Assigned Representatives provide the human operating layer between a manufacturer and the SRP. A resilient reporting setup should avoid dependence on one person, use Secondary AR coverage where appropriate and maintain the underlying Article 14 evidence outside private SRP drafts.
Assigned Representative Is an SRP User Role
ENISA uses the term Assigned Representative, or AR, for an individual who operates the Single Reporting Platform on behalf of a manufacturer. This should not be confused with the authorised representative defined elsewhere in the CRA. An authorised representative is an economic-operator concept and can also affect Article 14 routing for manufacturers without an EU main establishment. An Assigned Representative is the person who uses the SRP interface. Internal procedures should use the exact terms because confusing them can create errors in both platform access and legal routing analysis.
- Assigned Representative is an SRP platform role.
- Authorised representative is a different CRA legal concept.
- Do not use AR terminology ambiguously in procedures.
- Document who has authority to submit on behalf of the manufacturer.
The Primary AR Has Administrative Responsibilities
ENISA currently permits one Primary Assigned Representative for each manufacturer association. The Primary AR is the main administrative representative in the SRP. In addition to submitting and updating notifications, the Primary AR can manage the manufacturer association and invite or remove Secondary ARs. The Primary AR therefore combines operational reporting ability with access-management responsibilities. Manufacturers should assign this role to a person who can maintain the association accurately and understand the organisation's Article 14 reporting governance.
- One Primary AR is currently supported per manufacturer.
- The Primary AR can submit and update notifications.
- The Primary AR manages the manufacturer association.
- The Primary AR can invite or remove Secondary ARs.
Secondary ARs Provide Reporting Resilience
ENISA currently allows up to 20 Secondary Assigned Representatives for a manufacturer. Secondary ARs do not receive every administrative permission of the Primary AR, but they can submit and update notifications subject to their platform permissions. This makes the Secondary AR role useful for reporting continuity across security, legal, compliance or regional teams. A manufacturer facing a 24-hour deadline should not discover that the only person able to operate its reporting workflow is unavailable.
- Up to 20 Secondary ARs are currently supported.
- Secondary ARs can submit notifications.
- Secondary ARs can update notifications.
- Use appropriate coverage for holidays, time zones and incident-response handovers.
Associated ARs Can Continue Existing Notifications
Primary and Secondary ARs associated with the same manufacturer can access, view and update notifications associated with that manufacturer according to their permissions. ENISA's current model allows another associated AR to continue the reporting process even where a different AR originally submitted the notification. This is useful because Article 14 reporting can extend from the early warning through the 72-hour notification and into a final report days or weeks later.
- Do not tie an Article 14 case permanently to its original submitter.
- Use manufacturer-level reporting ownership.
- Allow authorised team members to continue later reporting stages.
- Keep internal handover notes current.
Draft Notifications Are the Important Exception
Draft notifications do not have the same continuity characteristics as submitted notifications. ENISA states that drafts are stored locally in the individual AR's account and are not visible to other ARs associated with the manufacturer. A draft should therefore never become the manufacturer's only record of the facts needed for a regulatory deadline. The evidence package, approved wording, awareness time and current reporting status should also exist in the manufacturer's controlled internal system.
- Drafts are associated with the individual AR.
- Other manufacturer ARs cannot rely on seeing another AR's draft.
- Maintain the reporting evidence outside the SRP draft.
- Design handover procedures around internal records.
Verification and Reporting Can Run in Parallel
ENISA currently states that validation of the AR-manufacturer association by the relevant CSIRT takes place after registration and is not a prerequisite for submitting a notification. While validation is pending, an AR can currently submit up to 20 notifications for that manufacturer before verification becomes mandatory. This platform rule can matter during an urgent first registration because it prevents the verification process itself from blocking an Article 14 submission.
- CSIRT verification follows registration.
- Pending verification does not automatically block reporting.
- Current ENISA guidance permits up to 20 submissions before verification becomes mandatory.
- Check current ENISA guidance when registering because platform rules can change.
Primary AR Changes Need Controlled Governance
ENISA also provides a path for a Secondary AR to claim the Primary AR role, subject to review and approval by the designated CSIRT. This can support organisational changes when the existing Primary AR leaves the company or changes role. Manufacturers should nevertheless manage this as a controlled access event. Reporting permissions, manufacturer association information and current regulatory cases should be reviewed whenever responsibility moves between representatives.
- Plan for Primary AR succession.
- Review access when personnel change.
- Keep current notification ownership documented.
- Remove unnecessary associations when appropriate.
Build an AR Coverage Model Around the Reporting Workflow
A practical AR model starts with the manufacturer's Article 14 operating structure. The organisation should identify the Primary AR, appropriate Secondary ARs, after-hours coverage, who makes legal trigger decisions and who supplies technical evidence. EU Login and MFA access should be maintained for the people expected to report. Internal case records should remain independent of an individual's platform draft so another representative can continue the process during the 24-hour, 72-hour or final-report stages.
- Name the Primary AR.
- Identify appropriate Secondary AR coverage.
- Maintain EU Login and MFA readiness.
- Maintain an internal Article 14 evidence record.
- Document handover responsibilities between reporting stages.
Official sources
Read the full legal text and Commission material for precise wording, qualifications and updates.