Germany now has a national law to enforce the EU Cyber Resilience Act (CRA), which sets mandatory security rules for products with digital elements, from smart plugs to apps. The Bundestag passed the CRA implementation act in mid-October 2026. The Federal Office for Information Security (BSI) announced it on 16 October, describing the vote as having taken place "yesterday". Law firm Hogan Lovells Cadwalader, in an analysis published on 20 October, dates the vote to 14 October.

The BSI becomes the CRA watchdog

The law makes the BSI the authority in charge of the CRA in Germany, with several roles:

  • market surveillance: the BSI can check products at random or in targeted checks, demand fixes, impose fines and take products off the market if they do not meet the CRA's requirements;
  • notifying authority: it confirms which test labs may assess products for CRA conformity, with the actual assessment of those labs done by the national accreditation body DAkkS;
  • CSIRT: since 11 September 2026 it has been coordinating the vulnerability and incident reports that manufacturers must file under the CRA;
  • complaints body: consumers can report products that they suspect do not comply;
  • support: it helps small and medium-sized companies and open-source software stewards meet the rules, including through a regulatory sandbox for testing products before launch.

BSI vice-president Thomas Caspers said the CRA creates mandatory cybersecurity requirements across Europe for the first time, "from the smart coffee machine, through mobile apps, to the security chip", and that security has to be built in from the start of development.

Fines follow the EU ceilings

According to Hogan Lovells Cadwalader, the German fines match the CRA's own tiers. Breaking the essential security requirements or the reporting duties can cost up to €15 million or 2.5% of worldwide annual turnover, whichever is higher. Other breaches can cost up to €10 million or 2%, and giving false or incomplete information to authorities up to €5 million or 1%.

When it applies

The BSI's new roles start the day after the law is published in the Federal Law Gazette. The Bundesrat did not object, so publication is expected soon. Most of the CRA's product obligations, however, apply only from 11 December 2027. From then on the CE mark will also stand for cybersecurity, and only then can the BSI enforce the rules and impose fines.

Why it matters for smart home buyers and makers

The CRA covers most connected consumer devices: cameras, locks, hubs, thermostats and the apps that control them. Makers will have to fix known vulnerabilities, ship security updates for a support period and report actively exploited flaws. Germany's law decides who checks this in Germany and who you can complain to.

Other EU countries are at different stages. Hogan Lovells Cadwalader lists Finland, Hungary and Malta as already having national laws, the Netherlands as having a bill in parliament and Italy as working on a draft. The sources do not say where Poland stands.