Assigned Representative or Authorised Representative?

The two “AR”s come from different documents

Neither role is the person who runs your scans; both only matter once you’re already filing. “Authorised representative” is a term Regulation (EU) 2024/2847 (the CRA) defines itself. Article 3(15), in the consolidated EUR-Lex text, reads: “‘authorised representative’ means a natural or legal person established within the Union who has received a written mandate from a manufacturer to act on its behalf in relation to specified tasks.”

“Assigned Representative,” also abbreviated AR, does not appear anywhere in Article 3’s definitions, and a search of the Regulation’s text turns up no use of that phrase at all. It is ENISA’s own label for a Single Reporting Platform (SRP) account. The ENISA CRA SRP AR User Manual (Version 1.1, September 2026), Section 1.3 “Target Audience,” says: “For the purposes of the SRP, an AR is the individual who submits notifications on behalf of a manufacturer or, once applicable, an open-source software steward.” The manual’s own definitions table puts it even more plainly: “Assigned Representative: User acting on behalf of a manufacturer or open-source software steward in the SRP.” Both quotes scope the term explicitly “for the purposes of the SRP,” language ENISA uses because the CRA does not supply this term itself, not because the CRA affirmatively declines to define it.

What the CRA’s authorised representative actually does

Article 18 of the CRA sets out the authorised representative’s role. A manufacturer “may, by a written mandate, appoint an authorised representative” (Article 18(1)). Article 18(3) lists the mandate’s required floor, not its ceiling: “An authorised representative shall perform the tasks specified in the mandate received from the manufacturer… The mandate shall allow the authorised representative to do at least the following: (a) keep the EU declaration of conformity and the technical documentation at the disposal of the market surveillance authorities; (b) further to a reasoned request from a market surveillance authority, provide that authority with all the information and documentation necessary to demonstrate the conformity of the product; (c) cooperate with the market surveillance authorities, at their request, on any action taken to eliminate the risks posed by a product.” Article 18(2) separately carves out certain core manufacturer duties that can never be delegated into that mandate, but that carve-out does not touch Article 14 notifications either way.

Article 14 itself is phrased as the manufacturer’s own duty, not the authorised representative’s: “A manufacturer shall notify any actively exploited vulnerability…” and “A manufacturer shall notify any severe incident…,” with no mention of the authorised representative anywhere in the article. Nothing in Article 18(3)’s minimum task list mentions submitting notifications either. Because Article 18(3) sets a floor rather than an exhaustive list, the text does not affirmatively rule out a mandate that also covers notification duties, but no primary source describes such a mandate in practice, and doing so would not by itself let that person submit through the SRP: that requires the separate ENISA registration described below, regardless of what an Article 18 mandate says.

What the SRP’s Assigned Representative actually does

The manual distinguishes a Primary AR, “the Main Assigned Representative for the manufacturer in the SRP, who can manage the manufacturer association, invite or remove Secondary ARs, submit, review and update notifications, and perform other administrative functions available to that role,” from a Secondary (Backup) AR, who “can submit, view and update notifications for the manufacturer and claim the Primary AR role, subject to review and approval by the designated CSIRT, but does not have the same administrative permissions as the Primary AR.” It is this AR, not the Article 18 authorised representative, who registers on the SRP and submits the Early Warning, 72-hour Notification, and Final Report for a manufacturer.

Article 16, titled “Establishment of a single reporting platform,” confirms it is not itself a manufacturer notification duty: its first paragraph says that “for the purposes of the notifications referred to in Article 14(1) and (3) and Article 15(1) and (2)… a single reporting platform shall be established by ENISA.” Article 16 sets up the platform through which Article 14 (mandatory) and Article 15 (voluntary) notifications get made and disseminated; it does not create a third, parallel manufacturer obligation alongside Articles 14 and 24(3). The manual’s own acronym table confirms this by tracing every SRP notification type back to Article 14: Early Warning is “as per Art. 14.2(a) and 14.4(a),” the 72-hour Notification is “as per Art. 14.2(b) and 14.4(b),” and the Final Report is “as per Art. 14.2(c) and 14.4(c) of the CRA.”

So which one files, and can one person be both

The Assigned Representative is the one who files a notification on the SRP. The authorised representative’s Article 18 mandate, as written, does not extend to submitting Article 14 notifications, whether under its statutory minimum tasks or under anything Article 14 itself assigns.

Whether the same natural person can, or typically does, hold both roles is not addressed by anything in the primary sources checked here. The CRA does not require a manufacturer’s Article 18 authorised representative to also be its SRP Assigned Representative, and nothing in the ENISA SRP guidance requires or forbids the reverse. In practice a manufacturer is free to register any individual as its SRP AR, whether or not that person also holds an Article 18 mandate, but no primary source states a rule either way.

Unsettled: No source says whether the same person commonly holds both roles. Nothing stops it and nothing requires it.