CRA Corrective Actions: Responding to Non-Compliance

The Cyber Resilience Act gives market surveillance authorities — in Germany primarily the BSI — a graduated toolbox. Depending on the severity of the non-compliance, they can require the manufacturer to bring the product with digital elements into conformity within a prescribed period, to eliminate specific vulnerabilities, or to improve documentation and conformity assessment evidence. Where risks are more serious, authorities can restrict or prohibit the product being made available on the market, or order its withdrawal from the supply chain or recall from end users. The proportionality principle applies: the measure must match the risk the non-compliance creates. For manufacturers, this means the quality and speed of your own corrective action plan directly influences whether the authority escalates to market restrictions or accepts remediation within the supply chain.

The CRA does not set a single fixed remediation deadline. Instead, the market surveillance authority prescribes a period that is commensurate with the nature of the non-compliance and the cybersecurity risk involved — serious vulnerabilities in widely deployed products will attract much shorter timelines than documentation deficiencies. What matters in practice is your demonstrated responsiveness: authorities expect an immediate acknowledgement, a credible interim risk assessment, and a corrective action plan with verifiable milestones. If the manufacturer fails to take adequate corrective action within the prescribed period, the authority can escalate to restrictive measures such as prohibition, withdrawal, or recall. We therefore recommend treating the first response to an authority finding as a critical deliverable: it sets the tone for the entire enforcement procedure and often determines how much scope for negotiation remains.

The CRA carries substantial financial and commercial consequences.

🔍 Sanction categories:

In most enforcement cases, the market measures hurt more than the fine — a recall or sales prohibition interrupts revenue immediately. A credible, well-documented corrective action programme is the most effective way to keep the procedure at the remediation level.

An effective corrective action plan convinces the authority that you understand the deficiency, control the risk, and will prevent recurrence.

🔍 Core elements:

Each measure should be traceable to the specific finding. Authorities respond well to plans that are honest about the deficiency and precise about verification — and poorly to generic commitments without measurable outcomes.

Treat the authority as a professional counterpart, not an adversary. Respond within the stated deadlines, designate a single accountable coordinator with access to management, and ensure every statement is technically accurate and consistent with your documentation — supplying misleading information is itself a sanctionable offence under the CRA. Proactive transparency generally pays off: sharing your risk assessment, remediation status, and verification evidence at agreed intervals builds credibility and can preserve room for proportionate outcomes. At the same time, statements should be prepared carefully, because they become part of the record and may be relevant for liability towards customers. We support clients by preparing authority submissions, aligning technical and legal messaging, and rehearsing inspection situations, so the organisation communicates consistently from engineering to executive level throughout the procedure.

Repeat findings are the fastest way to lose credibility with a market surveillance authority, so closure of the immediate deficiency should always be paired with structural prevention. The starting point is the root cause analysis from your corrective action plan: if the deficiency arose in secure development, strengthen security requirements and testing gates in the release process; if it was a vulnerability handling failure, improve intake, triage, and update distribution; if documentation was the issue, assign clear ownership for technical files and conformity evidence. Effective prevention also includes periodic internal CRA compliance reviews across the product portfolio, monitoring of obligations as they phase in, and management reporting that makes product compliance status visible. Done well, the enforcement case becomes the trigger for a durable product security governance that reduces both regulatory and commercial risk.