cra-kit: correct Art. 18 — an authorised representative is optional

Art. 18(1) reads "a manufacturer may, by a written mandate, appoint an
authorised representative". The kit stated the opposite in eight places,
telling readers that a manufacturer established outside the EU is obliged
to appoint one. That is wrong, and in the customer-facing pages it is
advice about a duty that does not exist.

Art. 66 CRA adds the CRA only to Annex I of Regulation (EU) 2019/1020,
the market-surveillance list. It does not bring products with digital
elements under Art. 4 of that Regulation, so there is no indirect
requirement for an EU-established economic operator either.

Rewrite eu-authorised-representative.md around the correct mechanism:
what Art. 18(3) puts in a mandate, what Art. 18(2) keeps with the
manufacturer, and how an AR fixes the Art. 14(7) coordinator CSIRT at
step 1 of the cascade instead of leaving it to an importer, a
distributor, or the Member State with the most users.

Also drop the appointment status, the target dates, the third-party
vendor shortlist, and the placeholder identity block. The packet no
longer asserts that an appointment is underway, and does not assert the
opposite either. 00-INDEX.md is updated to match.

Follow-up to #603, where this was raised in review as out of scope.

cra-kit/CRA-Cheat-Sheet.md

@@ -89,7 +89,7 @@ the EU market you also need:
 
 | Obligation | Article | Action |
 |------------|---------|--------|
-| **EU Authorised Representative** | Art. 18 | Required if you're established outside the EU |
+| **EU Authorised Representative** | Art. 18 | Optional (Art. 18(1) says "may") — but it fixes your Art. 14(7) reporting end-point |
 | **Product class** (Annex III/IV) | — | Determines self-cert vs **Notified Body** — long queues |
 | **Conformity assessment + CE mark** | Art. 32, 30 | Module A or external review |
 | **Technical documentation** | Annex VII | Risk assessment, support-period commitment |

cra-kit/CRA-Compliance-Shortlist.md

@@ -73,7 +73,7 @@ SBOMs alone make you ready:
 
 | Obligation | Article | What it means |
 |------------|---------|---------------|
-| **EU Authorised Representative** | Art. 18 | Manufacturers established **outside** the EU must appoint a written-mandated representative **inside** the EU before placing a product on the EU market. Either contract a third-party AR service or use an existing EU subsidiary. |
+| **EU Authorised Representative** | Art. 18 | **Optional.** Art. 18(1) says a manufacturer *may* appoint a written-mandated representative inside the EU; there is no duty to, even from outside the EU. Appointing one gives you a single EU contact point, puts your documentation inside the Union, and fixes your Art. 14(7) reporting end-point in a Member State you choose. Without one, that end-point falls to your importer, your distributor, or wherever most of your users are. Either contract a third-party AR service or use an existing EU subsidiary. |
 | **Product classification** | Annex III / IV | Determines whether conformity assessment is self-declared (default class) or requires a **Notified Body** (important / critical class). Notified-body queues are already long — if you may need one, get in queue early. |
 | **Conformity assessment + CE mark** | Art. 32, 30 | Module A (self-assessment) or external review per classification; CE marking before placing the product on the EU market. |
 | **Technical documentation** | Annex VII | Risk assessment, secure-design rationale, vulnerability handling process, support-period commitment — more than the SBOM. |

cra-kit/CRA-Supply-Chain-Glossary.md

@@ -71,7 +71,7 @@ that no SBOM tool can satisfy. **Not legal advice** — engage CRA counsel.
 
 | Term | Article / location | Plain English |
 |------|--------------------|---------------|
-| **EU Authorised Representative** (EU AR) | Art. 18 | Required if the manufacturer is established **outside** the EU. A written-mandated EU-resident legal entity that receives regulator correspondence on the manufacturer's behalf. Either contract a third-party AR service or use an existing EU subsidiary. **Long-lead** — start now. |
+| **EU Authorised Representative** (EU AR) | Art. 18 | A written-mandated EU-resident legal entity that holds the manufacturer's documentation and receives regulator correspondence on its behalf. **Optional** — Art. 18(1) says a manufacturer *may* appoint one, including from outside the EU. It cannot take on the Art. 13 core obligations (Art. 18(2)). It does fix the Art. 14(7) coordinator CSIRT. Either contract a third-party AR service or use an existing EU subsidiary. **Long-lead** if you want one. |
 | **Notified Body** | — | Independent third-party conformity-assessment organisation. For "important" or "critical" products (Annex III/IV) the conformity assessment must involve a Notified Body. Queues are long — engage early if you may need one. |
 | **Annex III** | Annex III | List of **"important"** products with above-baseline cybersecurity risk (e.g. password managers, network management systems, browsers, certain identity-management components). Triggers stricter conformity assessment than the default class. |
 | **Annex IV** | Annex IV | List of **"critical"** products (highest-risk class), e.g. hardware security modules, secure-boot devices, smart-meter gateways of certain types. Always requires Notified Body involvement. |

