German CRA implementation act (CRA-Durchführungsgesetz)
The Regulation applies directly, but each Member State must designate its own market surveillance authority, authority for fines and complaints body. In Germany, the draft CRA implementation act does this.
The German CRA implementation act (CRA-Durchführungsgesetz) is the German act implementing Regulation (EU) 2024/2847. It mainly sets out the responsibilities of the BSI and amends the BSI Act (BSIG). As of 7 October 2026, it had not yet been promulgated.
Definition in the Regulation
The Regulation itself does not mention the act; it only requires Member States to designate market surveillance authorities and notifying authorities and to lay down penalties. Germany is doing this through the draft act implementing Regulation (EU) 2024/2847 (Entwurf eines Gesetzes zur Durchführung der Verordnung (EU) 2024/2847): ministerial draft of the Federal Ministry of the Interior (BMI) of 12 March 2026, government bill as Bundestag printed paper 21/6134 of 26 May 2026, first reading on 11 June 2026 with referral to the Bundestag's Committee on Internal Affairs (Innenausschuss). The Bundesrat raised no objections on 12 June 2026. There is no record of a hearing, a second and third reading or promulgation in the Federal Law Gazette.
The draft makes the BSI the central market surveillance authority, the notifying authority, the CSIRT under Article 14 and the authority for fines. It sets up a complaints body for consumers and a regulatory sandbox for cyber resilience, and amends the BSI Act, the Telecommunications Act and the Energy Industry Act.
What it means for manufacturers
The act does not change the obligations; they come directly from the Regulation and apply regardless of whether Germany has formally designated its authorities yet. The reporting obligation has applied since 11 September 2026, and CERT-Bund within the BSI receives notifications as the coordinating CSIRT. Germany will have an authority for fines only from 11 December 2027: under the draft, the provisions on market surveillance and fines (sections 65, 69 and 70 of the draft BSI Act, BSIG-E) enter into force only on 11 December 2027 (Article 4(4) of the draft), even if the act is promulgated earlier. This coincides with the fines under Article 64, which also apply only from that date.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit