The CRA in Austria and Switzerland: responsibilities, status, exports to the EU
The Cyber Resilience Act applies directly in Austria, as in every Member State. Switzerland is not in the EU, but its manufacturers are affected in exactly the same way when they export. For both countries, this page sets out what is documented and leaves open what is still open.
In Austria, CERT.at receives notifications under Article 14 as the coordinating CSIRT; ENISA includes it in its list of coordinating CSIRTs (as of 10 September 2026). The notifying authority sits within the Austrian Federal Chancellery (Bundeskanzleramt), the market surveillance authority has not yet been designated, and there is no documented Austrian CRA act. Switzerland is not a Member State, but Swiss manufacturers that supply products with digital elements to the EU are subject to all the manufacturer obligations of the Regulation, including the reporting obligation. On 25 September 2026, the Swiss Federal Council (Bundesrat) commissioned a Swiss cybersecurity act of its own, modelled on the CRA.
Key points
- Austria: notifications go through the ENISA platform to CERT.at and, in parallel, to ENISA. As everywhere, fines only apply from 11 December 2027.
- Austria: notifying authority within the Federal Chancellery, market surveillance authority not yet designated, no documented national CRA act.
- The NISG 2026 has been in force since 1 October 2026. It transposes NIS2 and is something other than the CRA; both reporting obligations can apply side by side.
- Switzerland: anyone who supplies products to the EU is a manufacturer under the CRA. Without an establishment in the EU, the competent CSIRT depends on where the authorised representative, importer or distributor is established (Article 14(7)).
- Switzerland: a stand-alone federal act on cybersecurity has been commissioned; consultation draft due by June 2027.
Who receives CRA notifications in Austria?
CERT.at. ENISA keeps a list of "CSIRTs Designated as Coordinators" for all 27 Member States (as of 10 September 2026; according to secondary sources first published on 4 September 2026); for Austria it lists CERT.at, for Germany CERT-Bund. The Austrian Economic Chambers (Wirtschaftskammer Österreich, WKO) describe the process on their overview page (as of 28 September 2026) as follows: a notification submitted through the ENISA platform is forwarded automatically, in Austria's case to CERT.at and to ENISA. A manufacturer with its main establishment in Austria therefore selects Austria and CERT.at as coordinating CSIRT when registering on the single reporting platform. The platform itself and the notification process are the same in all Member States; the steps are described in ENISA Single Reporting Platform: registration and notification.
A word of caution: a few specialist articles name the Federal Chancellery as the recipient of notifications. That contradicts ENISA's list. What counts is what can be selected when registering on the platform, and that is CERT.at.
Which other authorities are responsible in Austria?
| Task | Austria | Germany, for comparison |
|---|---|---|
| Coordinating CSIRT (Article 14) | CERT.at | CERT-Bund within the BSI |
| Notifying authority | Federal Chancellery | BSI |
| Market surveillance authority | not yet designated | BSI under the bill, not yet promulgated |
| National CRA act | not documented | Bill before the Bundestag's Committee on Internal Affairs |
The Federal Chancellery has its own page on the Cyber Resilience Act and names itself there as the notifying authority, meaning the body that designates conformity assessment bodies for conformity assessment. No decision has yet been taken on market surveillance; the Federal Chancellery states that further responsibilities will be determined in the coming months as part of implementing the Regulation. A research project funded by the Austrian Research Promotion Agency (Österreichische Forschungsförderungsgesellschaft, FFG), "CRA-PRO" (1 October 2025 to 31 March 2027), is to develop processes and responsibilities with the Federal Chancellery as the public-sector partner. An Austrian act implementing the CRA, comparable to the German bill, is not documented in the available sources. For the situation in Germany, see The German CRA implementation act.
What does the NISG 2026 have to do with the CRA?
Not much, but the two are often confused. Austria's Network and Information Systems Security Act 2026 (Netz- und Informationssystemsicherheitsgesetz 2026, NISG 2026) transposes the NIS2 Directive in Austria. It was published in the Federal Law Gazette (Bundesgesetzblatt) on 23 December 2025, has been in force since 1 October 2026 and requires around 4,000 entities to register within three months. NIS2 is aimed at those operating entities, the CRA at manufacturers of products. An Austrian manufacturer that is also an essential or important entity under the NISG 2026 may be subject to both reporting obligations, and one does not satisfy the other. The difference is explained in CRA and NIS2 compared.
Where can Austrian manufacturers find help?
The Austrian Economic Chambers run an overview page on the CRA (as of 28 September 2026). They announce an online workshop "Cyber Resilience Act" on 30 November 2026 and workshops on the NISG 2026 on 12 and 20 October 2026, along with an FAQ on the NISG 2026. As regards fines, the same applies in Austria as everywhere in the EU: under Article 71(2), Article 64 only applies from 11 December 2027, whereas the reporting obligation itself has applied since 11 September 2026.
Does the CRA apply to Swiss manufacturers?
Yes, as soon as they make products with digital elements available on the EU market. The CRA is not tied to where the manufacturer is based, but to placing products on the EU market in the course of a commercial activity. A Swiss machinery manufacturer that supplies a control system with remote maintenance to Germany is a manufacturer within the meaning of the Regulation, with all the obligations under Articles 13 and 14: the requirements of Annex I, conformity assessment, CE marking, support period, reporting obligation. Switzerland itself has no coordinating CSIRT under Article 14, because it is not a Member State.
Which CSIRT does a Swiss manufacturer notify?
Article 14(7) determines the coordinating CSIRT by the Member State of the main establishment, meaning where decisions related to the cybersecurity of the product are predominantly taken. If a Swiss manufacturer has such an establishment in the EU, for example a development company in Germany, that company's Member State is decisive. If there is no establishment in the EU, Article 14(7) determines the CSIRT by the Member State of the authorised representative, failing that of the importer, the distributor or the users. A manufacturer that has appointed an authorised representative under Article 18 therefore notifies the CSIRT in that representative's Member State; the obligation remains with the manufacturer. An authorised representative is a body established in the EU that the manufacturer has mandated in writing to perform specified tasks. Who can act as one and what they may do is covered in Importers, distributors and authorised representatives.
What is Switzerland planning itself?
- 20 August 2025First mandate from the Federal Council; a public consultation was planned for autumn 2026.
- 25 September 2026The Federal Council instructs the Federal Department of Defence, Civil Protection and Sport (DDPS, VBS) to prepare a consultation draft (Vernehmlassungsvorlage) for a stand-alone federal act on cybersecurity by June 2027.
- by June 2027Consultation draft. According to the mandate, its content includes binding requirements for manufacturers, importers and distributors of software and hardware, market surveillance and a ban on selling insecure products, modelled on the CRA.
For exports to the EU, the Swiss act changes nothing: the CRA applies there. The Swiss act would additionally govern the Swiss market. The Swiss tech industry association Swissmem follows the topic with a page on approaching the Cyber Resilience Act strategically (Cyber Resilience Act jetzt strategisch angehen) and a named contact; the page does not mention a guide of its own or any events.
What this means in practice
- Austrian manufacturer: create an account on the ENISA platform, select CERT.at when registering, set up the reporting address and call chain. Waiting for the Federal Chancellery or a national act does not help, because the obligation already applies.
- Swiss manufacturer with an EU establishment: clarify in which Member State cybersecurity decisions are taken. That state determines the coordinating CSIRT.
- Swiss manufacturer without an EU establishment: consider whether to appoint an authorised representative under Article 18, and agree with them who submits the notification through the platform and who can be reached at night. Whoever submits the notification needs to receive it ready to go, otherwise the 24 hours are lost in back-and-forth questions.
