What happened
On 15 October 2026 the German Bundestag adopted the law that implements the Cyber Resilience Act in Germany (government bill 21/6134), with one change to its entry into force. The law makes the BSI the German market surveillance authority and the notifying authority for conformity assessment bodies. It now goes to the Bundesrat and is not yet promulgated.
What it means for machine builders
For machine builders who sell in Germany this settles who checks products on that market. The BSI may test products at random or on suspicion, demand fixes and impose sanctions. Nothing changes in what you do today: Article 14 reports already go through ENISA's Single Reporting Platform. Note the BSI as your German counterpart, next to ACN in Italy.
Official source BSI, press release on the CRA implementation law
See also Official: Bundestag, committee recommendation, Drucksache 21/8622
Published 20 October 2026 by Edge SDN. A summary, not legal advice. Always check the official text for your case.