CRA Compliance in Greece

Greece's Ministry of Digital Governance coordinates CRA national competent authority functions, with the National Cybersecurity Authority (NCA-GR) handling technical enforcement and GR-CSIRT managing incident coordination. Market surveillance for consumer and industrial products is coordinated with the General Secretariat for Commerce and Consumer Protection and the Hellenic Telecommunications and Post Commission (EETT) for communications equipment. Greece benefits from ENISA's headquarters in Athens, providing close coordination with the EU cybersecurity agency on CRA implementation. Greek manufacturers should monitor the Ministry of Digital Governance for implementing guidance and formal NCA designation.

Greek manufacturers submit Article 14 notifications to GR-CSIRT through its reporting portal. GR-CSIRT participates in the EU CSIRTs network and coordinates with ENISA for cross-border incident coordination. The Article 14 obligation requires an early warning within 24 hours of detecting active exploitation and a full notification within 72 hours. Greece's NIS2 transposition through national legislation designates GR-CSIRT as the incident coordination authority for essential and important entities, and CRA Article 14 notifications will follow similar procedures. Given ENISA's Athens headquarters, GR-CSIRT has unusually direct access to ENISA's vulnerability reporting and threat intelligence capabilities.

Market surveillance in Greece for CRA products is coordinated between the Ministry of Digital Governance, the General Secretariat for Commerce, and EETT. The full CRA penalty regime applies: up to €15 million or 2.5% of global annual turnover for violations of essential cybersecurity requirements. Greece has been building its market surveillance capacity, and enforcement for CRA is expected to develop progressively. The General Chemical State Laboratory (GCSL) and other technical bodies provide expertise in product testing relevant to conformity assessment. Greek manufacturers should establish CRA-compliant processes ahead of the 2027 application date rather than relying on graduated enforcement.

The Ministry of Digital Governance publishes cybersecurity guidance for Greek businesses through the Digital Governance portal. ENISA's Athens presence creates an unusually accessible source of EU-level cybersecurity guidance for Greek manufacturers. The Hellenic Federation of Enterprises (SEV) provides CRA implementation guidance through its digital economy working group. The Foundation for Research and Technology Hellas (FORTH) and National Technical University of Athens (NTUA) provide technical research and conformity assessment expertise. Greece's participation in the EU Digital Compass and Recovery and Resilience Facility includes cybersecurity investments supporting manufacturer CRA compliance.