Free readiness check

CRA SRP • ASSIGNED REPRESENTATIVE

CRA Assigned Representative: what manufacturers need to set up

Practical guide to the CRA Single Reporting Platform Assigned Representative role, Primary and Secondary ARs, EU Login MFA, registration and manufacturer association.

Last reviewed 20 September 2026 against current European Commission and ENISA guidance.

What is an Assigned Representative?

Within ENISA's CRA Single Reporting Platform, the Assigned Representative (AR) is the individual who submits mandatory CRA notifications on behalf of a manufacturer. The current SRP supports Primary and Secondary AR roles.

Primary versus Secondary AR

ENISA states that a manufacturer can have one Primary AR and up to 20 Secondary ARs. The Primary AR manages the manufacturer association and can invite or remove Secondary ARs after the association is validated. Both roles can submit and update notifications subject to their permissions.

What do ARs need?

ARs use their own EU Login account and must have multi-factor authentication enabled. ENISA currently advises manufacturers to initiate SRP registration when a specific notification needs to be submitted rather than registering pre-emptively.

Operational takeaway

Even if registration is event-driven, manufacturers should decide in advance who will act as Primary and backup representatives, who owns the internal escalation, and how incident facts will reach the representative quickly enough for the 24-hour stage.

Official guidance: ENISA AR User Registration · ENISA SRP FAQ

Frequently asked questions

How many CRA Assigned Representatives can a manufacturer have?

ENISA's current FAQ states there can be one Primary AR and up to 20 Secondary ARs per manufacturer.

Does an AR need EU Login?

Yes. ENISA states that ARs use personal EU Login accounts with multi-factor authentication enabled.

Should we register before an incident?

ENISA currently advises manufacturers to register and initiate validation when they need to submit a specific notification, but organisations can still prepare internal roles and escalation in advance.

PROTECT · REPORT · COMPLY

Test the workflow before the reporting clock starts.

Use the free CRA tools or review the Founding 10 onboarding package for an operational 24h / 72h runbook.

CyberAct24 is an independent commercial workflow service, not ENISA, an EU institution, a regulator or a law firm. Regulatory source material should be checked before acting.

Built on Hatchable