CRA Compliance in Cyprus

The CRA is a regulation, so it applies in Cyprus without transposition. Cyprus still has to designate a notifying authority under Article 36 and market surveillance authorities under Article 52. The Council of Ministers designated the Digital Security Authority (DSA) as the National Cybersecurity Certification Authority (NCCA) under Regulation (EU) 2019/881. The NCCA states that it is the CRA notifying authority and the CRA market surveillance authority in Cyprus. On 30 October 2026, the Commission's list of CRA notifying authorities named the DSA, as NCCA, for Cyprus. The Commission's database of market surveillance authorities listed the DSA, at the Office of the Commissioner of Communications, for the CRA. Law 89(I)/2020 set up the DSA, and the DSA falls administratively under the Commissioner of Communications. Market surveillance applies to products made available in Cyprus, wherever the manufacturer is established.

Cypriot manufacturers submit Article 14 notifications through the CRA Single Reporting Platform, which ENISA operates under Article 16. For a manufacturer with its main establishment in Cyprus, one submission reaches ENISA and National CSIRT-CY at the same time. The early warning is due within 24 hours of the manufacturer becoming aware of an actively exploited vulnerability or a severe incident, and the notification within 72 hours. Final reports follow within 14 days of a corrective or mitigating measure for a vulnerability, and within one month of the notification for a severe incident. Article 14(1) requires the platform, so a report sent only to a national portal or mailbox does not meet the obligation. The CSIRT then passes the notification through the platform to the CSIRTs of the other Member States where the product is available. ENISA's list of CSIRTs designated as coordinators gives csirt.cy as the contact for Cyprus. The DSA describes National CSIRT-CY as its technical and operational arm.

The NCCA carries out CRA market surveillance in Cyprus. It monitors and assesses whether products comply, and it may require economic operators to take corrective or restrictive measures. The NCCA is also the market surveillance authority for the cybersecurity essential requirements of the Radio Equipment Directive. Under Article 52(1), Regulation (EU) 2019/1020 applies to products in the scope of the CRA. Article 64 sets the ceilings for fines, and Cyprus must still lay down its own penalty rules within them. On 30 October 2026, the DSA's legislation page listed only the national laws on the security of networks and information systems. Breaches of the essential requirements in Annex I and of Articles 13 and 14 carry up to €15 million or 2.5% of worldwide annual turnover, whichever is higher. Other obligations carry up to €10 million or 2%. Incorrect, incomplete or misleading information given to notified bodies or market surveillance authorities carries up to €5 million or 1%. Article 64(10) exempts micro and small enterprises from fines for missing the 24-hour early warning deadline.

In August 2026, the DSA as NCCA published a CRA guide for Cyprus with Working Group 4 of NCC-CY, Cyprus's national coordination centre. The guide explains scope, product categories, the roles in the supply chain and the two CRA functions of the DSA. It is an awareness tool and says that it is not legal advice. The notification rules for conformity assessment bodies apply from 11 June 2026 under Article 71(2). Cypriot bodies that want CRA notification can contact the NCCA, which assesses, notifies and monitors them. On 30 October 2026, the NCCA's page on conformity assessment bodies named no CRA body.