The Bundestag passed the Act Implementing the Cyber Resilience Act, designating the BSI as Germany's market surveillance authority, notifying authority and coordinating CSIRT under the CRA. As market surveillance authority, the BSI can order noncompliant products with digital elements removed from the market. It will also act as a complaints office for consumer reports. The Act still requires Bundesrat approval. Once in force, provisions matching CRA obligations that already apply take effect the day after promulgation, and the remaining obligations follow the CRA's general application date of December 11, 2027.
The BSI becomes Germany's market surveillance authority, notifying authority and coordinating CSIRT under the CRA.
Noncompliant products with digital elements can be ordered off the German market.
The Act still needs Bundesrat approval, and most obligations follow the CRA date of December 11, 2027.
Our comment
The law gives Germany an enforcement authority with powers to remove noncompliant products from the market. For manufacturers and importers of products with digital elements sold in Germany, the question is how their vulnerability handling and conformity processes would hold up under review by a designated regulator.
Questions about this alert?
Sara Derbel
Paralegal
Our team can explain what this development means for your organization.
Regulatory intelligence and legislative monitoring for AI, privacy and cybersecurity across Canada, the US, EU, UK and Australia, filtered, prioritized and reviewed by legal experts.
Technology RFP management and procurement support: RFI, RFP and RFQ structuring, vendor due diligence, third-party risk and negotiation of SaaS, cloud and AI contracts.
CISA sent the final rule under the Cyber Incident Reporting for Critical Infrastructure Act to the White House Office of Management and Budget for review on October 1, 2026, the last procedural stage before publication. The rule would require covered entities across sixteen critical infrastructure sectors, an estimated 300,000 or more, to report substantial cyber incidents within 72 hours and ransomware payments within 24 hours. The scope could extend to technology, cloud, logistics, engineering and communications vendors serving critical infrastructure clients. Publication is expected before year end.
