I am not established in the EU. Who reports, and to which CSIRT?

Who has the obligation

Being a US, UK or anywhere-else company with no EU office doesn’t get you out of this; it only changes which country’s team you email. Article 14(1) and Article 14(3) of Regulation (EU) 2024/2847 place the notification duty on “a manufacturer,” with no carve-out for manufacturers that lack an EU establishment. The regulation’s own language for this scenario is “where a manufacturer has no main establishment in the Union,” not “not established in the EU,” but it describes the same practical situation. Having no EU establishment changes only the CSIRT-routing mechanism set out in Article 14(7), not who is legally required to file.

Importers and distributors carry their own, separate duties under Article 19 and Article 20 of the same Regulation, such as informing the manufacturer when they learn of a vulnerability, or informing market surveillance authorities of a significant cybersecurity risk. Nothing in the text of Articles 14, 19, or 20 transfers the manufacturer’s Article 14 notification duty onto an authorised representative, importer, or distributor. Those parties function only as location markers used to pick a CDaC, not as substitute reporters.

The ordered fallback test

Article 14(7), third subparagraph, of the Regulation sets out the order that applies once a manufacturer has no main establishment in the Union. Quoted from the official EUR-Lex Official Journal text:

1. the Member State in which the authorised representative acting on behalf of the manufacturer for the highest number of products with digital elements of that manufacturer is established;
2. the Member State in which the importer placing on the market the highest number of products with digital elements of that manufacturer is established;
3. the Member State in which the distributor making available on the market the highest number of products with digital elements of that manufacturer is established;
4. the Member State in which the highest number of users of products with digital elements of that manufacturer are located.

This is the same ordered list as steps 3 through 6 of the six-step order given in the ENISA SRP FAQ. The FAQ’s steps 1 and 2, main establishment, then the establishment with the highest number of employees, sit in the first two subparagraphs of Article 14(7) and apply only when a manufacturer does have some establishment in the Union to test; they drop out once it is established that there is none, which is why the fallback test for a manufacturer with no EU establishment at all starts at the authorised-representative step.

Article 14(7) also lets a manufacturer that lands on the users-count step keep reporting any later vulnerability or incident to the same CDaC it first reported to, instead of recalculating the test each time.

Unsettled: the Regulation says “has no main establishment in the Union,” not “not established in the EU.” If you have minor EU presence but no clear main office, the text doesn’t say which test to use first; that’s your own factual call.

How this was confirmed

This page relies on the official EUR-Lex Official Journal text of Regulation (EU) 2024/2847, Article 14 in full, plus Articles 13, 18, 19, and 20 for context on manufacturer, authorised representative, importer, and distributor obligations. The ordered fallback test is in Article 14(7), third subparagraph, points (a) to (d), exactly as quoted above; the paragraph breaks are: first subparagraph on where notifications are submitted, second subparagraph defining “main establishment,” and third subparagraph, the one starting “Where a manufacturer has no main establishment in the Union…,” setting out points (a) to (d). The ENISA SRP FAQ’s six-step CDaC selection order matches this fallback test in substance and in order for the no-main-establishment branch, but paraphrases the statutory wording rather than quoting it verbatim. For example, the FAQ describes step (a) as “the Member State where your authorised representative acts on your behalf for the highest number of products,” while the Regulation’s own text reads “the Member State in which the authorised representative acting on behalf of the manufacturer for the highest number of products with digital elements of that manufacturer is established.” The order and the substance line up; the phrasing does not.