From a4110d3a9bf2c2bff2101e6afe21370fe8461494 Mon Sep 17 00:00:00 2001 From: Sameeh Jubran Date: Fri, 28 Aug 2026 11:27:10 +0300 Subject: [PATCH] =?UTF-8?q?cra-kit:=20correct=20Art.=2018=20=E2=80=94=20an?= =?UTF-8?q?=20authorised=20representative=20is=20optional?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Art. 18(1) reads "a manufacturer may, by a written mandate, appoint an authorised representative". The kit stated the opposite in eight places, telling readers that a manufacturer established outside the EU is obliged to appoint one. That is wrong, and in the customer-facing pages it is advice about a duty that does not exist. Art. 66 CRA adds the CRA only to Annex I of Regulation (EU) 2019/1020, the market-surveillance list. It does not bring products with digital elements under Art. 4 of that Regulation, so there is no indirect requirement for an EU-established economic operator either. Rewrite eu-authorised-representative.md around the correct mechanism: what Art. 18(3) puts in a mandate, what Art. 18(2) keeps with the manufacturer, and how an AR fixes the Art. 14(7) coordinator CSIRT at step 1 of the cascade instead of leaving it to an importer, a distributor, or the Member State with the most users. Also drop the appointment status, the target dates, the third-party vendor shortlist, and the placeholder identity block. The packet no longer asserts that an appointment is underway, and does not assert the opposite either. 00-INDEX.md is updated to match. Follow-up to #603, where this was raised in review as out of scope. --- cra-kit/CRA-Cheat-Sheet.md | 2 +- cra-kit/CRA-Compliance-Shortlist.md | 2 +- cra-kit/CRA-Supply-Chain-Glossary.md | 2 +- cra-kit/README.md | 12 +- cra-kit/SKILL.md | 4 +- cra-kit/auditor-packet/00-INDEX.md | 2 +- .../wolfssl-inc-auditor-packet/00-INDEX.md | 4 +- cra-kit/wolfssl-inc-auditor-packet/README.md | 2 +- .../declaration-of-conformity.template.md | 4 +- .../eu-authorised-representative.md | 109 +++++++++++------- .../technical-documentation-outline.md | 2 +- 11 files changed, 88 insertions(+), 57 deletions(-) diff --git a/cra-kit/CRA-Cheat-Sheet.md b/cra-kit/CRA-Cheat-Sheet.md index 180f82a4..76280b40 100644 --- a/cra-kit/CRA-Cheat-Sheet.md +++ b/cra-kit/CRA-Cheat-Sheet.md @@ -89,7 +89,7 @@ the EU market you also need: | Obligation | Article | Action | |------------|---------|--------| -| **EU Authorised Representative** | Art. 18 | Required if you're established outside the EU | +| **EU Authorised Representative** | Art. 18 | Optional (Art. 18(1) says "may") — but it fixes your Art. 14(7) reporting end-point | | **Product class** (Annex III/IV) | — | Determines self-cert vs **Notified Body** — long queues | | **Conformity assessment + CE mark** | Art. 32, 30 | Module A or external review | | **Technical documentation** | Annex VII | Risk assessment, support-period commitment | diff --git a/cra-kit/CRA-Compliance-Shortlist.md b/cra-kit/CRA-Compliance-Shortlist.md index 21a35b0b..267eefa5 100644 --- a/cra-kit/CRA-Compliance-Shortlist.md +++ b/cra-kit/CRA-Compliance-Shortlist.md @@ -73,7 +73,7 @@ SBOMs alone make you ready: | Obligation | Article | What it means | |------------|---------|---------------| -| **EU Authorised Representative** | Art. 18 | Manufacturers established **outside** the EU must appoint a written-mandated representative **inside** the EU before placing a product on the EU market. Either contract a third-party AR service or use an existing EU subsidiary. | +| **EU Authorised Representative** | Art. 18 | **Optional.