cra-kit/README.md

@@ -254,10 +254,14 @@ distributor obligations. See [`CRA-Compliance-Shortlist.md`](CRA-Compliance-Shor
 legal/structural decisions, not artefacts.
 
 **Are we outside the EU? (US / Asia / etc.)**  
-Then you almost certainly need an **EU Authorised Representative** (Art. 18)
+Then consider an **EU Authorised Representative** (Art. 18). It is **optional** —
-appointed in writing **before** placing your product on the EU market. Either
+Art. 18(1) says a manufacturer *may* appoint one, and there is no duty even from
-contract a third-party AR service or use an existing EU subsidiary. This is a
+outside the EU. It is still worth weighing: an AR gives you one EU contact point,
-long-lead item — start now, do not wait for September 2026.
+holds your documentation inside the Union, and fixes your Art. 14(7) reporting
+end-point in a Member State you choose rather than leaving it to an importer, a
+distributor, or wherever most of your users happen to be. Either contract a
+third-party AR service or use an existing EU subsidiary. If you decide you want
+one, it is a long-lead item — start early. Your own counsel should make the call.
 
 ---
 

cra-kit/SKILL.md

@@ -59,7 +59,7 @@ Set `WOLFSSL_DIR` to your wolfSSL source tree when regenerating SBOMs.
 
 **Before starting**, confirm with the customer (do not assume):
 
-- Where is the customer **established** (US / EU / other)? If outside the EU, flag the **EU Authorised Representative** requirement (Art. 18) — long-lead item, start now.
+- Where is the customer **established** (US / EU / other)? If outside the EU, raise the **EU Authorised Representative** option (Art. 18). Do not call it a requirement — Art. 18(1) says *may*. Frame it as the choice that fixes their Art. 14(7) reporting end-point, and as a long-lead item if they want one.
 - What is the **product classification** under Annex III/IV? Self-declared (default class) or Notified Body required (important / critical)? Flag if unknown — Notified Body queues are long.
 - Is the customer's CRA work **on track for 11 Sep 2026** (Art. 14 reporting wave) and **11 Dec 2027** (full applicability)? If structural items are open, SBOM work alone won't make them ready.
 
@@ -95,7 +95,7 @@ Then run the SBOM execution checklist:
 - **VEX** = customer + scanner; wolfSSL provides advisories, not VEX files.
 - **bomsh** = optional provenance; not required for most CRA transparency asks.
 - **Vulnerability handling (Art. 13/14/16)** = customer publishes their own CVD policy + `security.txt`, runs on-call, files 24h reports via the **Single Reporting Platform** (to their coordinator CSIRT + ENISA) for their product; wolfSSL provides reference templates and handles reporting only for libraries placed on the EU market by wolfSSL Inc.
-- **Structural CRA (out of scope for this kit)** = EU Authorised Representative (Art. 18 — required if customer is outside the EU), Annex III/IV classification (determines self-cert vs Notified Body), conformity assessment + CE mark (Art. 32, 30), technical documentation (Annex VII), support-period commitment (Art. 13(8), 5+ years default). When a customer asks "are we ready?", surface these — SBOMs alone are not enough. Recommend engaging CRA counsel or consultant.
+- **Structural CRA (out of scope for this kit)** = EU Authorised Representative (Art. 18 — optional, never state it as required), Annex III/IV classification (determines self-cert vs Notified Body), conformity assessment + CE mark (Art. 32, 30), technical documentation (Annex VII), support-period commitment (Art. 13(8), 5+ years default). When a customer asks "are we ready?", surface these — SBOMs alone are not enough. Recommend engaging CRA counsel or consultant.
 
