For a maker based in the EU, the CRA defines its main site by facts. It is the Member State where most choices about product security are made. If no State can be found this way, use the EU site with the most staff.

This is a test of how the firm works. The maker cannot just choose the easiest place to report.

Map where decisions are made

Name who approves each main choice. Cover product security rules, flaw response, fix order, and the duty to report. Record the legal entity and place for each person. Keep the place of choice apart from the place where staff or servers do the work.

Save the result, proof, reviewer, and date. If control is spread across States, explain why one State still leads. If none does, explain why the staff test applies.

Build an entity evidence packet

Start with the legal maker and each EU site that may count. For each site, record the entity, place, and staff proof. List the product security choices made there. Link the firm chart to records of real choices. A label such as “head office” or “security office” is not enough.

Map choices that occur more than once. These cover policy, flaw handling, fix order, release approval, reports, and public security notes. Name the person with power, the entity they acted for, and the place where most choices were made.

If proof points to several States, record the clash. Save the view chosen by the reviewer who owns the result. Do not choose a route for its language or ease. The place of the person on call is also not the test.

Keep the route current

Review the result after a purchase, firm change, or shift in product security power. Keep the chosen CSIRT route with the proof. Do not keep it only in a call list.

Give the review an owner and events that reopen it. A firm rework, power transfer, purchase of a maker, or large staff shift should trigger a new check. Keep the old result and its dates so past reports still make sense.

During a live case, save the exact review used. Note any fact in dispute. If the route is not clear, raise the legal issue. Keep the Article 14 clock in view.

A maker with no main EU site uses a different ordered test in Article 14(7). Do not use this EU-based test without checking that rule.

Continue this workflow with the responsibility chain and the non-EU routing cascade.