What do you need to know about representatives when selling to the EEA?

From 1 January 2021, the UK became a ‘third country’ from the EU’s perspective. This means that UK product manufacturers and importers are no longer considered to be ‘economic operators’ established in the EU.

So, any distributors operating in the EEA must now adapt to be able to continue to sell into the EEA, as those products have become third-country imports following Brexit. A UK manufacturer without an entity based in the EU must find someone to take on various product liability and consumer protection obligations – either their distributor or an authorised representative (AR). Georgia Shriane and Daniel De Saulles consider the issues.

What is an authorised representative (AR)?

An AR acts as a point of contact on behalf of a manufacturer based outside the EU, where the product is being sold (or ‘placed on the market’ in most cases, for example by a distributor importing the products). The AR may need to liaise with consumers, distributors and importantly, EU regulatory authorities.

Do I have to have an AR?

Yes, if you are selling certain types of products into the EU, particularly medical devices or other CE-marked products. In other circumstances, an AR may not be required but a ‘manufacturer’s representative’ is required where products are introduced onto the market in the EEA but are not subject to CE markings. The same role and principles apply, in essence, to either representative.

What do my distributors or ARs have to do?

In a nutshell, your distributors’ and/or ARs’ obligations include ensuring that:

• The correct conformity assessment procedure has been carried out by the manufacturer.
• All technical documentation has been created and the product contains the relevant conformity marking (i.e. a CE marking if relevant). This technical documentation must also be made available to the relevant national authority upon request.
• All instructions (safety and general product information) has been printed and provided in a language relevant to where consumers and end-users are based; and
• A point of contact is placed on the product, its packaging or accompanying documentation, this should be a European business name and address.

Can I appoint several distributors if I already have an AR?

Yes, and in fact the AR themselves can also be an importer/distributor of your products.

As a non-EU manufacturer (i.e. a UK company) you will only need to appoint one AR across the entire EU, whereas you may have several distributors and/or sales agents.

Who do I need to tell about my AR?

The AR’s details (i.e. name, address and contact details) must be printed on the packing / labelling of the products to be sold into the EU to notify the world in general. This is required by EU legislation, as the AR is the person or entity placing the product onto the market – this will allow market surveillance or regulatory authorities to contact that person or entity, if necessary.

The AR’s details do not need to appear on the declaration of conformity, as this is produced by the manufacturer as a statement that the product meets the essential requirements of the relevant European Directive(s) and the appropriate harmonised standards.

How does this affect data protection and a UK manufacturer’s obligations?

If the UK manufacturer sells to EU citizens only through EEA-based companies as reseller-distributors, then the contract between the consumer is with the EEA-based reseller. Collection and processing of EEA-based citizens’ data will therefore be by the EEA-based reseller (not by the UK manufacturer) and so the responsibility of “data controller” lies with the EEA-based distributor.

Importantly, though, if the UK manufacturer sells their products online to EEA-based consumers, either instead of OR alongside appointing an EEA-based reseller, then the UK based entity will be contracting directly with the consumers and becomes a data controller of their personal data. This is where the GDPR requires the appointment of an “Article 27 representative” as a point of contact between the UK manufacturer and the EEA based data protection supervisory authorities.

This representative must be either an individual or an establishment permanently located in the EEA. Recent heavy fines have been imposed by the Dutch supervisory authority on a website operating globally, but from outside the EA, dealing with EEA citizens’ personal data, without any Article 27 representative.

The gloves are off

With the first six month “bridging” arrangements between the post-Brexit-UK and the EU coming to an end soon, it seems likely that the requirements for EU-based representatives of all types will be enforced with fines and damaged reputations. For UK companies to continue to have EEA-based consumers’ trust, overlooking the need for these representatives may end up costing more than just the fine.