 ---
 

cra-kit/auditor-packet/00-INDEX.md

@@ -28,7 +28,7 @@ CRA conformity packet for a real product also includes:
 - Declaration of conformity (Art. 28)
 - Technical documentation per Annex VII (risk assessment, design info, support-period commitment, vulnerability handling process)
 - Proof of conformity assessment (self-declared per Art. 32 Module A, or Notified Body certificate per product class)
-- Identity of the EU Authorised Representative (Art. 18) if the manufacturer is established outside the EU
+- Identity of the EU Authorised Representative (Art. 18) where one has been appointed — appointment is optional
 - CE marking declaration
 
 See [`../CRA-Compliance-Shortlist.md`](../CRA-Compliance-Shortlist.md)

cra-kit/wolfssl-inc-auditor-packet/00-INDEX.md

@@ -5,7 +5,7 @@
 | [`classification-statement.md`](classification-statement.md) | Annex III / IV | ✅ Decided — default category (not Annex III/IV), self-certification |
 | [`conformity-assessment-route.md`](conformity-assessment-route.md) | Art. 32, Annex VIII | ✅ Module A self-assessment |
 | [`declaration-of-conformity.template.md`](declaration-of-conformity.template.md) | Art. 28 | 🟡 Template ready; signature pending product release alignment |
-| [`eu-authorised-representative.md`](eu-authorised-representative.md) | Art. 18 | 🟠 In progress — appointment underway |
+| [`eu-authorised-representative.md`](eu-authorised-representative.md) | Art. 18 | Reference page — an AR is optional under Art. 18(1); what a mandate covers and how it affects the Art. 14(7) end-point |
 | [`support-period-policy.md`](support-period-policy.md) | Art. 13(2), 13(8) | ✅ Decided — 5-year minimum, longer for LTS lines |
 | [`vulnerability-handling-process.md`](vulnerability-handling-process.md) | Art. 13, 14, 16 | 🟡 Process documented; public SLA pending leadership approval |
 | [`technical-documentation-outline.md`](technical-documentation-outline.md) | Annex VII | 🟠 In progress — outline complete; per-release packet on roadmap |
@@ -17,7 +17,7 @@
 2. **`conformity-assessment-route.md`** — why Module A self-assessment fits this classification
 3. **`vulnerability-handling-process.md`** — the only continuous obligation
 4. **`support-period-policy.md`** — what we commit to maintain, for how long
-5. **`eu-authorised-representative.md`** — how a US-established manufacturer satisfies Art. 18
+5. **`eu-authorised-representative.md`** — what Art. 18 offers a manufacturer established outside the EU, and why it is optional
 6. **`declaration-of-conformity.template.md`** + **`technical-documentation-outline.md`** + **`ce-marking-statement.md`** — the formal output
 
 ## CRA timeline anchors

cra-kit/wolfssl-inc-auditor-packet/README.md

@@ -26,7 +26,7 @@ fiction.
 
 **Not legal advice.** These artefacts are templates and statements of position;
 they are not, and do not replace, the actual signed legal documents wolfSSL Inc.
-files with EU regulators or its EU Authorised Representative.
+files with EU regulators, or that an EU Authorised Representative would hold.
 
 ---
 

cra-kit/wolfssl-inc-auditor-packet/declaration-of-conformity.template.md

@@ -25,7 +25,7 @@ template for their own products.
 - Email: [TO BE FILLED — kept synchronised with `/.well-known/security.txt` once wolfSSL Inc.'s security alias is provisioned]
 - Website: https://www.wolfssl.com/
 
-**3. EU Authorised Representative** (Art. 18, required for non-EU manufacturers)
+**3. EU Authorised Representative** (Art. 18 — optional; omit this block where no AR is appointed)
 
 - Name: [TO BE FILLED — see `eu-authorised-representative.md`]
 - Postal address: [TO BE FILLED]
@@ -72,6 +72,6 @@ No Notified Body involvement required for default-class products.
 ## Notes for customers adapting this template
 
