Cyber Resilience Act Response Center Request a demoDemo

News Updated

Germany's CRA implementation act is stuck in the Committee on Internal Affairs

The Bundestag held the first reading of the draft German CRA implementation act on 11 June 2026 and referred it to the Committee on Internal Affairs. The Bundesrat raised no objections. Nothing further has been documented since. The act is not on the agenda of the plenary sittings of 7 to 9 October 2026.

The Act implementing Regulation (EU) 2024/2847 (Gesetz zur Durchführung der Verordnung (EU) 2024/2847) is intended to set out which German authority takes on which task under the Cyber Resilience Act. The federal government's draft is before the Bundestag, the German federal parliament, as printed paper 21/6134 of 26 May 2026. The first reading took place on 11 June 2026, and since then the Bundestag's Committee on Internal Affairs (Innenausschuss) has been the lead committee. At its sitting on 12 June 2026, the Bundesrat, which represents the federal states, raised no objections; the federal government informed the Bundestag of this in printed paper 21/6512 of 15 June 2026. After that, the trail goes cold: as of 7 October 2026, there is no record anywhere of a hearing, a committee recommendation or a second and third reading. The Bundestag's agenda for the plenary sittings of 7 to 9 October 2026 (as of 6 October 2026) contains no item on the Cyber Resilience Regulation. The Committee on Internal Affairs' public hearing on 5 October 2026 concerned a different bill, the Act to Strengthen Cybersecurity (Gesetz zur Stärkung der Cybersicherheit, printed paper 21/6585).

On 25 September 2026, the BSI itself wrote that its procedures were running "ahead of the publication of the CRA implementation act, which is currently in the legislative process" (our translation).

What it means for manufacturers

Manufacturers' obligations do not depend on the German act. The Regulation applies directly in every Member State; the reporting obligation under Article 14 has applied since 11 September 2026, with or without an implementation act. The German act deals with the authorities' side. As long as it is missing, the following is missing too:

  • The legal basis for the BSI's role. The draft makes the German Federal Office for Information Security (BSI) the central market surveillance authority, the notifying authority for conformity assessment bodies, the CSIRT under the Regulation and the authority responsible for fines (new sections 65 to 70 of the BSI Act, BSIG). In practice, the BSI already performs several of these roles: it has been accepting applications for notification since 11 June 2026, CERT-Bund is on ENISA's list of coordinating CSIRTs, and since March 2026 the BSI has chaired the European administrative cooperation group of market surveillance authorities. These tasks have not yet been anchored in law, however.
  • An authority to impose fines. The fines regime of Article 64 of the Regulation only applies from 11 December 2027 in any case. Who applies it in Germany will only be determined by the implementation act. The draft names the BSI and declares the Act on Regulatory Offences (Ordnungswidrigkeitengesetz) applicable. More on this in our article Fines under the CRA only apply from 11 December 2027.
  • The complaints office and the regulatory sandbox. The draft provides for a complaints office for consumers at the BSI and a regulatory sandbox for cyber resilience (Reallabor für Cyberresilienz). Neither will exist until the act is passed.
  • Planning certainty for conformity assessment bodies. In Germany, becoming a notified body is a two-stage process: accreditation by DAkkS, the national accreditation body, and notification by the BSI. On 25 September 2026, the two bodies extended their cooperation to cover the CRA. Industry associations criticise the accreditation requirement as a national special rule; whether the Bundestag will change it is open.

For manufacturers, the wait does not change the order of priorities: reporting address, call chain, access to the ENISA platform and record-keeping must be in place, because the deadlines of the Regulation are running. What the act is intended to cover in detail is set out in the guide The German CRA implementation act: status, content and the role of the BSI; responsibilities for fines and market surveillance are explained in the guide Fines and market surveillance under the CRA.

For your readiness, this means: the recipient of notifications is settled (CERT-Bund via the ENISA platform), even though its role in Germany is not yet laid down in law. CRA Response Center sets up your reporting channels on this basis and will adjust them as soon as the act is promulgated.

What remains open

We could not establish whether the Committee on Internal Affairs has internally scheduled a hearing or its final deliberation. The associations' criticism of individual points (the accreditation requirement, the lack of suspensive effect for objections and court actions, funding) may still lead to changes in committee. There is no date for promulgation. We will update this article when the situation changes.

Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Sources

The reporting obligation already applies. Who answers at night at your company?

CRA Response Center monitors your security mailbox, recognises important reports using AI hosted in Germany (your e-mails never go to OpenAI, Anthropic or Google) and alerts your people by SMS and e-mail. EUR 190 per month including VAT. Try it free for 30 days.

Try it free for 30 days