---
title: "Germany passes its CRA law: the BSI will police the market | Edge SDN"
description: "On 15 October 2026 the German Bundestag adopted the law that implements the Cyber Resilience Act in Germany (government bill 21/6134), with one change to its entry into force. The law makes the BSI the German market surveillance authority and the notifying authority for conformity assessment bodies."
url: https://www.edge-sdn.com/regulations/cyber-resilience-act/news/2026-10-germany-bundestag-passes-cra-law-bsi/
last_updated: 2026-10-20
---

# Germany passes its CRA law: the BSI will police the market

- Affected: New machines from 11 Dec 2027; Importers and distributors
- Status: National authority
- Date: 15 October 2026
- Practical impact: Adds or clarifies a duty

## What happened

On 15 October 2026 the German Bundestag adopted the law that implements the Cyber Resilience Act in Germany (government bill 21/6134), with one change to its entry into force. The law makes the BSI the German market surveillance authority and the notifying authority for conformity assessment bodies. It now goes to the Bundesrat and is not yet promulgated.

## What it means for machine builders

For machine builders who sell in Germany this settles who checks products on that market. The BSI may test products at random or on suspicion, demand fixes and impose sanctions. Nothing changes in what you do today: Article 14 reports already go through ENISA's Single Reporting Platform. Note the BSI as your German counterpart, next to ACN in Italy.

Official source: [BSI, press release on the CRA implementation law](https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2026/261020_CRA-Durchf%C3%BChrungsgesetz.html)
See also: [Bundestag, committee recommendation, Drucksache 21/8622](https://dserver.bundestag.de/btd/21/086/2108622.pdf)

Published 20 October 2026 by Edge SDN. Edited by Edge SDN. A summary, not legal advice. Always check the official text for your case.