CRA Market Surveillance: BSI Inspections and Sanctions

CRA market surveillance is the EU-wide enforcement system under the Cyber Resilience Act. Each EU Member State designates a national market surveillance authority empowered to inspect products with digital elements for CRA conformity. In Germany the BSI fulfils this role. Authorities can inspect products, request evidence and order corrective actions where non-compliance is found.

Violations of the essential cybersecurity requirements can result in fines of up to EUR 15 million or 2.5% of global annual turnover, whichever is higher. For less serious infringements the cap is EUR 10 million or 2% of turnover. Additionally, authorities can withdraw products from the market or order recalls.

CRA market surveillance is phased in: by June 2026 Member States must designate their notifying authorities. From September 2026 reporting obligations for exploited vulnerabilities and severe incidents apply. The full market surveillance framework takes effect from December 2027 for all in-scope products.

When a market surveillance authority determines that a product fails to meet CRA requirements and poses a cybersecurity risk, it can require the manufacturer to bring the product into conformity, restrict or prohibit its availability on the market, or order a recall. The manufacturer must then notify all affected users and implement corrective measures.

The CRA establishes a uniform EU-wide framework defining penalty ceilings, reporting obligations and corrective powers. Each Member State then designates its own national authority to implement these rules locally. For example Germany appointed the BSI while other countries designate their own cybersecurity or consumer protection agencies. Coordination happens through ADCO groups and the EU Safeguard Clause procedure.

From 11 September 2026 manufacturers must report actively exploited vulnerabilities and severe security incidents to ENISA and the relevant national authority. This applies even to products already on the EU market before December 2027. Reports must be submitted within 24 hours of becoming aware of an incident.

ADVISORI conducts a readiness assessment of your current CRA compliance posture, identifies gaps and builds monitoring systems. We develop incident response processes for reporting obligations, prepare documentation for audit scenarios and establish continuous surveillance mechanisms so you are ready for authority inquiries and market checks.