Cyber Resilience Act Response Center Try it freeTry it

News

CRA implementation in the Member States: three done, most still pending

The reporting obligation under Article 14 has applied in every Member State since 11 September 2026. The national rules on authorities and penalties are another matter. A review of all 27 Member States in mid-October 2026 shows three with national rules adopted, several bills in parliament and a long list of countries with no published draft.

The Cyber Resilience Act is a regulation: it applies directly, and manufacturers' obligations do not depend on any national act. What it leaves to the Member States is the authorities' side. Each must designate a notifying authority for conformity assessment bodies (Article 36), market surveillance authorities (Article 52) and a coordinating CSIRT for notifications (Article 14(7)), and lay down rules on penalties (Article 64). On 19 October 2026 we checked the status in all 27 Member States, as far as possible against official gazettes, parliamentary records and authority websites. The European Commission's register of notifying authorities for the CRA listed 15 Member States on 19 October 2026: Belgium, Croatia, Cyprus, Estonia, Finland, France, Germany, Hungary, Ireland, Lithuania, Malta, the Netherlands, Poland, Slovakia and Sweden. An entry shows that a Member State has reported an authority to the Commission, not that its national law is complete: Germany and France are listed although neither has promulgated its act.

StatusMember StateDetails
AdoptedFinlandAct 439/2026, in force since 1 June 2026. Traficom is market surveillance authority and notifying authority and imposes administrative fines.
AdoptedHungaryAct CXXXV of 2025, promulgated on 29 December 2025. The Supervisory Authority for Regulatory Affairs (SZTFH) is notifying authority and market surveillance authority.
AdoptedMaltaCyber Resilience Regulations, 2026 (Legal Notice 238 of 2026), published on 11 September 2026. The Malta Digital Innovation Authority is listed as notifying authority; according to a law firm summary it is also market surveillance authority.
Adopted, not promulgatedGermanyAdopted by the Bundestag on 15 October 2026; second passage in the Bundesrat outstanding. The BSI takes on all roles.
In parliamentNetherlandsBill 36 875, passed by the House of Representatives on 10 September 2026, now in written preparation in the Senate.
In parliamentFrancePart of a broader EU adaptation bill, passed by the Senate on 18 February 2026, in committee in the National Assembly since February. ANFR for market surveillance, ANSSI as notifying authority.
In parliamentSlovakiaGovernment bill (print 1450), submitted on 27 August 2026, committee stage until 16 November 2026.
Government draftItalyDraft legislative decree, approved in preliminary review by the Council of Ministers on 2 October 2026. ACN for both roles, with support from the Guardia di Finanza.
Government draftDenmarkPublic consultation from 5 October to 2 November 2026, planned entry into force 1 March 2027.
Earlier stageCzechia, Spain, SwedenMinistry draft (Czechia, July 2026), draft royal decree (Spain), government inquiry report without a bill (Sweden).

For Austria, Belgium, Bulgaria, Croatia, Cyprus, Estonia, Greece, Ireland, Latvia, Luxembourg, Poland, Portugal and Romania we found no published draft of a national act. Some of them have nevertheless reported a notifying authority to the Commission. Lithuania, also in the register, adopted a government resolution in February 2026 whose content we could not verify. Slovenia is implementing by government decree; its adoption in April 2026 was reported, but we could not find it in the official gazette. Austria's federal chancellery had planned to publish its act in June 2026; that date has passed.

What it means for manufacturers

The reporting obligation does not wait for national law. The 24-hour early warning, the 72-hour notification and the final report go through ENISA's Single Reporting Platform to the coordinating CSIRT of the Member State where the manufacturer has its main establishment, in every Member State, with or without an implementing act. ENISA lists a coordinating CSIRT for all 27.

Where national laws differ is enforcement, and the differences are real. Finland lets its market surveillance authority impose administrative fines up to the ceilings in Article 64. Denmark's draft deliberately avoids administrative fines and makes infringements criminal offences tried in court, using the option in Article 64(8); the explanatory notes cite the separation of powers under the Danish constitution. Czechia's draft spreads market surveillance across twelve authorities. A manufacturer selling across the EU will deal with different authorities and procedures from December 2027, when market surveillance and penalties apply.

For readiness this means: a missing national act is no reason to wait. The deadlines under Article 14 run everywhere, and the evidence of having met them, which market surveillance authorities can demand from December 2027, is being created now.

What remains open

Article 64 applies from 11 December 2027; that is the practical date by which national penalty rules need to be in place. Several bills are expected to move in the coming weeks: the Dutch Senate committees submit their questions on 27 October 2026, Denmark's consultation closes on 2 November 2026 and the Slovak committees report by mid-November. Germany's Bundesrat next meets on 20 November 2026. We will update this overview as acts are promulgated. The German act is covered in detail in our guide The German CRA implementation act and in the news item The Bundestag has adopted the German CRA implementation act.

Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Sources

The reporting obligation already applies. Who answers at night at your company?

CRA Response Center monitors your security mailbox, recognises important reports using AI hosted in Germany (your e-mails never go to OpenAI, Anthropic or Google) and alerts your people by SMS and e-mail. EUR 190 per month per domain including VAT. Try it free for 30 days.

Try it free for 30 days