 1. Fields in `[BRACKETS]` must be filled before signature.
-2. The declaration must be drawn up in **at least one of the official languages** of the Member State where the product is placed on the market. English is generally accepted but verify with your EU Authorised Representative.
+2. The declaration must be drawn up in **at least one of the official languages** of the Member State where the product is placed on the market. English is generally accepted, but verify against the Member States you place the product in — or ask your EU Authorised Representative, where you have appointed one.
 3. The signed declaration is part of the **technical documentation** (Annex VII) and must be retained for **10 years**.
 4. The declaration accompanies the product. For software products, this typically means including it in the release tarball, in a `LEGAL/` directory, or alongside the SBOMs.

cra-kit/wolfssl-inc-auditor-packet/eu-authorised-representative.md

@@ -1,64 +1,91 @@
-# EU Authorised Representative — wolfSSL Inc.
+# EU Authorised Representative — Art. 18
 
-**Status:** 🟠 In progress — appointment underway; target completion before 11 Sep 2026
+**Status:** Reference page. wolfSSL Inc. is a manufacturer under the CRA and complies with its manufacturer obligations. This page explains the Art. 18 mechanism. It does not publish an appointment, a decision, or a date.
 **CRA reference:** Art. 18
 
-## Why an EU AR is required
+## An AR is optional, not mandatory
 
-wolfSSL Inc. is established in the **United States** (Edmonds, Washington). CRA
+Art. 18(1) is permissive:
-Art. 18 requires manufacturers established outside the EU to appoint, **in
-writing**, an Authorised Representative inside the EU before placing a product
-on the EU market. The AR:
 
-- Receives correspondence from EU market surveillance authorities and ENISA on the manufacturer's behalf.
+> A manufacturer **may**, by a written mandate, appoint an authorised representative.
-- Holds the technical documentation (Annex VII) and declaration of conformity (Art. 28) for **10 years** post-placement, available to authorities on request.
-- Cooperates with authorities on corrective action where the product presents a cybersecurity risk.
-- **Determines the Art. 14 reporting end-point.** Because wolfSSL Inc. has no EU main establishment, Art. 14(7) uses the AR's Member State to fix the **CSIRT designated as coordinator** that wolfSSL Inc. files to via the Single Reporting Platform. Appointing the AR therefore also resolves *where* the 24-hour report is filed — see [`vulnerability-handling-process.md`](vulnerability-handling-process.md).
 
-The AR does **not** transfer manufacturer obligations — wolfSSL Inc. remains
+There is no obligation to appoint one. This holds for manufacturers established
-the manufacturer and bears the substantive obligations. The AR is a single
+outside the Union as well. The CRA differs here from regimes such as the MDR,
-point of contact in the EU.
+which does require a representative for non-EU manufacturers.
 
-## Current state
+The usual back-door route does not apply either. Art. 4 of Regulation (EU)
+2019/1020 forces some products to have an economic operator established in the
+Union, but Art. 66 CRA adds the CRA only to **Annex I** of that Regulation,
+which is the market-surveillance list. It does not bring products with digital
+elements within the scope of Art. 4.
 
-🟠 **wolfSSL Inc. is finalising the EU AR appointment.** Two paths were evaluated:
+## What an AR does when one is appointed
 
-1. **Use an existing wolfSSL EU presence.** wolfSSL has business operations in
+An AR is a natural or legal person established in the Union that holds a written
-   the DACH region (Germany / Austria / Switzerland). Nominating an existing
+mandate from the manufacturer (Art. 3(15)). Art. 18(3) sets the minimum scope of
-   EU-resident wolfSSL legal entity as the AR is the simplest path if such an
+that mandate:
-   entity exists with the appropriate legal capacity to act as AR.
-2. **Contract a third-party AR service.** Several vendors (e.g. Obelis, Authrep,
-   Casa Group) offer AR-as-a-service across CE-marking regulations. Cost is
-   typically EUR 1500–4000/year per regulation; lead time 4–6 weeks.
 
-The internal decision is being finalised by wolfSSL leadership. The written
+- Keep the EU declaration of conformity (Art. 28) and the technical documentation
-mandate will be in place before 11 Sep 2026 (Art. 14 vulnerability reporting
+  (Art. 31) available to market surveillance authorities for at least **10 years**
-onset) and certainly before 11 Dec 2027 (full CRA applicability).
+  after the product is placed on the market, or for the support period, whichever
+  is longer.
+- Provide an authority with the information and documentation needed to demonstrate
+  conformity, following a reasoned request.
+- Cooperate with authorities on any action taken to eliminate the risks a product
+  presents.
 