** Art. 18(1) says a manufacturer *may* appoint a written-mandated representative inside the EU; there is no duty to, even from outside the EU. Appointing one gives you a single EU contact point, puts your documentation inside the Union, and fixes your Art. 14(7) reporting end-point in a Member State you choose. Without one, that end-point falls to your importer, your distributor, or wherever most of your users are. Either contract a third-party AR service or use an existing EU subsidiary. | | **Product classification** | Annex III / IV | Determines whether conformity assessment is self-declared (default class) or requires a **Notified Body** (important / critical class). Notified-body queues are already long — if you may need one, get in queue early. | | **Conformity assessment + CE mark** | Art. 32, 30 | Module A (self-assessment) or external review per classification; CE marking before placing the product on the EU market. | | **Technical documentation** | Annex VII | Risk assessment, secure-design rationale, vulnerability handling process, support-period commitment — more than the SBOM. | diff --git a/cra-kit/CRA-Supply-Chain-Glossary.md b/cra-kit/CRA-Supply-Chain-Glossary.md index 7377c1a1..92d8d865 100644 --- a/cra-kit/CRA-Supply-Chain-Glossary.md +++ b/cra-kit/CRA-Supply-Chain-Glossary.md @@ -71,7 +71,7 @@ that no SBOM tool can satisfy. **Not legal advice** — engage CRA counsel. | Term | Article / location | Plain English | |------|--------------------|---------------| -| **EU Authorised Representative** (EU AR) | Art. 18 | Required if the manufacturer is established **outside** the EU. A written-mandated EU-resident legal entity that receives regulator correspondence on the manufacturer's behalf. Either contract a third-party AR service or use an existing EU subsidiary. **Long-lead** — start now. | +| **EU Authorised Representative** (EU AR) | Art. 18 | A written-mandated EU-resident legal entity that holds the manufacturer's documentation and receives regulator correspondence on its behalf. **Optional** — Art. 18(1) says a manufacturer *may* appoint one, including from outside the EU. It cannot take on the Art. 13 core obligations (Art. 18(2)). It does fix the Art. 14(7) coordinator CSIRT. Either contract a third-party AR service or use an existing EU subsidiary. **Long-lead** if you want one. | | **Notified Body** | — | Independent third-party conformity-assessment organisation. For "important" or "critical" products (Annex III/IV) the conformity assessment must involve a Notified Body. Queues are long — engage early if you may need one. | | **Annex III** | Annex III | List of **"important"** products with above-baseline cybersecurity risk (e.g. password managers, network management systems, browsers, certain identity-management components). Triggers stricter conformity assessment than the default class. | | **Annex IV** | Annex IV | List of **"critical"** products (highest-risk class), e.g. hardware security modules, secure-boot devices, smart-meter gateways of certain types. Always requires Notified Body involvement. | diff --git a/cra-kit/README.md b/cra-kit/README.md index 274b3674..f844b2af 100644 --- a/cra-kit/README.md +++ b/cra-kit/README.md @@ -254,10 +254,14 @@ distributor obligations. See [`CRA-Compliance-Shortlist.md`](CRA-Compliance-Shor legal/structural decisions, not artefacts. **Are we outside the EU? (US / Asia / etc.)** -Then you almost certainly need an **EU Authorised Representative** (Art. 18) -appointed in writing **before** placing your product on the EU market. Either -contract a third-party AR service or use an existing EU subsidiary. This is a -long-lead item — start now, do not wait for September 2026. +Then consider an **EU Authorised Representative** (Art. 18). It is **optional** — +Art. 18(1) says a manufacturer *may* appoint one, and there is no duty even from +outside the EU. It is still worth weighing: an AR gives you one EU contact point, +holds your documentation inside the Union, and fixes your Art. 14(7) reporting +end-point in a Member State you choose rather than leaving it to an importer, a +distributor, or wherever most of your users happen to be. Either contract a +third-party AR service or use an existing EU subsidiary. If you decide you want +one, it is a long-lead item — start early. Your own counsel should make the call. --- diff --git a/cra-kit/SKILL.md b/cra-kit/SKILL.md index a9d2cf21..56e880ab 100644 --- a/cra-kit/SKILL.md +++ b/cra-kit/SKILL.md @@ -59,7 +59,7 @@ Set `WOLFSSL_DIR` to your wolfSSL source tree when regenerating SBOMs. **Before starting**, confirm with the customer (do not assume): -- Where is the customer **established** (US / EU / other)? If outside the EU, flag the **EU Authorised Representative** requirement (Art. 18) — long-lead item, start now. +- Where is the customer **established** (US / EU / other)? If outside the EU, raise the **EU Authorised Representative** option (Art. 18). Do not call it a requirement — Art. 18(1) says *may*. Frame it as the choice that fixes their Art. 14(7) reporting end-point, and as a long-lead item if they want one. - What is the **product classification** under Annex III/IV? Self-declared (default class) or Notified Body required (important / critical)? Flag if unknown — Notified Body queues are long. - Is the customer's CRA work **on track for 11 Sep 2026** (Art. 14 reporting wave) and **11 Dec 2027** (full applicability)? If structural items are open, SBOM work alone won't make them ready. @@ -95,7 +95,7 @@ Then run the SBOM execution checklist: - **VEX** = customer + scanner; wolfSSL provides advisories, not VEX files. - **bomsh** = optional provenance; not required for most CRA transparency asks. - **Vulnerability handling (Art. 13/14/16)** = customer publishes their own CVD policy + `security.txt`, runs on-call, files 24h reports via the **Single Reporting Platform** (to their coordinator CSIRT + ENISA) for their product; wolfSSL provides reference templates and handles reporting only for libraries placed on the EU market by wolfSSL Inc. -- **Structural CRA (out of scope for this kit)** = EU Authorised Representative (Art. 18 — required if customer is outside the EU), Annex III/IV classification (determines self-cert vs Notified Body), conformity assessment + CE mark (Art. 32, 30), technical documentation (Annex VII), support-period commitment (Art. 13(8), 5+ years default). When a customer asks "are we ready?", surface these — SBOMs alone are not enough. Recommend engaging CRA counsel or consultant. +- **Structural CRA (out of scope for this kit)** = EU Authorised Representative (Art. 18 — optional, never state it as required), Annex III/IV classification (determines self-cert vs Notified Body), conformity assessment + CE mark (Art. 32, 30), technical documentation (Annex VII), support-period commitment (Art. 13(8), 5+ years default). When a customer asks "are we ready?", surface these — SBOMs alone are not enough. Recommend engaging CRA counsel or consultant. --- diff --git a/cra-kit/auditor-packet/00-INDEX.md b/cra-kit/auditor-packet/00-INDEX.md index 96ef3860..7c56b0a1 100644 --- a/cra-kit/auditor-packet/00-INDEX.md +++ b/cra-kit/auditor-packet/00-INDEX.md @@ -28,7 +28,7 @@ CRA conformity packet for a real product also includes: - Declaration of conformity (Art. 28) - Technical documentation per Annex VII (risk assessment, design info, support-period commitment, vulnerability handling process) - Proof of conformity assessment (self-declared per Art. 32 Module A, or Notified Body certificate per product class) -- Identity of the EU Authorised Representative (Art. 18) if the manufacturer is established outside the EU +- Identity of the EU Authorised Representative (Art. 18) where one has been appointed — appointment is optional - CE marking declaration See [`../CRA-Compliance-Shortlist.md`](../CRA-Compliance-Shortlist.md) diff --git a/cra-kit/wolfssl-inc-auditor-packet/00-INDEX.md b/cra-kit/wolfssl-inc-auditor-packet/00-INDEX.md index 320df29b..ed9ff1de 100644 --- a/cra-kit/wolfssl-inc-auditor-packet/00-INDEX.md +++ b/cra-kit/wolfssl-inc-auditor-packet/00-INDEX.md @@ -5,7 +5,7 @@ | [`classification-statement.md`](classification-statement.md) | Annex III / IV | ✅ Decided — default category (not Annex III/IV), self-certification | | [`conformity-assessment-route.md`](conformity-assessment-route.md) | Art. 32, Annex VIII | ✅ Module A self-assessment | | [`declaration-of-conformity.template.md`](declaration-of-conformity.template.md) | Art. 28 | 🟡 Template ready; signature pending product release alignment | -| [`eu-authorised-representative.md`](eu-authorised-representative.md) | Art. 18 | 🟠 In progress — appointment underway | +| [`eu-authorised-representative.md`](eu-authorised-representative.md) | Art. 18 | Reference page — an AR is optional under Art. 18(1); what a mandate covers and how it affects the Art. 14(7) end-point | | [`support-period-policy.md`](support-period-policy.md) | Art. 13(2), 13(8) | ✅ Decided — 5-year minimum, longer for LTS lines | | [`vulnerability-handling-process.md`](vulnerability-handling-process.md) | Art. 13, 14, 16 | 🟡 Process documented; public SLA pending leadership approval | | [`technical-documentation-outline.md`](technical-documentation-outline.md) | Annex VII | 🟠 In progress — outline complete; per-release packet on roadmap | @@ -17,7 +17,7 @@ 2. **`conformity-assessment-route.md`** — why Module A self-assessment fits this classification 3. **`vulnerability-handling-process.md`** — the only continuous obligation 4. **`support-period-policy.md`** — what we commit to maintain, for how long -5. **`eu-authorised-representative.md`** — how a US-established manufacturer satisfies Art. 18 +5. **`eu-authorised-representative.md`** — what Art. 18 offers a manufacturer established outside the EU, and why it is optional 6. **`declaration-of-conformity.template.md`** + **`technical-documentation-outline.md`** + **`ce-marking-statement.md`** — the formal output ## CRA timeline anchors diff --git a/cra-kit/wolfssl-inc-auditor-packet/README.md b/cra-kit/wolfssl-inc-auditor-packet/README.md index f090a107..d13d8b1a 100644 --- a/cra-kit/wolfssl-inc-auditor-packet/README.md +++ b/cra-kit/wolfssl-inc-auditor-packet/README.md @@ -26,7 +26,7 @@ fiction. **Not legal advice.** These artefacts are templates and statements of position; they are not, and do not replace, the actual signed legal documents wolfSSL Inc. -files with EU regulators or its EU Authorised Representative. +files with EU regulators, or that an EU Authorised Representative would hold. --- diff --git a/cra-kit/wolfssl-inc-auditor-packet/declaration-of-conformity.template.md b/cra-kit/wolfssl-inc-auditor-packet/declaration-of-conformity.template.md index 5fdf8815..3027e329 100644 --- a/cra-kit/wolfssl-inc-auditor-packet/declaration-of-conformity.template.md +++ b/cra-kit/wolfssl-inc-auditor-packet/declaration-of-conformity.template.md @@ -25,7 +25,7 @@ template for their own products. - Email: [TO BE FILLED — kept synchronised with `/.well-known/security.txt` once wolfSSL Inc.'s security alias is provisioned] - Website: https://www.wolfssl.com/ -**3. EU Authorised Representative** (Art. 18, required for non-EU manufacturers) +**3. EU Authorised Representative** (Art. 18 — optional; omit this block where no AR is appointed) - Name: [TO BE FILLED — see `eu-authorised-representative.md`] - Postal address: [TO BE FILLED] @@ -72,6 +72,6 @@ No Notified Body involvement required for default-class products. ## Notes for customers adapting this template 1. Fields in `[BRACKETS]` must be filled before signature. -2. The declaration must be drawn up in **at least one of the official languages** of the Member State where the product is placed on the market. English is generally accepted but verify with your EU Authorised Representative. +2. The declaration must be drawn up in **at least one of the official languages** of the Member State where the product is placed on the market. English is generally accepted, but verify against the Member States you place the product in — or ask your EU Authorised Representative, where you have appointed one. 3. The signed declaration is part of the **technical documentation** (Annex VII) and must be retained for **10 years**. 4. The declaration accompanies the product. For software products, this typically means including it in the release tarball, in a `LEGAL/` directory, or alongside the SBOMs. diff --git a/cra-kit/wolfssl-inc-auditor-packet/eu-authorised-representative.md b/cra-kit/wolfssl-inc-auditor-packet/eu-authorised-representative.md index a554046b..ba81c190 100644 --- a/cra-kit/wolfssl-inc-auditor-packet/eu-authorised-representative.md +++ b/cra-kit/wolfssl-inc-auditor-packet/eu-authorised-representative.md @@ -1,64 +1,91 @@ -# EU Authorised Representative — wolfSSL Inc. +# EU Authorised Representative — Art. 18 -**Status:** 🟠 In progress — appointment underway; target completion before 11 Sep 2026 +**Status:** Reference page. wolfSSL Inc. is a manufacturer under the CRA and complies with its manufacturer obligations. This page explains the Art. 18 mechanism. It does not publish an appointment, a decision, or a date. **CRA reference:** Art. 18 -## Why an EU AR is required +## An AR is optional, not mandatory -wolfSSL Inc. is established in the **United States** (Edmonds, Washington). CRA -Art. 18 requires manufacturers established outside the EU to appoint, **in -writing**, an Authorised Representative inside the EU before placing a product -on the EU market. The AR: +Art. 18(1) is permissive: -- Receives correspondence from EU market surveillance authorities and ENISA on the manufacturer's behalf. -- Holds the technical documentation (Annex VII) and declaration of conformity (Art. 28) for **10 years** post-placement, available to authorities on request. -- Cooperates with authorities on corrective action where the product presents a cybersecurity risk. -- **Determines the Art. 14 reporting end-point.** Because wolfSSL Inc. has no EU main establishment, Art. 14(7) uses the AR's Member State to fix the **CSIRT designated as coordinator** that wolfSSL Inc. files to via the Single Reporting Platform. Appointing the AR therefore also resolves *where* the 24-hour report is filed — see [`vulnerability-handling-process.md`](vulnerability-handling-process.md). +> A manufacturer **may**, by a written mandate, appoint an authorised representative. -The AR does **not** transfer manufacturer obligations — wolfSSL Inc. remains -the manufacturer and bears the substantive obligations. The AR is a single -point of contact in the EU. +There is no obligation to appoint one. This holds for manufacturers established +outside the Union as well. The CRA differs here from regimes such as the MDR, +which does require a representative for non-EU manufacturers. -## Current state +The usual back-door route does not apply either. Art. 4 of Regulation (EU) +2019/1020 forces some products to have an economic operator established in the +Union, but Art. 66 CRA adds the CRA only to **Annex I** of that Regulation, +which is the market-surveillance list. It does not bring products with digital +elements within the scope of Art. 4. -🟠 **wolfSSL Inc. is finalising the EU AR appointment.** Two paths were evaluated: +## What an AR does when one is appointed -1. **Use an existing wolfSSL EU presence.** wolfSSL has business operations in - the DACH region (Germany / Austria / Switzerland). Nominating an existing - EU-resident wolfSSL legal entity as the AR is the simplest path if such an - entity exists with the appropriate legal capacity to act as AR. -2. **Contract a third-party AR service.** Several vendors (e.g. Obelis, Authrep, - Casa Group) offer AR-as-a-service across CE-marking regulations. Cost is - typically EUR 1500–4000/year per regulation; lead time 4–6 weeks. +An AR is a natural or legal person established in the Union that holds a written +mandate from the manufacturer (Art. 3(15)). Art. 18(3) sets the minimum scope of +that mandate: -The internal decision is being finalised by wolfSSL leadership. The written -mandate will be in place before 11 Sep 2026 (Art. 14 vulnerability reporting -onset) and certainly before 11 Dec 2027 (full CRA applicability). +- Keep the EU declaration of conformity (Art. 28) and the technical documentation + (Art. 31) available to market surveillance authorities for at least **10 years** + after the product is placed on the market, or for the support period, whichever + is longer. +- Provide an authority with the information and documentation needed to demonstrate + conformity, following a reasoned request. +- Cooperate with authorities on any action taken to eliminate the risks a product + presents. -## Placeholder identity +Art. 18(2) sets a hard limit. The obligations in Art. 13(1) to (11), Art. 13(12) +first subparagraph, and Art. 13(14) cannot form part of the mandate. Design, +development, production, risk assessment, vulnerability handling, and Art. 14 +reporting stay with the manufacturer. An AR is a document custodian and a contact +point. It does not transfer manufacturer obligations. -Once the appointment is signed: +## Effect on the Art. 14 reporting end-point -- **Name:** [TO BE FILLED] -- **Address:** [TO BE FILLED] -- **Email:** [TO BE FILLED] -- **Mandate effective date:** [TO BE FILLED] -- **Mandate scope:** all wolfSSL libraries placed on the EU market by wolfSSL Inc. under CRA. +Art. 14(7) ties the **CSIRT designated as coordinator** to the manufacturer's EU +main establishment. Where there is no EU main establishment, the same paragraph +sets an ordered cascade: + +1. The Member State of the authorised representative acting for the highest number + of the manufacturer's products. +2. The Member State of the importer placing the highest number of products on the + market. +3. The Member State of the distributor making available the highest number of + products. +4. The Member State in which the highest number of users are located. + +An AR therefore fixes the reporting end-point at step 1, in a Member State the +manufacturer chooses. Without an AR the cascade continues, and the end-point is +determined by an importer, a distributor, or by where the users happen to be. The +obligation to report is unaffected either way — only the destination changes. See +[`vulnerability-handling-process.md`](vulnerability-handling-process.md). ## What this means for customers -If your company is established **outside the EU** (US / UK post-Brexit / Asia / -elsewhere), you face the same Art. 18 obligation. wolfSSL's choice of AR does -not satisfy your obligation — you appoint your own. +If your company is established outside the EU, Art. 18 gives you the same option +and imposes no duty. Weigh it on the merits: -The single-most-important advice we can give: **start now**. AR appointments -take weeks to months including legal review on both sides; the lead time -compounds with conformity assessment timelines and is the most common -last-minute blocker for non-EU manufacturers. +- **A single EU contact point** for market surveillance authorities, rather than + correspondence reaching you through an importer or distributor. +- **Custody of the documentation** inside the Union, which is what an authority + asks for first. +- **A predictable Art. 14 end-point**, chosen by you rather than derived from the + cascade. + +Against that, an AR is a contracted relationship with lead time. Third-party AR +services exist across CE-marking regimes and appointments take weeks to months, +including legal review on both sides. If you decide you want one, start early — +the lead time compounds with conformity assessment timelines. + +wolfSSL's own arrangements do not satisfy your Art. 18 position, whichever way you +resolve it. This is a decision for your own legal counsel. ## References - CRA Art. 18 (Authorised Representative) -- CRA Art. 19 (Importer obligations) — what an EU importer carries if no AR is in place +- CRA Art. 3(15) (definition), Art. 13(1)–(14) (obligations that cannot be delegated) +- CRA Art. 14(7) (coordinator CSIRT cascade) +- CRA Art. 19 (Importer obligations) — what an EU importer carries where no AR is in place +- CRA Art. 66 (amendment to Regulation (EU) 2019/1020) - [`../CRA-Compliance-Shortlist.md`](../CRA-Compliance-Shortlist.md) — "Beyond this kit" - [`../CRA-Supply-Chain-Glossary.md`](../CRA-Supply-Chain-Glossary.md) — EU Authorised Representative diff --git a/cra-kit/wolfssl-inc-auditor-packet/technical-documentation-outline.md b/cra-kit/wolfssl-inc-auditor-packet/technical-documentation-outline.md index 98d0409f..777eb9f1 100644 --- a/cra-kit/wolfssl-inc-auditor-packet/technical-documentation-outline.md +++ b/cra-kit/wolfssl-inc-auditor-packet/technical-documentation-outline.md @@ -71,7 +71,7 @@ following sections are populated: ## Retention - **10 years** from the date the product is placed on the EU market, or for the duration of the support period (whichever is longer). -- Held by wolfSSL Inc. **and** the EU Authorised Representative ([`eu-authorised-representative.md`](eu-authorised-representative.md)). +- Held by the manufacturer, and also by the EU Authorised Representative where one is appointed ([`eu-authorised-representative.md`](eu-authorised-representative.md)). ## What this means for customers