Definition

Main establishment

The Member State where decisions on the manufacturer's cybersecurity are predominantly taken — determines the competent coordinator CSIRT.

A manufacturer is deemed to have its main establishment in the Member State where decisions related to the cybersecurity of its products with digital elements are predominantly taken; failing that, where the largest number of employees involved in that area work; for manufacturers without an establishment in the Union, in the Member State where its authorised representative is established or where the product is placed on the market. This determines which coordinator CSIRT receives notifications.

Reference: Art. 14(7) · Regulation (EU) 2024/2847 on EUR-Lex

Updated 2026-09-12 · Paraphrase for orientation, not legal advice.