Germany's CRA implementation act: what the BSI's new role means for app teams
· 5 min read · CRA news
In short: on 15 October 2026 the German Bundestag passed the national law that implements the Cyber Resilience Act. It makes the Federal Office for Information Security (BSI) the single authority that will police CRA compliance in Germany, including for apps.
- This is an analysis piece: the vote was more than three weeks ago, and we found no fresher CRA development in the last 14 days that matters more to app teams.
- The BSI becomes market surveillance authority, notifying authority and CSIRT under the CRA. It has handled CRA vulnerability reports for Germany since 11 September 2026.
- Fines mirror Article 64 of the CRA: up to €15 million or 2.5% of worldwide turnover for the most serious breaches. According to Hogan Lovells, the fine provisions apply from 11 December 2027.
- At the end of October, promulgation and entry into force were still pending.
What happened
The Bundestag adopted the government's bill implementing Regulation (EU) 2024/2847 on Thursday, 15 October 2026, in the version amended by its Committee on Internal Affairs the day before. According to the Bundestag's own report, CDU/CSU, SPD and the Greens voted for it, the AfD voted against and Die Linke abstained. The committee's changes concern when certain provisions take effect.
The CRA is an EU regulation, so its obligations already bind manufacturers directly. What a national law adds is the enforcement machinery: who checks products, who can fine, and under which procedure. Germany's law does this by amending the BSI Act (BSIG), with smaller changes to the telecommunications and energy laws.
We are covering it now because Germany is a major market for most European app publishers, and the law decides who will knock on the door. The Bundesrat raised no objections to the draft in June. A guest article on Security-Insider, published on 30 October, said the Bundesrat's final approval, promulgation and entry into force were still outstanding.
What the BSI will be able to do
In its press release of 16 October, the BSI describes four roles under the new law:
| Role | What it means in practice |
|---|---|
| Market surveillance authority | Random or targeted checks of products, demands for fixes, sanctions and fines, and removal of non-compliant products from the market. |
| Notifying authority | Confirms the competence of conformity assessment bodies that manufacturers can hire for CRA assessments. Hogan Lovells notes that the accreditation body DAkkS assesses those bodies, with the BSI able to do so itself in the public interest. |
| CSIRT | Coordinates CRA reports for Germany. It has done so since 11 September 2026. |
| Complaints point | Consumers can tell the BSI about suspected violations. |
The BSI also says it will support companies in meeting CRA requirements, especially small and medium-sized ones. The press release does not yet name specific offers.
The complaints point deserves attention from consumer app publishers. Our reading: a user who finds that your app ships with a known, unpatched vulnerability now has an official address to raise it, in addition to your own security contact.
Fines and timing
According to Hogan Lovells' summary, the new sections 68 and 69 of the BSIG follow the ceilings in Article 64 of the CRA, which we checked against the regulation's text:
- Up to €15 million or 2.5% of worldwide annual turnover, whichever is higher, for breaching the essential requirements in Annex I or the obligations in Articles 13 and 14 (Article 64(2)).
- Up to €10 million or 2% for a list of other obligations, including those of importers and distributors (Article 64(3)).
- Up to €5 million or 1% for giving incorrect, incomplete or misleading information to authorities or notified bodies (Article 64(4)).
The regulation itself sets two exceptions in Article 64(10): microenterprises and small enterprises cannot be fined for missing the 24-hour early-warning deadlines in Article 14, and open-source software stewards cannot be fined at all.
On timing, Hogan Lovells reports that the BSI's roles take effect the day after promulgation, while the enforcement and fine provisions apply from 11 December 2027, the date most CRA obligations start. Until then, the practical exposure for app teams sits in the reporting duty of Article 14, which already applies.
Germany is not alone, but the map is uneven
Hogan Lovells' overview shows how differently Member States are moving. Finland's Traficom has been in place since June. Malta named its Digital Innovation Authority in September. France's October decree names ANSSI only as notifying authority, not as market surveillance authority. Italy, Denmark and the Netherlands still have bills or drafts in progress. For an app sold across the EU, that means different authorities, and possibly different priorities, in each country. The Bundestag's accompanying resolution, for example, asks the BSI to prioritise checks on routers, not apps.
What we would do now
- Note the BSI as the authority for your German users, and add it to your incident runbook next to your own security contact and ENISA's reporting platform.
- Check that you could file a 24-hour early warning today. Our reporting guide and deadline calculator walk through it.
- If you build apps for clients, settle who is the manufacturer before an authority asks. See agency or client.
- Keep an inventory of the components in every shipped app version, because "is our app affected?" will be the first question in any check.
- Watch for promulgation in the Federal Law Gazette, which starts the clock on the BSI's new powers.
Not sure whether the CRA covers your app at all? Answer six questions and get a reasoned answer.
Check if the CRA appliesSources
- Deutscher Bundestag: Bundestag stimmt Gesetzentwurf zur Cybersicherheit zu (vote of 15 October 2026, German).
- BSI press release: CRA-Durchführungsgesetz verabschiedet (16 October 2026, German).
- Hogan Lovells: Germany adopts CRA implementation act, with an overview of national enforcement regimes (20 October 2026).
- Security-Insider: CRA-Meldepflicht läuft (30 October 2026, German; status of the legislative procedure).
- Bundesrat: procedure 260/26 (no objections, 12 June 2026).
- Regulation (EU) 2024/2847 (Cyber Resilience Act), EUR-Lex: Articles 14 and 64.
This article summarises a national law that had not yet been promulgated when we wrote it, based on official releases and a law firm's analysis. Details may change. It is not legal advice. Related: Does the CRA apply to mobile apps? · ENISA's draft SME Vulnerability Kit