For an EU-established manufacturer, the CRA treats the main establishment as the Member State where decisions related to the cybersecurity of its products are predominantly taken. If that State cannot be determined, the fallback is the EU establishment with the highest number of employees.
This is an organisational fact test, not simply a choice of the most convenient reporting destination.
Map where decisions are made
Identify who approves product-security policy, vulnerability response, remediation priorities, and reportability decisions. Record their legal entities and locations. Distinguish where decisions are made from where operational work or hosting happens.
Document the conclusion, the evidence supporting it, the reviewer, and the date. If the decision structure is distributed, explain why one Member State still predominates or why the employee fallback applies.
Build an entity evidence packet
Start with the legal manufacturer and all relevant Union establishments. For each establishment, record the legal entity, location, employee evidence used for the fallback, and the product-cybersecurity decisions actually taken there. Link organisational charts to decision records rather than relying on labels such as headquarters or security office.
Map recurring decisions: product-security policy, vulnerability acceptance, remediation priority, release approval, reportability, and external security communication. Identify who had authority, the entity through which they acted, and where the decision was predominantly taken.
If evidence points to several Member States, record the conflict and the interpretation selected by the accountable reviewer. Do not choose a routing destination based on language, convenience, or the location of the person currently on call.
Keep the route current
Review the analysis after acquisitions, reorganisations, or changes in product-security authority. Keep the selected coordinating-CSIRT route beside the evidence, not only in an incident-response contact list.
Give the analysis an owner and review event. A corporate reorganisation, transfer of product-security authority, acquisition of a manufacturer, or material staffing change should reopen the facts. Preserve the previous conclusion and effective period so historical reports remain explainable.
During a live case, freeze the version of the analysis used and record any disputed fact. If the route cannot be resolved confidently, escalate the legal question while keeping the Article 14 clock visible.
A manufacturer with no main establishment in the Union uses a separate ordered rule in Article 14(7). Do not reuse this EU-established analysis without checking that cascade.
Continue this workflow with the responsibility chain and the non-EU routing cascade.