You're outside the EU. Which CSIRT do you actually report to?

Selling into the EU is enough to put you inside the Cyber Resilience Act's reporting duty, wherever your company is incorporated.Art. 2⁠(1)⁠ What's less obvious is that the Regulation still expects a single answer to "which national authority do I report to," even for a manufacturer with no EU office at all. Article 14(7) answers that with an ordered cascade, and ENISA's own guidance warns that choosing the wrong CSIRT can invalidate the notification.

The short answer

If you have an establishment in the EU, you report to the CSIRT coordinating in your member state of main establishment. If you don't, the cascade runs in this order:Art. 14⁠(7)⁠

1. Your authorised representative, if you have one
2. Failing that, your importer
3. Failing that, your distributor
4. Failing that, the member state where you have the largest number of users

You stop at the first link in that chain that actually exists for you. A manufacturer with an authorised representative in Ireland reports there, full stop — the importer, distributor and user-base tests only come into play if the step above them is absent.

Why the order matters, not just the list

It would be simpler if any of the four roles could point you to a valid CSIRT and you picked whichever was easiest to establish. The Regulation doesn't work that way: the cascade is sequential, so a manufacturer who reports based on their distributor's location while an authorised representative already exists has reported to the wrong authority, even though a distributor genuinely exists. This is where the "one wrong report" failure mode actually happens — not from confusion about the rule, but from skipping straight to whichever role was most convenient to identify without checking whether an earlier one applied first.

It also means the answer isn't fixed for the life of the product. Appoint an authorised representative after previously relying on your importer, and your correct CSIRT changes with it — quietly, from the Regulation's point of view, with no notice that arrives on its own.

What each role actually has to be, to count

None of the four terms is a courtesy title. An "authorised representative" is a specific role with obligations under the Regulation, not simply someone in the EU you have a business relationship with; the same is true of "importer" and "distributor," both of which carry defined meanings tied to who places or makes the product available on the market. If you're not sure whether a party you work with actually occupies one of these roles in the Regulation's sense, that uncertainty is itself worth resolving before an incident forces the question — the 24-hour clock is not the moment to be researching which entity in your supply chain the cascade actually points to.

Working it out before you need it

The practical failure here isn't ignorance of the rule — most manufacturers selling into the EU can recite "authorised rep, then importer, then distributor, then users" once they've read it. The failure is not having pre-identified which step applies to them, so that at hour six of a 24-hour clock, someone is trying to work out for the first time whether their EU distributor counts, while also drafting an early warning. Where to report lists the coordinating CSIRT in all 27 member states, and CRA for non-EU manufacturers walks through the cascade with the same order as above — worth resolving now, filed away, rather than reconstructed under a deadline.