Cyber Resilience Act Response Center Request a demoDemo

News Updated

Swiss Federal Council commissions a cybersecurity act modelled on the CRA

On 25 September 2026, the Swiss Federal Council instructed the DDPS to prepare a consultation draft for a federal cybersecurity act by June 2027, based on the EU Cyber Resilience Act. Manufacturers who supply the EU from Switzerland do not need to wait: the EU Regulation already applies to them.

On 25 September 2026, the Swiss Federal Council instructed the Federal Department of Defence, Civil Protection and Sport (DDPS) to draw up, by June 2027, a consultation draft for a stand-alone federal cybersecurity act (Bundesgesetz über die Cybersicherheit). This is stated in the Federal Council's press release of the same day. The act is to set binding requirements for manufacturers, importers and distributors of software and hardware, introduce market surveillance and make it possible to ban the sale of insecure products. The mandate names the EU Cyber Resilience Act as its model. An earlier mandate of 20 August 2025 had envisaged a consultation by autumn 2026; that timetable has now been superseded. The consultation (Vernehmlassung) is the stage at which the cantons, political parties and associations comment on a draft before it goes to parliament. The mandate does not give a date for entry into force.

What it means for manufacturers

For manufacturers who sell only in Switzerland, nothing changes for now; according to the timetable, at least the consultation and the parliamentary debate will have to take place before there is a Swiss act. It is different for manufacturers who supply their products to the EU. Regulation (EU) 2024/2847 applies to them regardless of where the manufacturer is based, because it is triggered by placing on the market in the EU, not by the location of the establishment. A machine builder from the canton of Zürich that sells a controller with software to a customer in Baden-Württemberg is a manufacturer within the meaning of the Regulation. In concrete terms:

  • The reporting obligation has applied since 11 September 2026. Article 14 requires manufacturers to report actively exploited vulnerabilities and severe incidents via ENISA's reporting platform, with an early warning within 24 hours and a vulnerability notification within 72 hours of becoming aware. Switzerland is not a Member State and has no coordinating CSIRT. Under Article 14(7), the recipient depends on the Member State of the main establishment. Where there is no main establishment in the EU, that paragraph points, in this order, to the Member State of the authorised representative, the importer, the distributor or the users.
  • An authorised representative in the EU. An authorised representative is a person or company established in the EU whom the manufacturer has appointed in writing to perform certain tasks on its behalf, such as keeping the technical documentation available and cooperating with authorities. Article 18 sets out which tasks can be delegated. Responsibility for the product remains with the manufacturer.
  • Importers and distributors in the EU have obligations of their own. Whoever brings the Swiss product into the EU is an importer under Article 19 and must inform the manufacturer of any vulnerabilities they become aware of. The roles are explained in the guide Importers, distributors and authorised representatives.
  • The remaining manufacturer obligations follow from 11 December 2027. Under Article 71(2), the requirements of Annex I, conformity assessment and the fines regime then apply as well, to Swiss manufacturers just as to manufacturers in the EU.

A Swiss act modelled on the CRA would later introduce these obligations for the home market too. If you build a reporting process for the EU today, you will already have it in place by then. The responsibilities that apply in Austria and Switzerland are summarised in the guide The CRA in Austria and Switzerland; who counts as a manufacturer is covered in the guide Who is the manufacturer under the CRA?.

For your readiness, this means: a Swiss manufacturer with EU customers needs the same reporting address, call chain and deadline tracking today as a German one. CRA Response Center works the same way for manufacturers in Germany, Austria and Switzerland; the notification to the platform is submitted by the manufacturer itself.

What remains open

The press release does not say how closely the Swiss act will follow the CRA; it names the CRA only as a point of reference. It is also open whether it will adopt the same deadlines and the same reporting structure, and whether there will be mutual recognition with the EU. The order of authorised representative, importer, distributor and users is set out in Article 14(7); we have not found anything in ENISA's documentation on how the reporting platform handles this case during registration.

Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Sources

The reporting obligation already applies. Who answers at night at your company?

CRA Response Center monitors your security mailbox, recognises important reports using AI hosted in Germany (your e-mails never go to OpenAI, Anthropic or Google) and alerts your people by SMS and e-mail. EUR 190 per month including VAT. Try it free for 30 days.

Try it free for 30 days