CRA SRP guidance - AR User registration

The information on this page is provided according to our current best knowledge and may be subject to change. Please ensure that you consult the latest available guidance before applying these instructions. Last updated: 3/08/2026.

AR users authenticate through EU Login when registering on the SRP. Authentication steps related to EU Login are not described here; all related information can be found at:  https://trusted-digital-identity.europa.eu/index_en.

Notes: 

• Validation of the registration of the assigned representative (AR) by the CSIRT Designated as Coordinator (CDaC), which happens after the registration process described below, is not a prerequisite for fulfilling the CRA reporting obligation. The validation that an AR is authorised to submit a report on behalf of a specific manufacturer or open-source steward will take place after the first access to the platform, in parallel with the reporting process, and will not affect the ability to submit notifications through the SRP. 
• As the specific validation procedure may vary between CSIRTs and remains the responsibility of the relevant CSIRT, manufacturers and open-source stewards are advised to register and initiate the validation process only when they need to submit a specific notification, rather than creating an account pre-emptively.

Registration as Primary Assigned Representative & AR Association with Manufacturer via “Registration Flow”

Follow these steps to register on the SRP and associate your account with a manufacturer.

Pre-conditions

• You are not already registered as an SRP user
• You already have an active EU Login account (please check the URL above)

Steps

• Open the SRP website (URL to be provided at launch), select your role (AR) and click “Continue”.

Note: Hovering over the “i" icon allows you to view information about each role.

• Select the designated CSIRT from the drop-down menu and click “Continue”.

• Authenticate through EU Login
• Read and accept the legal agreement
• Confirm the accuracy of your pre-filled personal details (First Name, Last Name, Email, Legal name) click “Continue” 

• Enter the manufacturer details (manufacturer name, manufacturer adress, additional information) and click “Continue”.

Exceptions: If you omit mandatory manufacturer details (manufacturer name, additional Information), the SRP will return an error and the “Continue” button will remain disabled.

Expected result: Your registration is completed, subject only to approval of the AR association with manufacturer. Your account is "Active" and assigned the “AR Primary User” role. The system sends you a confirmation email. If you included manufacturer details, the manufacturer entity is created in the SRP.

Registration via Invitation (Secondary AR)

Follow these steps if you, as a new Secondary AR, wish to register on the SRP following an email invitation received from the Primary AR.

Pre-conditions

• You are not already registered as an SRP user
• You already have an active EU Login account 
• You have received an email invitation from the Primary AR

Steps

• Click the link in the email invitation. You will be prompted to authenticate through EU Login, which completes the authentication successfully.

Exceptions: If the invitation link has expired (more than 7 days have passed since the Primary AR sent the invitation), you will be redirected to a page displaying an error message.

• Confirm the accuracy of your pre-filled personal details (First Name, Last Name, Email, Legal name) and click “Continue”.

• Confirm the accuracy of the pre-filled manufacturer details for the manufacturer associated with the Primary AR who initiated the invitation and click “Accept invitation”.

Expected result: You are successfully registered as a Secondary AR with the role “AR Backup User” for the relevant manufacturer, and your status is set to “Active”. If the registration is not completed within 7 days of the invitation being sent, the user record status is automatically changed to “Invitation Expired”.