BSI
The Federal Office for Information Security is Germany's cybersecurity authority. Under the federal government's draft act, it is to combine four roles for the Cyber Resilience Act. It already performs some of them before the act has been promulgated.
The BSI is the German Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik), Germany's cybersecurity authority. Under the draft German CRA implementation act (CRA-Durchführungsgesetz), it is to become the market surveillance authority, notifying authority, CSIRT and authority for fines for the Cyber Resilience Act.
Definition in the Regulation
The Regulation does not define the term. Regulation (EU) 2024/2847 requires each Member State to designate authorities: market surveillance authorities under Article 52(2), a notifying authority under Article 36(1) and a CSIRT as coordinator under Article 14(7). In Germany, the draft act (Bundestag printed paper 21/6134) assigns all of these tasks to the BSI. It is to become the market surveillance authority and complaints body for consumers (section 65 of the draft BSI Act, BSIG-E), the notifying authority for conformity assessment bodies (section 66) and the authority for fines for infringements under Article 64(2) to (4) (section 70). It also supports small businesses with a regulatory sandbox (section 67). The responsibilities for market surveillance and fines are to enter into force only on 11 December 2027 (Article 4(4) of the draft). The draft has been with the Bundestag's Committee on Internal Affairs (Innenausschuss) since its first reading on 11 June 2026 and had not been promulgated as of 8 October 2026.
What it means for manufacturers
The BSI already performs some tasks: CERT-Bund, within the BSI, has been the coordinating CSIRT for notifications since 11 September 2026, the notification procedure for conformity assessment bodies has been running since 11 June 2026, and since 19 March 2026 the BSI has chaired the European administrative cooperation group of market surveillance authorities (AdCo CRA). With its technical guideline TR-03183, the BSI offers manufacturers voluntary guidance on product requirements, SBOMs and vulnerability reports. The BSI has no power to impose fines until the act is promulgated; in any case, under Article 71(2) the fines under Article 64 apply only from 11 December 2027.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- CERT-Bund
- Market surveillance authority
- German CRA implementation act (CRA-Durchführungsgesetz)
- BSI TR-03183
- Notified body