Germany's CRA Implementation Act and the Role of the BSI
The Cyber Resilience Act (Regulation (EU) 2024/2847), or CRA, applies directly in every EU Member State. Each Member State still decides which national authorities enforce it. This article uses Germany as an example for manufacturers that sell products with digital elements into the German market. Germany's draft CRA implementation act names the Federal Office for Information Security (BSI), Germany's national cybersecurity authority, as the central authority for the CRA.
Status of this article: It reflects the legislative procedure as of June 2026. On June 11, 2026, the Bundestag, the German federal parliament, holds the first reading of the federal government's draft (Bundestag printed paper 21/6134, in German). The CRA dates in this article are those of the regulation.
Update of October 13, 2026: The first reading took place as planned on June 11, 2026. The Bundestag referred the draft to its committees, with the Committee on Internal Affairs in the lead. On June 12, 2026, the Bundesrat, the body through which the German states take part in federal legislation, decided not to raise any objections (Bundestag printed paper 21/6512, in German). So far, the Bundestag's documentation and information system (DIP) lists no further steps in the procedure, and the act has not yet been promulgated in the Federal Law Gazette.
Contents
What is Germany's CRA implementation act?
The CRA implementation act is a national law that makes the directly applicable CRA enforceable in Germany. It mainly amends the BSI Act (BSI-Gesetz), the law that sets out the tasks and powers of the BSI. It names the BSI as market surveillance authority and notifying authority. It creates no cybersecurity obligations of its own for manufacturers. These follow directly from the regulation.
This point is often overlooked. According to the draft, the compliance costs that the implementation act itself creates for businesses and citizens are zero. The obligations for secure product development, vulnerability handling, CE marking, and reporting apply anyway, because the regulation is directly applicable. The act only answers one question: which German authority manufacturers, notified bodies, and consumers deal with.
Which roles does the BSI take on?
Article 1 of the draft assigns four functions under the CRA to the BSI:
- Market surveillance authority: The BSI monitors whether products with digital elements conform to the CRA, in particular to the essential cybersecurity requirements in Annex I.
- Notifying authority: The BSI assesses and notifies conformity assessment bodies. The assessment itself is in principle carried out by the national accreditation body under Regulation (EC) No 765/2008. In Germany, this is the DAkkS, the German national accreditation body.
- CSIRT coordinator and reporting point: As Germany's computer security incident response team (CSIRT) designated as coordinator, the BSI receives notifications of actively exploited vulnerabilities and severe incidents. Manufacturers must submit these under Article 14 of the CRA. The draft expects around 2,000 notifications per year.
- Support for economic operators: The BSI offers awareness and training programs. It also runs a cyber resilience regulatory sandbox, a controlled testing environment in which manufacturers can test innovative products before placing them on the market.
One limitation matters in practice. A product may fall under the CRA and at the same time be a high-risk AI system under the AI Act (Regulation (EU) 2024/1689). In that case, Article 52(14) of the CRA makes the market surveillance authority designated for the AI Act responsible. In Germany, this is expected to be the Federal Network Agency (BNetzA). For these products, market surveillance does not lie with the BSI.
Which dates apply?
The draft brings the act into force in three stages that follow the CRA:
| Date | What enters into force |
|---|---|
| June 11, 2026 | Provisions on notification, so that notified bodies can be accredited in time |
| September 11, 2026 | The BSI, as CSIRT, becomes the reporting point for vulnerabilities and incidents |
| December 11, 2027 | The rest of the act, at the same time as the substantive CRA requirements become fully applicable |
For manufacturers, the middle date is the most tangible. Since September 11, 2026, manufacturers must report actively exploited vulnerabilities and severe incidents via the single reporting platform. If your main establishment in the EU is in Germany, the notification goes from there to the BSI as the CSIRT designated as coordinator. It also goes to ENISA, the EU Agency for Cybersecurity. Article 14(7) of the CRA determines which Member State's CSIRT is competent for you.
This is the first CRA obligation with direct organizational consequences. It requires working internal processes to detect, assess, and report on time. Our article on the CRA reporting process describes these steps.
What does this mean for manufacturers?
Take a manufacturer that places a connected machine controller with remote maintenance access on the German market. With the implementation act, it now has clear points of contact: the BSI handles market surveillance, vulnerability notifications, and support programs.
Does this change the actual requirements? No. You must still demonstrate a secure product development process, handle vulnerabilities over the support period, and document conformity. These obligations exist independently of the national law. The implementation act only makes visible to whom you report in Germany and who enforces the obligations there.
Two points deserve a closer look:
- Reporting process: If you have not set up a reliable internal chain from detecting a vulnerability to reporting it on time, you risk missing deadlines when a vulnerability is actively exploited.
- Conformity assessment: Germany's National Regulatory Control Council (Nationaler Normenkontrollrat) is an independent body that reviews the compliance costs of federal draft legislation. It welcomes concentrating the tasks at the BSI. It explicitly points out that success depends on sufficient staff capacity at the conformity assessment bodies. Important and critical products under Annexes III and IV may require third-party assessment. For them, a shortage of notified bodies can become a market access risk. If you depend on an external assessment, you should plan early for the availability of notified bodies.
What happens next in the legislative procedure?
As of June 2026, the draft goes to the Bundestag's committees after the first reading, with the Committee on Internal Affairs in the lead. Changes are possible in the further procedure, but the basic structure of authorities is unlikely to change much.
With the draft, the question of which authority is responsible in Germany is largely settled. The operational preparation for reporting and conformity assessment remains the manufacturer's task.
The chain up to the notification remains your task
Since September 11, 2026, manufacturers submit their notifications via the single reporting platform. From there, they go to the competent CSIRT and to ENISA. The templates cover what happens before that: who receives the report, who assesses it, who approves the notification, and who tracks the deadline.
