CRA Compliance in Denmark

CFCS serves as Denmark's national competent authority for the CRA, with the Danish Business Authority (Erhvervsstyrelsen) handling market surveillance coordination for consumer products. Denmark is a major exporter of medical devices, maritime equipment, and industrial automation systems — all product categories within the CRA's scope. CFCS operates with a mandate rooted in national security, and its CRA enforcement is expected to focus especially on products with potential for systemic or critical infrastructure risk. The Danish Safety Technology Authority (Sikkerhedsstyrelsen) retains competence for electrical safety and coordinates on product market surveillance.

Danish manufacturers submit Article 14 early warnings and notifications to CFCS, which serves as Denmark's national CSIRT for the CRA. CFCS operates a secure reporting portal and maintains operational contacts for urgent cybersecurity notifications. The Article 14 obligation requires an early warning within 24 hours and a full notification within 72 hours of discovering active exploitation of a product vulnerability. CFCS participates in the EU CSIRTs network and relays relevant notifications to ENISA. Manufacturers should establish a documented Article 14 notification procedure naming CFCS as the competent recipient before any incident arises.

Market surveillance for CRA compliance in Denmark is coordinated between CFCS and the Danish Business Authority. The full CRA penalty regime applies: up to €15 million or 2.5% of global annual turnover for violations of essential cybersecurity requirements. Denmark's regulatory enforcement tradition is characterised by constructive dialogue and graduated escalation, but persistent non-compliance results in formal enforcement action. Manufacturers should be aware that the Danish Consumer Ombudsman (Forbrugerombudsmanden) may also be involved for consumer-facing connected products, adding an additional oversight dimension.

CFCS publishes cybersecurity guidance for Danish businesses and coordinates with the Danish Industry Foundation on SME cybersecurity programmes. The Erhvervsstyrelsen provides regulatory guidance on product compliance through its Virk.dk business portal. The Danish Standards organisation (DS) develops and publishes national standards aligned with ETSI EN 303 645 and IEC 62443, providing a reference framework for CRA Annex I compliance. Danish manufacturers can also access EU-level support through ENISA's published CRA guidance and the SME-focused resources from Digital Europe.