cra-kit: Art. 18 EU Authorised Representative is discretionary, not required

[MarkAtwood]

DRAFT — do not merge yet. Needs a rebase once #603 lands (ROADMAP.md
delete/modify and a small SKILL.md hand-merge), and the policy position below
should get a nod before this is public.

What this changes

The kit told customers in eleven places that a manufacturer established outside
the EU must appoint an EU Authorised Representative. That is not what the
CRA says.

Art. 18(1): "A manufacturer may, by a written mandate, appoint an
authorised representative."

There is no shall appoint anywhere in Regulation (EU) 2024/2847.

Ruling out a backdoor requirement

The obvious counter is Art. 4 of Reg (EU) 2019/1020, which requires an
EU-established responsible economic operator, and CRA Art. 66 does add the CRA to
that regulation's Annex I. But Art. 4 is triggered by its own closed list in
Art. 4(5), not by Annex I, and the CRA never amends 4(5).

The comparator makes it deliberate rather than an oversight. When the legislature
wants Art. 4 to bite it amends both limbs:

• Batteries Reg (EU) 2023/1542, Art. 91: amends Art. 4(5) and Annex I.
• Critical Raw Materials Act, Reg (EU) 2024/1252: same two-limb amendment.
• CRA, Reg (EU) 2024/2847, Art. 66: Annex I only.

Verified against the OJ text and the latest consolidated 2019/1020
(02019R1020-20240523).

wolfSSL Inc.'s position

eu-authorised-representative.md is rewritten to state affirmatively how the
three Art. 18(3) tasks are discharged directly. Each maps onto a duty wolfSSL
carries as manufacturer regardless:

Art. 18(3) task	Discharged under
Hold DoC + technical documentation, 10 years or support period	Art. 13(13), identical duty, identical clock
Answer reasoned requests from market surveillance	Direct; contacts published per Art. 13(16)
Cooperate on risk-elimination action	Direct

Plus Art. 13(17), the single point of contact, already live as security.txt
and secure@wolfssl.com. Net effect is a shorter chain: authorities and
reporters reach the manufacturer directly rather than through a forwarding
intermediary.

Customer-facing guidance

Corrected to say Art. 18 is discretionary under the CRA, while noting that
other EU legislation covering finished consumer products may require an EU
representative outright. Customers shipping consumer hardware may well have a
real obligation, just not from this regulation, so the kit points at counsel for
the full set of acts rather than asserting Art. 18.

Note on Art. 14(7)

Declining to appoint an AR does not remove the need to know the coordinator
CSIRT. Art. 14(7) sets an ordered cascade where there is no EU main
establishment: authorised representative, importer, distributor, then user count.
#603 states that cascade. Naming the resulting end-point belongs in the
escalation runbook before 11 Sep 2026.

Test plan

• cra-kit/scripts/validate.sh passes
• No remaining "required / must appoint / almost certainly need" claims about the AR
• All relative links in changed files resolve
• CRLF line endings preserved on the files that use them

[Copilot]

Pull request overview

Updates the CRA kit’s customer- and auditor-facing guidance to reflect that CRA Art. 18 allows (but does not require) appointment of an EU Authorised Representative, and reframes wolfSSL Inc.’s compliance posture accordingly.

Changes:

• Rewrites EU Authorised Representative guidance to state Art. 18 is discretionary under the CRA and maps Art. 18(3) tasks to manufacturer duties wolfSSL performs directly.
• Updates checklists, glossaries, templates, and index/roadmap references to remove “required/must appoint” language and replace it with “optional/discretionary” framing.
• Aligns auditor packet materials (technical documentation retention, index/status) with the updated Art. 18 position.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
cra-kit/wolfssl-inc-auditor-packet/technical-documentation-outline.md	Removes implication that docs are held by an EU AR; attributes retention/availability to manufacturer duties.
cra-kit/wolfssl-inc-auditor-packet/README.md	Removes EU AR from the “files with…” description to match discretionary stance.
cra-kit/wolfssl-inc-auditor-packet/eu-authorised-representative.md	Major rewrite: explains Art. 18 permissive wording and how wolfSSL discharges Art. 18(3) functions directly.
cra-kit/wolfssl-inc-auditor-packet/declaration-of-conformity.template.md	Makes EU AR section conditional (“include only where mandated”).
cra-kit/wolfssl-inc-auditor-packet/00-INDEX.md	Updates EU AR status line to “Settled — discretionary; functions performed directly”.
cra-kit/SKILL.md	Updates agent/customer checklist language to reflect Art. 18 is discretionary under the CRA.
cra-kit/ROADMAP.md	Updates roadmap row to mark EU AR as settled/discretionary.
cra-kit/README.md	Updates “outside the EU” guidance to say EU AR is optional and why one might still appoint.
cra-kit/CRA-Supply-Chain-Glossary.md	Updates glossary definition to remove “required” framing and note other acts may differ.
cra-kit/CRA-Compliance-Shortlist.md	Updates structural obligations row to state Art. 18 is discretionary and explains practical rationale.
cra-kit/CRA-Cheat-Sheet.md	Updates cheat-sheet obligation table to mark EU AR as optional under CRA.
cra-kit/auditor-packet/00-INDEX.md	Updates customer packet list item to make EU AR conditional (“where one has been mandated”).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.