Market surveillance authority
The Regulation sets out the obligations, and a national authority enforces them. It may request documents, demand corrections, take products off the market and impose fines. For Germany, the draft legislation assigns this role to the BSI.
A market surveillance authority is the national authority that checks whether products with digital elements comply with the Cyber Resilience Act, orders corrective measures and imposes fines. In Germany, the BSI is to take on this task.
Definition in the Regulation
Under Article 52(2) of Regulation (EU) 2024/2847, each Member State designates one or more market surveillance authorities; Regulation (EU) 2019/1020 on market surveillance applies (Article 52(1)). The powers are set out in Articles 53 to 60: access to data and documentation upon a reasoned request (Article 53), and a requirement to take corrective measures, up to withdrawal and recall, where there is a significant cybersecurity risk (Article 54). In addition, there are measures for formal non-compliance, such as a missing CE marking or missing documentation (Article 58), and coordinated control actions including purchases under a cover identity (Article 60). In supervising the reporting obligation, the authority works with the CSIRTs and ENISA (Article 52(4)). Article 64 sets the range of fines; whether the authority imposes a fine itself or a court does depends on the law of the Member State (Article 64(8)). Supplying incorrect information to the authority is a separate offence under Article 64(4).
What it means for manufacturers
In Germany, the draft CRA implementation act (CRA-Durchführungsgesetz) assigns market surveillance to the BSI (section 65 of the draft BSI Act, BSIG-E), working with the authorities of the federal states, from 11 December 2027 according to the draft (Article 4(4) of the draft); as of 8 October 2026 the act had not been promulgated. In Austria, market surveillance has not yet been assigned. Under Article 13(22), manufacturers must provide the authority with information on request and cooperate with it. That is why a log is worth keeping that shows who became aware of what and when, and when the notification was made. Under Article 71(2), the market surveillance provisions apply from 11 December 2027, as does the framework for fines.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit