CRA Compliance in France

ANSSI has been established as France's national competent authority for the CRA, with a mandate that builds on its existing role as the national authority under the NIS2 Directive. ANSSI operates with broad supervisory powers including the ability to conduct on-site inspections, request technical documentation, and order product recalls. French manufacturers in regulated sectors — including those supplying the defence and critical infrastructure supply chains — will be subject to overlapping requirements from ANSSI under both the CRA and the LPM framework. ANSSI's Centre de Qualification and CSPN certification scheme provide a recognised pathway for third-party conformity assessment.

French manufacturers must route Article 14 reports through CERT-FR, ANSSI's operational CSIRT. CERT-FR operates a secure electronic reporting portal and accepts incident notifications 24/7. The Article 14 obligation requires an early warning within 24 hours of discovering active exploitation, with a full notification within 72 hours and a final report within one month. France's existing LPM notification framework for Opérateurs d'Importance Vitale (OIV) uses a similar tiered structure, and manufacturers already accustomed to OIV reporting will find CRA Article 14 familiar. CERT-FR will relay reports to ENISA and coordinates within the EU CSIRTs network.

ANSSI and the DGCCRF (Direction Générale de la Concurrence, de la Consommation et de la Répression des Fraudes) share market surveillance responsibilities in France for consumer-facing products. For CRA violations, France will implement the full penalty regime: up to €15 million or 2.5% of global annual turnover for breaches of essential cybersecurity requirements. ANSSI may issue formal notices, require corrective action, or seek product withdrawal through the courts. The DGCCRF has an established track record of active enforcement in consumer product safety, suggesting CRA enforcement for consumer-facing connected products will be vigorous.

ANSSI publishes extensive guidance in French, including its Référentiel Général de Sécurité (RGS) and product security recommendations that map to CRA Annex I requirements. Its CSPN (Certification de Sécurité de Premier Niveau) scheme provides a lighter-touch evaluation pathway suitable for lower-risk products. For SMEs, Bpifrance and the French cybersecurity industry association ACN operate support programmes. ANSSI also maintains the France Cybersecurity label, which can complement CRA conformity activities. The Campus Cyber initiative in Paris serves as a national hub connecting manufacturers with cybersecurity expertise.