Software

BSI: Bundestag Strengthens Cybersecurity – CRA Implementation Act Passed

October 16, 2026. With yesterday’s passage of the implementing legislation for the Cyber Resilience Act (CRA) by the German Bundestag, another important step toward greater cybersecurity in Germany and Europe has been taken. As a result, starting in December 2027, the well-known CE marking will be expanded to include cybersecurity and will apply to products with digital elements. The Federal Office for Information Security (BSI) welcomes this important step.

Stock photo illustrating data security. Photo: Unsplash

Tags

Data Security, Digitalization, Resilience

Contact info

Silicon Saxony

Marketing, Kommunikation und Öffentlichkeitsarbeit

Manfred-von-Ardenne-Ring 20 F

Telefon: +49 351 8925 886

redaktion@silicon-saxony.de

BSI Vice President Thomas Caspers: “The Cyber Resilience Act establishes, for the first time across Europe, mandatory cybersecurity requirements for products with digital components—from smart coffee makers and mobile apps to security chips. Cybersecurity must therefore be mandatorily incorporated throughout the entire product lifecycle, starting with the development phase. This creates transparency and security for consumers in their everyday lives.”

The implementing law establishes the conditions for effective national implementation and enforcement of the European requirements by designating the Federal Office for Information Security (BSI) as the competent authority. This assigns new responsibilities to the BSI:

As a market surveillance authority, the BSI can conduct random or targeted cybersecurity checks on IT products, demand corrective measures, and impose sanctions and fines in the event of violations. In this role, the BSI is also granted the authority to remove products with digital elements from the market if they do not meet the CRA’s requirements.
As the notifying authority, the BSI will confirm the competence of conformity assessment bodies so that manufacturers can have their products and processes tested for CRA compliance by these bodies.
As the designated CSIRT, the BSI has been coordinating CRA reports for Germany since September 11, 2026.
As a consumer complaint center, the BSI accepts reports of non-compliance with the CRA.
The BSI supports affected economic operators, particularly small and medium-sized enterprises, in meeting the CRA requirements.

The CRA, or Cyber Resilience Act, substantially strengthens the protection of citizens, businesses, and digital infrastructures and makes a key contribution to cybersecurity in the EU single market.

– – – – –