tier:

• Tier 1: non-compliance with the essential cybersecurity requirements in Annex I and the obligations set out in Articles 13 and 14 — administrative fines of up to EUR 15 million or 2.5 % of total worldwide annual turnover, whichever is higher.
• Tier 2: non-compliance with the obligations in Articles 18 to 23 (which include both the EC REP and the importer), and certain other articles — fines of up to EUR 10 million or 2 % of total worldwide annual turnover, whichever is higher.
• Tier 3: supply of incorrect, incomplete or misleading information to notified bodies or market surveillance authorities — fines of up to EUR 5 million or 1 % of total worldwide annual turnover, whichever is higher.

Translation for an EC REP or importer: a procedural failure (e.g. failing to retain the EU declaration of conformity, or failing to identify yourself on the product) sits squarely in the tier-2 envelope.

Common mistakes

• Treating the EC REP as a postbox. The EC REP must keep the EU declaration of conformity and technical documentation available for at least 10 years or the CRA support period, whichever is longer. A mailbox-only service typically does not meet that requirement.
• Letting the EC REP "approve" the technical file. RED Article 11(1) and CRA Article 18(2) bar this delegation.
• Forgetting Article 4 of Regulation 2019/1020 outside the CRA. If you ship a non-CRA product (say, a Toy Safety Directive product) into the EU, you still need a responsible economic operator under Article 4.
• Not signing the written mandate. Both CRA Article 18(1) and RED Article 11(1) require a written mandate. An undocumented appointment is not an appointment.
• Wearing both hats without documenting which one applies to which obligation. See Top 10 CE marking mistakes.

How Cenitia helps

Cenitia's compliance vault treats the EC REP and the Importer as separate operator profiles inside one product file. When you assign an EC REP, Cenitia generates the written mandate template aligned to CRA Article 18(1) or RED Article 11(1), tracks the 10-year (or support-period) retention clock against the EU declaration of conformity, and surfaces the Article 4(4) identification rule on labelling reviews.

When the regulation changes — for example if Article 71 staging is amended, or if Article 19 importer text is updated — Cenitia's regulation watcher flags the affected DoCs so your team knows which products to re-review. This is the same workflow we apply to Annex I essential requirements and to the CRA September 2026 reporting checklist.

Frequently asked questions

Is the EU Authorised Representative the same as the EU Importer?

No. The EC REP is a person or company appointed by a non-EU manufacturer through a written mandate to act on their behalf for specific regulatory tasks. The importer is the natural or legal person established in the Union who actually places the product on the EU market. They are distinct economic operator roles under EU product law and can — but do not have to — be the same legal entity.

Which CRA article governs the EU Authorised Representative for products with digital elements?

Article 18 of Regulation (EU) 2024/2847 governs the authorised representative under the Cyber Resilience Act. Article 18(1) confirms that a manufacturer may appoint an authorised representative only by a written mandate. Importer obligations under the CRA are set out in Article 19, not Article 18.

What pre-market checks must an EU Importer perform under the Radio Equipment Directive?

Under RED Article 12(1) importers may place only compliant radio equipment on the market. Before placing the equipment on the EU market the importer must verify that the manufacturer carried out the appropriate conformity assessment procedure, drew up the technical documentation, affixed the CE marking, and accompanied the equipment with required information and instructions in a language easily understood by end users.

Can the EU Authorised Representative draw up the technical file on the manufacturer's behalf?

No. Under RED Article 11(1) and CRA Article 18(2) the design, manufacturing and the drawing up of the technical documentation cannot be delegated to the authorised representative. The EC REP can keep the documentation available to authorities, cooperate with market surveillance, and verify that the EU declaration of conformity exists — but they cannot create the technical file in place of the manufacturer.

Is the EC REP personally liable for defective devices under MDR?

Under Article 11(5) of Regulation (EU) 2017/745 (MDR), if the manufacturer is not established in a Member State and has not complied with the obligations laid down in Article 10, the authorised representative is legally liable for defective devices on the same basis as, and jointly and severally with, the manufacturer. This is the strongest liability provision among the three regulations compared in this article.

When does Article 4 of Regulation 2019/1020 require a "responsible economic operator" for my product?

Article 4(1) of Regulation (EU) 2019/1020 requires that a product within its scope may be placed on the EU market only if there is an economic operator established in the Union responsible for the tasks set out in Article 4(3). The covered scope listed in Article 4(5) includes the RED (2014/53/EU), the Machinery Directive (2006/42/EC), the EMC Directive (2014/30/EU), the Low Voltage Directive (2014/35/EU), the Toy Safety Directive (2009/48/EC) and the PPE Regulation (2016/425), among others. The responsible operator can be an EU-established manufacturer, an importer, a written-mandated authorised representative, or an EU fulfilment service provider.

Related from the Library

• EU Authorised Representative (EC REP) guide
• CRA timeline and reporting obligations
• Declaration of Conformity 101
• Technical File retention requirements

Further reading

• Regulation (EU) 2024/2847 — Cyber Resilience Act, Article 18 (EC REP)
• Regulation (EU) 2024/2847 — Cyber Resilience Act, Article 19 (Importers)
• Regulation (EU) 2024/2847 — Cyber Resilience Act, Article 64 (Penalties)
• Regulation (EU) 2024/2847 — Cyber Resilience Act, Article 71 (Entry into force)
• Directive 2014/53/EU — Radio Equipment Directive
• Regulation (EU) 2017/745 — Medical Device Regulation
• Regulation (EU) 2019/1020 — Market Surveillance Regulation

Last reviewed: 5 July 2026. Cited regulations watched continuously by Cenitia — when one amends, this article is flagged for update.