-## Placeholder identity
+Art. 18(2) sets a hard limit. The obligations in Art. 13(1) to (11), Art. 13(12)
+first subparagraph, and Art. 13(14) cannot form part of the mandate. Design,
+development, production, risk assessment, vulnerability handling, and Art. 14
+reporting stay with the manufacturer. An AR is a document custodian and a contact
+point. It does not transfer manufacturer obligations.
 
-Once the appointment is signed:
+## Effect on the Art. 14 reporting end-point
 
-- **Name:** [TO BE FILLED]
+Art. 14(7) ties the **CSIRT designated as coordinator** to the manufacturer's EU
-- **Address:** [TO BE FILLED]
+main establishment. Where there is no EU main establishment, the same paragraph
-- **Email:** [TO BE FILLED]
+sets an ordered cascade:
-- **Mandate effective date:** [TO BE FILLED]
+
-- **Mandate scope:** all wolfSSL libraries placed on the EU market by wolfSSL Inc. under CRA.
+1. The Member State of the authorised representative acting for the highest number
+   of the manufacturer's products.
+2. The Member State of the importer placing the highest number of products on the
+   market.
+3. The Member State of the distributor making available the highest number of
+   products.
+4. The Member State in which the highest number of users are located.
+
+An AR therefore fixes the reporting end-point at step 1, in a Member State the
+manufacturer chooses. Without an AR the cascade continues, and the end-point is
+determined by an importer, a distributor, or by where the users happen to be. The
+obligation to report is unaffected either way — only the destination changes. See
+[`vulnerability-handling-process.md`](vulnerability-handling-process.md).
 
 ## What this means for customers
 
-If your company is established **outside the EU** (US / UK post-Brexit / Asia /
+If your company is established outside the EU, Art. 18 gives you the same option
-elsewhere), you face the same Art. 18 obligation. wolfSSL's choice of AR does
+and imposes no duty. Weigh it on the merits:
-not satisfy your obligation — you appoint your own.
 
-The single-most-important advice we can give: **start now**. AR appointments
+- **A single EU contact point** for market surveillance authorities, rather than
-take weeks to months including legal review on both sides; the lead time
+  correspondence reaching you through an importer or distributor.
-compounds with conformity assessment timelines and is the most common
+- **Custody of the documentation** inside the Union, which is what an authority
-last-minute blocker for non-EU manufacturers.
+  asks for first.
+- **A predictable Art. 14 end-point**, chosen by you rather than derived from the
+  cascade.
+
+Against that, an AR is a contracted relationship with lead time. Third-party AR
+services exist across CE-marking regimes and appointments take weeks to months,
+including legal review on both sides. If you decide you want one, start early —
+the lead time compounds with conformity assessment timelines.
+
+wolfSSL's own arrangements do not satisfy your Art. 18 position, whichever way you
+resolve it. This is a decision for your own legal counsel.
 
 ## References
 
 - CRA Art. 18 (Authorised Representative)
-- CRA Art. 19 (Importer obligations) — what an EU importer carries if no AR is in place
+- CRA Art. 3(15) (definition), Art. 13(1)–(14) (obligations that cannot be delegated)
+- CRA Art. 14(7) (coordinator CSIRT cascade)
+- CRA Art. 19 (Importer obligations) — what an EU importer carries where no AR is in place
+- CRA Art. 66 (amendment to Regulation (EU) 2019/1020)
 - [`../CRA-Compliance-Shortlist.md`](../CRA-Compliance-Shortlist.md) — "Beyond this kit"
 - [`../CRA-Supply-Chain-Glossary.md`](../CRA-Supply-Chain-Glossary.md) — EU Authorised Representative

cra-kit/wolfssl-inc-auditor-packet/technical-documentation-outline.md

@@ -71,7 +71,7 @@ following sections are populated:
 ## Retention
 
 - **10 years** from the date the product is placed on the EU market, or for the duration of the support period (whichever is longer).
-- Held by wolfSSL Inc. **and** the EU Authorised Representative ([`eu-authorised-representative.md`](eu-authorised-representative.md)).
+- Held by the manufacturer, and also by the EU Authorised Representative where one is appointed ([`eu-authorised-representative.md`](eu-authorised-representative.md)).
 
 ## What this means for customers