Sign in

Medium New document EU Action required

Bundestag adopts CRA implementation law – BSI becomes supervisory authority

Original title: CRA Durchführungsgesetz

Published
Source: bsi.bund.de
Effective
Not stated
Deadline
Not stated
Framework: CRA
Regulation (EU) 2024/2847 (as corrected October 2025) source
in 137 days
EHDS amendments to CRA Articles 13, 31 and 32 apply source

Why it matters

The German Bundestag has adopted the implementation law for the Cyber Resilience Act (CRA), establishing the national legal framework for mandatory cybersecurity requirements for products with digital elements from December 2027 onwards. The Federal Office for Information Security (BSI) is designated as the competent authority and receives expanded powers for market surveillance, notification of conformity assessment bodies, and enforcement of sanctions. Manufacturers must now mandatorily consider cybersecurity throughout the entire product lifecycle from development onwards.

What changed

  • The CE marking is extended from December 2027 to include cybersecurity requirements and now applies to products with digital elements
  • The BSI is established as a market surveillance authority and can inspect IT products for cybersecurity, require improvements, and impose penalties and fines for violations
  • The BSI gains the authority to remove products with digital elements from the market if they fail to meet CRA requirements
  • The BSI becomes a notifying body and confirms the competence of conformity assessment bodies that assist manufacturers in verifying their products
  • The BSI coordinates CRA notifications for Germany from 11 September 2026 onwards as the competent CSIRT and serves as a complaint body for consumers

Who is affected

All manufacturers of products with digital elements (from smart home devices to mobile apps and security chips), particularly small and medium-sized enterprises; consumers in Germany and the EU

What to do

The regulation requires manufacturers to mandatorily consider cybersecurity requirements throughout the entire product lifecycle starting from development.

Open the official document

AI-assisted summary of the official document; the official text prevails. Not legal advice.

More changes in CRA