CRA Compliance in Germany

The BSI has been designated as Germany's national competent authority (NCA) under the CRA, building on its existing mandate under the BSI-Gesetz. BSI already operates market surveillance for certain product categories under the Radio Equipment Directive and NIS2, giving it established tooling and legal precedent for CRA enforcement. Manufacturers placing products with digital elements on the German market — one of the EU's largest — must ensure conformity with Annex I requirements before CE marking and market access. The BSI publishes detailed technical guidance and maintains a register of accredited conformity assessment bodies for products requiring third-party evaluation.

German manufacturers must report actively exploited vulnerabilities and significant security incidents to CERT-Bund, the national CSIRT hosted within BSI, within the Article 14 timeframes: an early warning within 24 hours and a notification within 72 hours. Germany has a well-established electronic reporting portal at bsi.bund.de/meldung used for NIS2 and KRITIS notifications, which will be extended to cover CRA Article 14 obligations. CERT-Bund coordinates with ENISA's ECSIRT network and will relay reports to other member states when products are distributed across the EU. Manufacturers should establish a documented incident response procedure naming CERT-Bund as the Article 14 recipient.

The BSI's market surveillance division conducts both documentary reviews and technical testing of products. For CRA non-compliance, German law will implement the full CRA penalty regime: up to €15 million or 2.5% of global annual turnover for violations of essential requirements, whichever is higher. The BSI may issue corrective action orders, require product withdrawal, or restrict market access. Germany's existing tradition of robust regulatory enforcement — demonstrated through BSI's enforcement under the BSI-Gesetz and the Telekommunikationsgesetz — signals that CRA market surveillance in Germany will be active rather than reactive.

The BSI publishes extensive free guidance for manufacturers, including its IT-Grundschutz framework, which maps closely to CRA Annex I requirements, and its Technische Richtlinien (Technical Guidelines) for specific product categories. The BSI also operates an IT Security Label programme for consumer products that can serve as a stepping stone toward CRA conformity. Germany hosts a dense ecosystem of TÜV and DEKRA accredited conformity assessment bodies capable of supporting Annex IV evaluations. Small and medium-sized enterprises can access the BSI's Mittelstand Digital initiative, which provides subsidised cybersecurity advisory services.