CRA Compliance in Latvia

CERT.LV serves as Latvia's national competent authority and CSIRT for the CRA, combining regulatory and operational functions in a single agency. Market surveillance for physical products is coordinated with the Consumer Rights Protection Centre (PTAC) and the State Electrotechnical Inspectorate for electrical and electronic products. Latvia's Kiberdrošības likums (Cybersecurity Law), transposing NIS2, provides the legislative framework for CERT.LV's supervisory powers. Latvian manufacturers benefit from CERT.LV's combined technical expertise and regulatory mandate, creating a single point of contact for both compliance guidance and incident coordination.

Latvian manufacturers submit Article 14 notifications directly to CERT.LV through its secure reporting portal. CERT.LV operates incident response capability and participates in the EU CSIRTs network and Baltic CERT cooperation. The Article 14 obligation requires an early warning within 24 hours of detecting active exploitation and a full notification within 72 hours. Latvia's NIS2 incident reporting framework provides the operational model for CRA Article 14 notifications. Manufacturers should register with CERT.LV in advance and confirm the current Article 14 notification procedure, as Latvia may refine reporting channels through national implementing legislation.

Market surveillance for CRA products in Latvia is coordinated between CERT.LV and PTAC (Consumer Rights Protection Centre). The full CRA penalty regime applies: up to €15 million or 2.5% of global annual turnover for violations of essential cybersecurity requirements. PTAC conducts active market surveillance under EU consumer protection and product safety regulations. Latvian manufacturers should maintain CRA technical documentation in both Latvian and English and expect documentation-based surveillance in the initial years of CRA enforcement.

CERT.LV publishes cybersecurity guidance for Latvian businesses in Latvian and English, including sector-specific advisories and implementation recommendations. The Latvian Investment and Development Agency (LIAA) supports manufacturer capability development through innovation grants. The Latvian Information and Communications Technology Association (LIKTA) provides industry engagement on EU regulatory implementation. Latvia participates in Baltic cybersecurity cooperation with Estonia and Lithuania, creating a shared knowledge base for CRA implementation. EU Cohesion Funds and the Latvian Recovery and Resilience Plan provide investment support for manufacturer digitalisation and cybersecurity.