Cyber Resilience Act Response Center Request a demoDemo

Guide Last updated 15 min read

The German CRA implementation act: status, content and the role of the BSI

The Regulation applies directly, but Germany has to designate its own market surveillance authority, fining authority and complaints body. The bill to do this has been with the Bundestag's Committee on Internal Affairs since June 2026. This page records where it stands and explains what the bill provides.

As of 8 October 2026, the German CRA implementation act (CRA-Durchführungsgesetz) has not been promulgated. The Bundestag, Germany's federal parliament, debated the bill (Bundestag printed paper 21/6134) at first reading on 11 June 2026 and referred it to its Committee on Internal Affairs (Innenausschuss); no date has been set for a hearing or a second reading. The bill makes the German Federal Office for Information Security (BSI) the central market surveillance authority, the notifying authority, the CSIRT and the fining authority for the Cyber Resilience Act. The act does not change manufacturers' obligations: these come directly from Regulation (EU) 2024/2847 and apply regardless of whether Germany has designated its authorities yet.

Key points

  • The bill (Bundestag printed paper 21/6134) has been with the Committee on Internal Affairs since 11 June 2026 and has not been promulgated. No date for further deliberation is known.
  • Under the bill, the BSI becomes market surveillance authority, notifying authority, CSIRT and fining authority, all four roles in one body (sections 65 to 70 of the draft BSI Act, BSIG-E).
  • The reporting obligation under Article 14 has applied since 11 September 2026 regardless. CERT-Bund at the BSI is already receiving notifications.
  • Under Article 71(2), the fines set out in Article 64 apply only from 11 December 2027.
  • Industry associations criticise the budget reservation and the accreditation requirement for testing bodies. The rule in the ministerial draft that objections and court actions would have no suspensive effect is no longer in the government bill.

Status on 8 October 2026

After its first reading, the bill is with the Bundestag's Committee on Internal Affairs, which leads on it. Neither the plenary agendas for the sittings of 7 to 9 October 2026 nor the agenda of the committee's 45th meeting on 7 October 2026 list it. The committee's public hearing on 5 October 2026 concerned a different law, a bill to strengthen cybersecurity (Bundestag printed paper 21/6585). On 25 September 2026 the BSI itself wrote that its procedures were going ahead before the CRA implementation act had been published. There is no record anywhere of promulgation in the Federal Law Gazette (Bundesgesetzblatt).

Why does an EU regulation need a German act at all?

A regulation applies directly in every Member State, without being transposed into national law. Manufacturers' obligations under Article 13 and Article 14 therefore need no German act. What the Regulation does leave to the Member States is how supervision is organised: which authority carries out market surveillance, which notifies testing bodies, which imposes fines, and under which procedure. That is exactly what the implementation act covers. To do so it amends the BSI Act (BSIG) and inserts new sections into it, together with minor amendments to the Telecommunications Act and the Energy Industry Act.

As long as the act is missing, Germany has no formally designated market surveillance authority for the CRA and no fining authority. For manufacturers this changes little: they still have to notify, and the deadline still runs. Under the bill, the provisions on market surveillance and fines (sections 65, 69 and 70 BSIG-E) enter into force only on 11 December 2027 (Article 4(4) of the bill), even if the act is promulgated earlier. The explanatory memorandum points to the Regulation's dates: notification of conformity assessment bodies from 11 June 2026, the reporting obligation from 11 September 2026, everything else from 11 December 2027 (Article 71(2)).

How has the procedure gone so far?

  1. 12 March 2026Ministerial draft from the Federal Ministry of the Interior: a bill implementing Regulation (EU) 2024/2847 (Entwurf eines Gesetzes zur Durchführung der Verordnung (EU) 2024/2847 (Cyberresilienz-Verordnung)).
  2. April 2026Industry associations comment on the ministerial draft: ZVEI (2 April), BDI (9 April), TeleTrusT (reported on 10 April).
  3. 1 May 2026Following the cabinet decision of 29 April 2026, the bill goes to the Bundesrat, the chamber representing the federal states, as Bundesrat printed paper 260/26 (first round).
  4. 26 May 2026The bill is introduced in the Bundestag as printed paper 21/6134.
  5. 11 June 2026First reading in the Bundestag, referral to the Committee on Internal Affairs as lead committee.
  6. 12 June 2026At its 1066th session, the Bundesrat raises no objections (Bundesrat printed paper 260/26(B)).
  7. 15 June 2026The Bundestag is informed of the Bundesrat's opinion (Bundestag printed paper 21/6512); the Bundestag's news service reports on it on 17 June 2026.
  8. 11 September 2026The reporting obligation under Article 14 applies. The ENISA platform goes live without the German act having been promulgated.
  9. OpenHearing in the Committee on Internal Affairs, second and third readings, second round in the Bundesrat, promulgation.

What does the bill provide?

At its core are the new sections 65 to 70 BSIG-E. They concentrate supervision at the BSI. The main points:

TaskResponsible body under the billProvision
Market surveillance of products with digital elementsBSI as central market surveillance authority, in cooperation with the market surveillance authorities of the federal statesSection 65 BSIG-E
Complaints body for consumersBSISection 65(3) BSIG-E
Notification of conformity assessment bodiesBSI as notifying authority, with prior accreditation by DAkkS, Germany's national accreditation bodySection 66 BSIG-E
Regulatory sandbox for cyber resilienceBSISection 67 BSIG-E
CSIRT under Article 14 (receiving notifications)BSI, operationally CERT-BundSection 5(3), point 6 BSIG-E
Fining authorityBSI for infringements under Article 64(2) to (4); the Federal Ministry of the Interior only for one offence under the BSI Act (section 68(2), point 11)Section 70 BSIG-E
Procedure for finesAct on Regulatory Offences (OWiG) applies accordingly, except sections 17 and 30 OWiGSection 69 BSIG-E

BSI as market surveillance authority, notifying authority, CSIRT and fining authority

Four roles in one authority: the BSI carries out market surveillance, designates the bodies allowed to carry out conformity assessments, receives notifications under Article 14 as CSIRT and imposes fines. The bill gives the Federal Network Agency (Bundesnetzagentur) no market surveillance role for the CRA; it remains responsible for the sector catalogues under the Telecommunications Act and the Energy Industry Act. The explanatory memorandum mentions it for products that are also high-risk AI systems, because under Article 52(14) of the Regulation the market surveillance authority designated under the AI Act is responsible for those. The Federal Ministry of the Interior is the fining authority only for one offence under the BSI Act (section 70(1), point 1 BSIG-E), not for Article 64.

Regulatory sandbox

Section 67 BSIG-E provides for a regulatory sandbox for cyber resilience (Reallabor). A regulatory sandbox is a protected setting in which manufacturers can try out new products and processes together with the authority. Most of the one-off EUR 10 million set aside goes to the sandbox. The bill leaves open how manufacturers take part and what exactly is tested there.

Fines and procedure

The bill does not itself set the level of fines; they are in Article 64 of the Regulation: up to EUR 15 million or 2.5 per cent of worldwide annual turnover for infringements of the essential cybersecurity requirements and the manufacturer obligations, up to EUR 10 million or 2 per cent for other obligations, and up to EUR 5 million or 1 per cent for supplying incorrect information to authorities. Section 69 BSIG-E declares the Act on Regulatory Offences applicable accordingly, but excludes section 17 (calculating the fine) and section 30 (fines against legal persons), because EU sanctions law takes precedence. Under section 70(2), no fines are imposed on public bodies. The ministerial draft of 12 March 2026 provided in section 65(4) that objections and court actions against market surveillance decisions would have no suspensive effect; the government bill no longer contains this paragraph and its explanatory memorandum refers to the general rules of the Code of Administrative Court Procedure (Verwaltungsgerichtsordnung, VwGO), under which the BSI can order immediate enforcement in individual cases. For manufacturers this means: an objection or an action for annulment against an order by the BSI, such as a recall, initially has suspensive effect (section 80(1) VwGO). If the BSI orders immediate enforcement, it must give written reasons for the particular interest in doing so (section 80(3) VwGO), and the administrative court can restore the suspensive effect on application (section 80(5) VwGO). An objection must be lodged before a court action; the BSI decides on it itself, because the next higher authority, the Federal Ministry of the Interior, is a supreme federal authority (section 68(1) and section 73(1) VwGO). Fining decisions are not governed by the VwGO but by the procedure under the OWiG. All of this applies to the government bill; the committee may reinstate the rule from the ministerial draft.

Staff and money

The bill expects 141 additional posts at the BSI by 2029, a one-off EUR 10 million and ongoing non-staff costs of EUR 8.1 million. Compliance costs for the administration come to around EUR 20.5 million a year. For business, the bill identifies no additional burden, because all the obligations derive from the EU Regulation. EUR 1.28 million a year is earmarked for training small and medium-sized enterprises.

What do industry associations criticise?

  • Budget reservation. TeleTrusT, the German IT security association, objects that the posts and funds are subject to a budget reservation and considers EUR 1.28 million a year for SME training too little. It also criticises section 66(3), under which the BSI may notify testing bodies without accreditation where this is in the public interest.
  • Accreditation requirement. Bitkom, the German digital industry association, rejects the requirement for DAkkS accreditation before notification as a national special rule and warns of bottlenecks at testing bodies as long as DAkkS's funding is not secured.
  • No suspensive effect. Bitkom criticised the ministerial draft because, under its section 65(4), objections and court actions against market surveillance decisions were not to have suspensive effect. The government bill no longer contains this rule.
  • Pace. In its statement of 9 April 2026, the BDI, the Federation of German Industries, urges that the act be pushed through without delay. ZVEI, the electrical and digital industry association, published a position paper on the ministerial draft in early April 2026 (dated 31 March 2026).

In Bundestag printed paper 21/7731 of 26 August 2026, the federal government considers the structures to be adequate, but acknowledges that DAkkS is undergoing a reform process.

What applies even though the act is missing?

More than the state of the legislative procedure might suggest. The Regulation does not wait for Berlin.

  • The reporting obligation is running. Since 11 September 2026, Article 14 has required manufacturers to notify actively exploited vulnerabilities and severe incidents within 24 hours. ENISA lists CERT-Bund as Germany's coordinating CSIRT (as of 10 September 2026). When registering, a German manufacturer selects Germany and CERT-Bund. More in CERT-Bund, BSI, ENISA: who receives CRA notifications.
  • Notification of testing bodies is running. The BSI started its notification procedure for testing bodies on 11 June 2026, and DAkkS has been accepting applications for accreditation since 28 July 2026. On 25 September 2026, the two authorities extended their administrative agreement to cover the CRA.
  • The BSI is active at European level. Since 19 March 2026, the BSI has chaired the administrative cooperation group of market surveillance authorities (ADCO CRA).
  • No fines yet. Under Article 71(2), Article 64 is among the provisions that apply only from 11 December 2027. Until then Germany will also have no fining authority: the bill has section 70 BSIG-E enter into force only on 11 December 2027. The provisions on market surveillance (Articles 52 to 60) also apply only from 11 December 2027; the evidence an authority can then demand, however, is being created now. Details in Fines and market surveillance under the CRA.

Other Member States are further ahead: Hungary has already adopted a national implementation act, Act CXXXV of 2025.

What this means in practice

For the management of a manufacturer, the state of the procedure has three consequences. First, there is no reason to wait. The reporting obligation applies, the platform is running and CERT-Bund is accepting notifications. A manufacturer of packaging machinery that waits for the German act before setting up a reporting address and a call chain has been subject to the obligation since 11 September 2026 and is not meeting it. Second, a manufacturer that meets the reporting deadlines today and documents that it does so has nothing to fear from later market surveillance. The evidence an authority can demand from 2027 onwards is being created now. Third, manufacturers of important or critical products should keep an eye on the status of notified bodies, because without a testing body there is no third-party assessment.

CRA Response Center provides the tool for this readiness: it monitors the security mailbox, recognises important reports, notifies the people responsible and keeps a history that later serves as evidence. The decision and the submission remain with the manufacturer.

Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Frequently asked questions

Do I have to notify even though the German act is not yet in force?

Yes. The reporting obligation is in Article 14 of the Regulation and has applied directly since 11 September 2026. The German act only organises the authorities. CERT-Bund at the BSI is already receiving notifications via the ENISA platform.

When will the implementation act come?

That is open. The bill has been with the Committee on Internal Affairs since 11 June 2026, and as of 8 October 2026 no date for a hearing or second reading is known. This page will be updated as soon as the situation changes.

Who is the market surveillance authority for the CRA in Germany?

Under the bill, the BSI as central market surveillance authority, in cooperation with the market surveillance authorities of the federal states. Formally, however, the BSI only takes on this role when these provisions enter into force on 11 December 2027, even if the act is promulgated earlier (Article 4(4) of the bill).

Can fines be imposed already?

No. Under Article 71(2), Article 64 applies only from 11 December 2027, and under the bill the fining authority is also only to exist from that date (Article 4(4) of the bill). The reporting deadlines apply regardless, however, and compliance with them will have to be demonstrated later.

What is the regulatory sandbox for cyber resilience?

Section 67 BSIG-E provides for a regulatory sandbox at the BSI in which manufacturers can try out products and processes in a protected setting. Most of the one-off EUR 10 million is earmarked for it. The bill does not set out participation and procedure in detail.

Does the Federal Network Agency get a role?

Not in market surveillance for the CRA. It remains responsible for the sector catalogues under the Telecommunications Act and the Energy Industry Act; the explanatory memorandum mentions it for products that are also high-risk AI systems (Article 52(14) of the Regulation).

Does the act create additional work for manufacturers?

Not according to the bill. All of the manufacturers' obligations come from the EU Regulation; the act only allocates tasks between authorities. The effort required by the Regulation itself is unaffected.

Further reading

Sources

The reporting obligation already applies. Who answers at night at your company?

CRA Response Center monitors your security mailbox, recognises important reports using AI hosted in Germany (your e-mails never go to OpenAI, Anthropic or Google) and alerts your people by SMS and e-mail. EUR 190 per month including VAT. Try it free for 30 days.

Try it free for 30 days