CRA Compliance in Lithuania
National competent authority, Article 14 CSIRT contacts, and enforcement guidance for Lithuania manufacturers.
Lithuania's National Cyber Security Centre (NKSC — Nacionalinis kibernetinio saugumo centras), operating under the Ministry of National Defence, serves as both the national competent authority and coordinates CERT-LT as the national CSIRT for the CRA. Lithuania has one of the fastest-growing technology manufacturing and fintech sectors in Central and Eastern Europe, and NKSC has built significant regulatory capacity to match. Lithuanian manufacturers benefit from a proactive authority that publishes detailed guidance and engages industry constructively.
National Competent Authority (CRA)
NKSC
Nacionalinis kibernetinio saugumo centras
NKSC is Lithuania's national cybersecurity authority operating under the Ministry of National Defence. It serves as Lithuania's CRA national competent authority and coordinates CERT-LT as the national CSIRT. NKSC is particularly active in public-private partnership on cybersecurity and participates in Baltic and EU cybersecurity coordination.
https://www.nksc.lt →National CSIRT (Article 14 Reports)
CERT-LT
CERT-LT
https://www.nksc.lt/en/contacts.html
https://www.nksc.lt/en →CRA Enforcement in Lithuania
NKSC serves as Lithuania's national competent authority for the CRA, with market surveillance for physical products coordinated with the State Consumer Rights Protection Authority (VVTAT) and sector-specific regulators. Lithuania's Kibernetinio saugumo įstatymas (Law on Cyber Security), updated to transpose NIS2, provides the legislative basis for NKSC's supervisory powers over cybersecurity, which will extend to CRA market surveillance through national implementing legislation. NKSC has been growing rapidly in both capacity and scope, reflecting Lithuania's strategic prioritisation of cybersecurity given its geopolitical position.
Article 14 Incident Reporting for Lithuanian Manufacturers
Lithuanian manufacturers submit Article 14 notifications to CERT-LT, coordinated through NKSC. NKSC operates incident response capability and participates in the EU CSIRTs network and Baltic CERT cooperation. The Article 14 obligation requires an early warning within 24 hours of detecting active exploitation and a full notification within 72 hours. Lithuania's NIS2 incident reporting framework provides the operational model for CRA Article 14 notifications. Manufacturers should contact NKSC in advance to register and confirm the current Article 14 notification procedure and designated reporting channel.
Market Surveillance & Penalties
Market surveillance for CRA products in Lithuania is coordinated between NKSC and VVTAT (State Consumer Rights Protection Authority), with customs authorities involved for imports. The full CRA penalty regime applies: up to €15 million or 2.5% of global annual turnover for violations of essential cybersecurity requirements. VVTAT conducts active market surveillance under EU consumer protection and product safety regulations. Lithuanian manufacturers should maintain CRA technical documentation in Lithuanian and English and should expect NKSC to take a technically informed approach to CRA enforcement given its growing capacity.
Support for Lithuanian Manufacturers
NKSC publishes cybersecurity guidance for Lithuanian businesses in Lithuanian and English, including the National Cyber Security Framework aligned with international standards. The Lithuanian Business Support Agency (LVPA) supports manufacturer investments in cybersecurity through EU-funded innovation programmes. Enterprise Lithuania (Versli Lietuva) provides support for manufacturer internationalisation including EU regulatory compliance. Lithuania's technology industry association Infobalt engages technology manufacturers on EU regulatory implementation including the CRA. Baltic cooperation with Estonia and Lithuania provides shared implementation resources and intelligence-sharing benefits for Lithuanian manufacturers.
CVD Portal automates your Article 14 notification obligations.
Pre-built notification workflows for CERT-LT, deadline tracking, CSAF advisory generation, and a public CVD submission portal. Free forever.
Start your free portalFrequently asked
How do I contact NKSC as a manufacturer with a CRA compliance question?+
NKSC can be contacted through nksc.lt/en/contacts.html in Lithuanian and English. NKSC provides regulatory guidance and incident coordination services. For CRA compliance enquiries, NKSC's regulatory affairs team handles industry questions. NKSC engages manufacturers through annual cybersecurity conferences and through Infobalt, Lithuania's technology industry association. For Article 14 incident notifications, use NKSC's CERT-LT reporting channel.
Does Lithuania have national-level CRA implementing legislation?+
Lithuania has updated its Kibernetinio saugumo įstatymas (Law on Cyber Security) to transpose NIS2 and will implement CRA requirements through further amendments and product safety implementing legislation. The Ministry of National Defence (via NKSC) and the Ministry of Economy are coordinating Lithuania's CRA implementation. National implementing measures are expected ahead of the December 2027 CRA application date, and NKSC is expected to publish implementation guidance for manufacturers in advance of the legislation.
How does Lithuania's strategic cybersecurity posture affect CRA enforcement?+
Lithuania's position as a NATO frontline state has driven significant investment in national cybersecurity capacity, including NKSC's rapid growth in regulatory and operational capabilities. This strategic context means that CRA enforcement in Lithuania is likely to be technically capable and well-resourced. Lithuanian manufacturers — particularly those in sectors relevant to critical infrastructure, energy, and defence supply chains — should expect NKSC to apply CRA requirements with technical rigour. The same geopolitical context also provides manufacturers with access to threat intelligence and security guidance that can inform their CRA-required vulnerability management processes.
Need a CRA compliance checklist for your product?
Browse free niche-specific checklists covering classification, Annex I obligations, and CVD requirements.