For non-EU manufacturers, the reporting obligation remains a manufacturer obligation. Article 14(7) mainly solves the question of which Member State's coordinating CSIRT receives the notification. The existence of an authorised representative, importer or distributor can determine routing without transferring the manufacturer's Article 14 reporting responsibility to that economic operator.
Article 14 Reporting Can Apply to Manufacturers Outside the EU
The CRA reporting regime is connected to products with digital elements made available on the Union market rather than being limited to companies headquartered in the EU. ENISA's current guidance expressly addresses corporate groups whose parent company is headquartered outside the Union and states that only one notification is required for a given actively exploited vulnerability or severe incident even where a manufacturer has multiple EU branches or subsidiaries. The manufacturer must coordinate internally and ensure that the required Article 14 notification is submitted through the Single Reporting Platform.
- Non-EU headquarters do not by themselves remove Article 14 reporting.
- Assess products made available on the Union market.
- Coordinate reporting across the corporate group.
- Avoid duplicate notifications for the same qualifying event.
First Determine Whether the Manufacturer Has an EU Main Establishment
A company headquartered outside the EU can still have a main establishment in the Union for Article 14 reporting purposes. The CRA asks where decisions related to the cybersecurity of the manufacturer's products with digital elements are predominantly taken. If those decisions are predominantly taken in an EU Member State, that Member State can establish the normal Article 14 routing even though the global parent company is located elsewhere. Only when the manufacturer has no main establishment in the Union does the special non-EU cascade in the third subparagraph of Article 14(7) apply.
- Do not equate non-EU headquarters with no EU main establishment.
- Apply the product-cybersecurity decision-making test first.
- Determine whether an EU main establishment exists.
- Use the non-EU fallback cascade only when there is no EU main establishment.
The First Non-EU Fallback Is the Authorised Representative
Where there is no main establishment in the Union, Article 14(7) first looks to the Member State in which the authorised representative acting on behalf of the manufacturer for the highest number of that manufacturer's products with digital elements is established. This is a routing rule for identifying the coordinating CSIRT. It should not be confused with the SRP Assigned Representative role. The authorised representative is part of the economic-operator structure, while the Assigned Representative is the individual user who submits information through the platform.
- Identify whether the manufacturer has an applicable authorised representative.
- Determine the representative acting for the highest number of the manufacturer's products.
- Use that representative's Member State when point (a) applies.
- Keep authorised representative and Assigned Representative terminology separate.
The Second Fallback Uses the Importer
If the authorised-representative branch does not apply, Article 14(7) next looks to the Member State in which the importer placing the highest number of the manufacturer's products with digital elements on the market is established. This provision can make importer data important to the manufacturer's regulatory routing analysis. It does not mean that the importer automatically replaces the manufacturer as the Article 14 reporting duty-holder. The manufacturer remains responsible for ensuring its mandatory notification is submitted through the SRP.
- Identify relevant EU importers.
- Determine which importer places the highest number of the manufacturer's products on the market.
- Use the importer's Member State when the second branch applies.
- Do not confuse routing with transfer of manufacturer responsibility.
The Third Fallback Uses the Distributor
If neither the authorised-representative nor importer branch applies, Article 14(7) turns to the distributor. The relevant Member State is the one where the distributor making available on the market the highest number of the manufacturer's products with digital elements is established. A non-EU manufacturer should therefore maintain enough information about its Union distribution structure to apply this test quickly. Waiting until a 24-hour reporting deadline has already begun to identify the company's principal distributor can create avoidable delay.
- Identify EU distributors before an incident occurs.
- Determine which distributor makes available the highest number of products.
- Use that distributor's Member State if the third branch applies.
- Preserve the evidence supporting the conclusion.
The Final Fallback Uses the Highest Number of Users
If none of the preceding Article 14(7) branches applies, the manufacturer uses the Member State in which the highest number of users of its products with digital elements are located, based on the information available to it. This means the Regulation recognises that a manufacturer may not possess a perfect census of every user. The routing decision should use the best reliable information available and should be documented. A manufacturer reaching this point should identify the data source used, the date of the assessment and the resulting Member State.
- Use the best available reliable user-location information.
- Identify the Member State with the highest number of users.
- Document the data source and assessment date.
- Select that Member State's coordinating CSIRT.
The User-Based Branch Can Provide Future Routing Continuity
The CRA provides a specific continuity rule for manufacturers whose coordinating CSIRT is determined using the final user-location branch. In that case, the manufacturer may submit notifications concerning subsequent actively exploited vulnerabilities or severe incidents to the same coordinating CSIRT to which it first reported. This can reduce repeated routing analysis for a manufacturer that had to rely on the user-location fallback. The provision is specifically connected to point (d) and should not automatically be extended to routing originally based on an authorised representative, importer or distributor.
- Record when point (d) is the basis for routing.
- Record the first coordinating CSIRT used.
- Preserve that information for later Article 14 cases.
- Do not automatically extend the rule to points (a), (b) or (c).
Non-EU Manufacturers Still Use Assigned Representatives in the SRP
The legal routing analysis determines the coordinating CSIRT, but the operational submission is made through the SRP by an Assigned Representative. ENISA's current platform model allows a Primary AR to register, select the appropriate coordinating CSIRT and create the manufacturer association. The AR uses an individual EU Login account with MFA. The manufacturer's location outside the EU does not change the distinction between the economic-operator authorised representative in Article 14(7) and the individual Assigned Representative who operates the SRP.
- Determine the Article 14(7) routing first.
- Use the selected coordinating CSIRT during Primary AR registration.
- Use EU Login with MFA.
- Maintain backup reporting coverage through Secondary ARs where appropriate.
Build the Routing Record Before an Article 14 Event
A non-EU manufacturer can prepare an Article 14 routing record without pre-registering unnecessary SRP associations. The record should state whether the manufacturer has an EU main establishment and, if not, work through the authorised-representative, importer, distributor and user-location cascade in order. It should name the likely coordinating CSIRT, identify the evidence used and record the date of review. The company should separately prepare EU Login and MFA for likely Assigned Representatives. This allows the reporting team to move quickly if an actively exploited vulnerability or severe incident starts the 24-hour clock.
- Document whether an EU main establishment exists.
- Apply the four non-EU routing branches in order.
- Record the likely coordinating CSIRT.
- Prepare Assigned Representative access.
- Review the routing record after material market or corporate changes.
Official sources
Read the full legal text and Commission material for precise wording, qualifications and updates.