CRA Compliance in Norway

Norway participates in the EU single market through the EEA Agreement, and EU product regulations including the CRA apply to Norway following EEA incorporation — typically within 12-24 months of EU adoption. NSM will serve as the national competent authority for CRA enforcement in Norway. The Direktoratet for samfunnssikkerhet og beredskap (DSB) coordinates market surveillance for consumer product safety, and the Norwegian Communications Authority (Nkom) retains competence for radio equipment. Norwegian manufacturers placing products on the EEA market must comply with CRA requirements on the same timeline as EU-based manufacturers once the regulation is incorporated into the EEA Agreement.

Norwegian manufacturers will report CRA Article 14 incidents to NorCERT, NSM's national CSIRT. NorCERT operates a 24/7 incident response capability and secure reporting channels. Following EEA incorporation, Norwegian manufacturers will face the same Article 14 timeframes as EU manufacturers: early warning within 24 hours, full notification within 72 hours. NorCERT participates in the EU CSIRTs network as an EEA associate and will relay reports to ENISA as required. Norwegian manufacturers with EU subsidiaries or entities may need to file reports with both NorCERT and relevant EU-member-state CSIRTs depending on where the legal manufacturer entity is registered.

Market surveillance in Norway for CRA products will be coordinated between NSM, DSB, and Nkom depending on product type. Norway will implement the CRA penalty regime following EEA incorporation: up to €15 million or 2.5% of global annual turnover for violations of essential cybersecurity requirements. Norway has a robust market surveillance tradition in product safety, and the DSB has extensive experience in CE marking enforcement. Norwegian manufacturers should not assume EEA status provides any grace period — the CRA applies on the same basis as to EU manufacturers once incorporated.

NSM publishes free cybersecurity guidance in Norwegian and English, including its National Cyber Security Strategy and sector-specific frameworks. NorCERT provides threat intelligence sharing for registered organisations. Innovasjon Norge supports cybersecurity capability development through innovation grants for Norwegian manufacturers. SINTEF, Norway's independent research institute, provides technical research and testing services applicable to CRA conformity assessment. Norwegian manufacturers also benefit from access to ENISA guidance and the Nordic cooperation framework through NSM's participation in Nordic cybersecurity coordination mechanisms.