Cyber Resilience Act Response Center Try it freeTry it

News

The Bundestag has adopted the German CRA implementation act

On 15 October 2026 the Bundestag adopted the act implementing the Cyber Resilience Regulation, with one change to its entry into force. This gives the BSI's roles as CSIRT and notifying authority a legal basis as soon as the act is promulgated. Nothing changes for manufacturers' obligations.

On Thursday, 15 October 2026, the Bundestag, Germany's federal parliament, adopted the bill implementing Regulation (EU) 2024/2847 (Gesetz zur Durchführung der Verordnung (EU) 2024/2847, Bundestag printed paper 21/6134). It did so on the basis of the recommendation of the Bundestag's Committee on Internal Affairs (Innenausschuss) of 14 October 2026 (printed paper 21/8622). CDU/CSU, SPD and Alliance 90/The Greens voted in favour, the AfD against, and Die Linke abstained. The committee had concluded its deliberations the day before; as late as early October the bill was on no agenda. The German Federal Office for Information Security (BSI) announced the vote on 16 October 2026. The act has not yet been promulgated: it now goes to the Bundesrat, the chamber representing the federal states, for its second passage.

The Bundestag changed the government bill in only one place, its entry into force (Article 4). The bill had tied the BSI's roles to fixed dates: notification of conformity assessment bodies from 11 June 2026, tasks as CSIRT from 11 September 2026. Both dates have passed. Under the adopted version, these provisions therefore enter into force on the day after promulgation. Everything else stays at 11 December 2027.

What it means for manufacturers

The act does not change manufacturers' obligations. They are set out in the Regulation, which applies directly; the reporting obligation under Article 14 has applied since 11 September 2026. The act organises the authorities' side, in two stages:

  • On the day after promulgation. The BSI's list of tasks then includes market surveillance and notification under the Regulation, as well as its task as CSIRT (section 3(1), second sentence, points 30 and 31, and section 5(3), second sentence, point 6 of the BSI Act, BSIG). The procedure for notifying testing bodies after accreditation by DAkkS, Germany's national accreditation body (section 66 BSIG), also applies from that day. In practice the BSI already performs these roles; CERT-Bund accepts notifications through the ENISA platform. What is new is the legal basis.
  • On 11 December 2027. The actual provision on market surveillance with the complaints body (section 65), support for small and medium-sized enterprises including the regulatory sandbox (section 67) and the provisions on fines (sections 68 to 70) enter into force only then, at the same time as Article 64 of the Regulation. The BSI becomes the fining authority. No fines are imposed on authorities and public bodies.

Together with the act, the Bundestag adopted a resolution. Among other things, it calls on the federal government to check routers as a priority in market surveillance under the Cyber Resilience Regulation. Manufacturers of routers or similar network equipment should expect the BSI to look at them early once it carries out market surveillance from December 2027. A resolution does not bind the authority, but it shows the political direction.

For readiness this means: CERT-Bund via the ENISA platform remains the recipient of notifications. What was missing was the legal basis, not the body. The deadlines under Article 14 run regardless of the German act, and the evidence of compliance with them that market surveillance can demand from 2027 is being created now.

What remains open

The Bundesrat has to deal with the act in its second passage. According to its calendar, its next plenary sitting is on 20 November 2026; whether the act will be on the agenda there was not yet known on 19 October 2026. In the first passage, on 12 June 2026, the Bundesrat raised no objections. Signing into law and promulgation in the Federal Law Gazette (Bundesgesetzblatt) follow; only from then do the BSI's brought-forward roles apply. It also remains open how manufacturers can take part in the regulatory sandbox. The guide The German CRA implementation act explains the act in detail, and the guide Fines and market surveillance under the CRA covers responsibility for fines.

Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Sources

The reporting obligation already applies. Who answers at night at your company?

CRA Response Center monitors your security mailbox, recognises important reports using AI hosted in Germany (your e-mails never go to OpenAI, Anthropic or Google) and alerts your people by SMS and e-mail. EUR 190 per month per domain including VAT. Try it free for 30 days.

Try it free for 30 days