- Both: document the time of awareness. The 24-hour deadline runs from awareness, not from receipt of the report, in Vienna just as in Zurich.
Readiness is the same task in all three countries: an address that someone reads, a call chain, a record. CRA Response Center supports manufacturers from Germany, Austria and Switzerland alike: it monitors the reporting address, recognises important reports and alerts the people responsible; the manufacturer or its authorised representative submits the notification to the CSIRT itself.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitFrequently asked questions
Who is responsible for CRA notifications in Austria?
CERT.at, as the coordinating CSIRT under Article 14(7). ENISA includes it in its list of coordinating CSIRTs (as of 10 September 2026). Notifications are submitted through the single reporting platform and go to ENISA in parallel.
Is there an Austrian CRA act?
None is documented in the available sources. The Federal Chancellery names itself as the notifying authority; according to the Federal Chancellery, further responsibilities are to be determined in the coming months. The NISG 2026 is a NIS2 act, not a CRA act.
Does an Austrian manufacturer have to report twice under the NISG 2026 and the CRA?
If it is subject to both sets of rules, yes. NIS2 concerns the entity, the CRA the product. One notification does not satisfy the other; the Regulation does not provide for one to count towards the other.
Does the CRA apply to companies in Switzerland?
For the products they place on the EU market, yes. The CRA is tied to the EU market, not to where a company is based. A Swiss manufacturer then has the same obligations as a German one, including the reporting obligation that has applied since 11 September 2026.
Does a Swiss manufacturer need an authorised representative in the EU?
Without an establishment in the EU, Article 14(7) determines the competent CSIRT by the Member State of the authorised representative, failing that of the importer, the distributor or the users. Appointing an authorised representative is voluntary under Article 18(1); whether one makes sense in an individual case, or is required by other legislation, should be clarified with legal advice.
When will the Swiss cybersecurity act come?
On 25 September 2026, the Federal Council commissioned a consultation draft by June 2027. Public consultation and the parliamentary process follow after that. No date has been set for entry into force.
Where can Swiss manufacturers find information?
Swissmem runs a topic page on the CRA with a named contact. For exports to the EU, the sources from ENISA and the Commission are decisive, because that is where the CRA applies.
Further reading
- CERT-Bund, BSI, ENISAThe roles in receiving a notification, using Germany as the example.
- Importers, distributors and authorised representativesObligations under Articles 18 to 22, important for manufacturers outside the EU.
- CRA and NIS2 comparedProduct or entity, two reporting obligations, neither counting towards the other.
- Who is the manufacturer under the CRA?Agency, client, own brand, importer.
- Swiss Federal Council commissions a cybersecurity act modelled on the CRAConsultation draft by June 2027. For Swiss manufacturers supplying the EU, the CRA already applies.
Sources
- List of CSIRTs Designated as Coordinators, ENISA, as of 10 September 2026.
- Cyber Resilience Act: overview (in German), Austrian Economic Chambers, as of 28 September 2026.
- Cyber Resilience Act (CRA) (in German), Austrian Federal Chancellery, 2026.
- CRA-PRO project (in German), Austrian Research Promotion Agency (FFG), running from 1 October 2025 to 31 March 2027.
- NISG 2026 published in the Federal Law Gazette (in German), FEEI, December 2025.
- NIS2: overview (in German), Austrian Economic Chambers, 2026.
- 24 hours to report: what applies under the CRA from 11 September 2026 (in German), E+H Rechtsanwälte, 10 September 2026.
- Federal Council commissions new cybersecurity act (in German), Netzwoche, 25 September 2026; Federal Council plans new cybersecurity act (in German), Federal Council press release, 25 September 2026.
- Federal Council press release (in German), Swiss Confederation, 20 August 2025.
- Approaching the Cyber Resilience Act strategically now (in German), Swissmem, as of 19 February 2026.
- Cyber Resilience Act 2024/2847, ivibridge.ch, 2026.