Market surveillance
The Regulation is not enforced from Brussels but by national authorities on the market. Their tools range from a request to correct a product to a recall. For manufacturers, the commercial risk of a sales ban is usually greater than the fine.
Market surveillance is the supervision by national authorities of products that are already on the market: they check compliance with the Regulation, request documents, demand corrective action and can have products withdrawn from the market or recalled.
Definition in the Regulation
Market surveillance is governed by Articles 52 to 60 of Regulation (EU) 2024/2847, supplemented by Regulation (EU) 2019/1020. Under Article 53, authorities are granted access to data and documentation upon a reasoned request. Under Article 54, where there is a significant cybersecurity risk, they require corrective action within a reasonable period and, if nothing happens, can prohibit or restrict the product from being made available, or order its withdrawal or recall. Article 57 allows measures even against compliant products that present a significant risk, and Article 58 covers formal non-compliance such as a missing CE marking or declaration of conformity. Under Article 60, authorities carry out coordinated control actions (sweeps) on particular product categories, including inspections of products acquired under a cover identity; ENISA can propose categories for this based on the notifications under Article 14. Under Article 71(2), these provisions apply from 11 December 2027.
What it means for manufacturers
Under Article 13(21), manufacturers must themselves take corrective measures, up to and including withdrawal, if a product does not comply, and under Article 13(22) they must cooperate with the authorities and provide information. In supervising the reporting obligation, market surveillance authorities, CSIRTs and ENISA work together (Article 52(4)); data protection authorities can request CRA documentation (Article 52(7)). In Germany, the BSI is to become the central market surveillance authority, with a complaints body for consumers, from 11 December 2027 according to the draft legislation; as of 8 October 2026 the bill had not been promulgated. The instruments are the same as in product safety law: a request to correct, a sales ban, a recall. If you keep a complete log of awareness times, notifications and user information, you have the evidence ready when an inspection comes.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit