Germany’s Bundestag Passed the CRA Implementation Act on 15 October 2026: BSI Gets Sole Enforcement Role and Fines up to €15 Million
Our piece on Malta’s enforcement framework flagged one loose end: Germany’s own CRA implementation law “had not yet passed the Bundestag as of this writing.” That is no longer true. The Bundestag’s Interior Committee (Innenausschuss) approved an amended version of the government’s bill, Drucksache 21/6134, on Wednesday, 14 October 2026, with CDU/CSU, SPD and the Greens voting for it, the AfD against, and Die Linke abstaining. The plenary gave the bill its final reading the next evening, Thursday, 15 October 2026. The law inserts a new Part 8, “Cybersecurity of Products with Digital Elements,” into the BSI Act (BSIG), and with it Germany becomes one of the larger Member States to put its CRA enforcement machinery into statute.
One agency, several hats
The law gives the Federal Office for Information Security (BSI) nearly every national role the CRA leaves open to Member States. It is the market surveillance authority for products with digital elements, with the power to investigate, demand technical documentation and order corrective action. It is the notifying authority that designates conformity assessment bodies, though the German accreditation body, DAkkS, actually assesses and monitors those bodies day to day, with the BSI stepping in directly only where there is a public interest reason to. And it performs the national CSIRT functions under Article 14 of the Regulation, receiving early warnings, 72-hour notifications and final reports from manufacturers whose main establishment is in Germany; the BSI has effectively been doing this piece since mandatory reporting began on 11 September 2026, and the Act now gives that role a statutory footing. One exception: for high-risk AI systems that are also products with digital elements, the Bundesnetzagentur or another authority designated under Germany’s AI Act implementation law takes the surveillance role instead, with the BSI in a supporting capacity.
What a breach actually costs
The Act sets three fine tiers in new Sections 68 and 69 BSIG, tracking the ceilings the Regulation itself sets in Article 64:
- Breaches of the essential requirements in liite I, or of the manufacturer duties in Articles 13 and 14: up to €15 million or 2.5% of worldwide annual turnover, whichever is higher.
- Other infringements falling under Article 64(3) of the Regulation: up to €10 million or 2% of turnover.
- Giving incorrect, incomplete or misleading information to the BSI or to a notified body: up to €5 million or 1% of turnover.
Public authorities and bodies are carved out of administrative fines entirely, under a new Section 70(2) BSIG.
Two different start dates, not one
The Act does not switch on all at once. Under its Article 4(1), the BSI’s market surveillance role, its notifying authority role, its CSIRT functions, and related amendments to the Telecommunications Act and the Energy Industry Act take effect the day after the Act is promulgated in the Federal Law Gazette. The fine provisions are different: under Article 4(2), Sections 65, 67, 68, 69 and 70 BSIG, the ones that actually let the BSI issue a sanction, only apply from 11. joulukuuta 2027. That is not a German quirk; it mirrors the CRA’s own split between reporting duties that already bind manufacturers and the Regulation’s main obligations, which apply EU-wide from the same date. Germany can start supervising earlier. It cannot start fining earlier.
The Act passed the Bundestag’s final reading on 15 October 2026. Publication in the Bundesgesetzblatt, which starts the clock on the provisions that take effect “the day after promulgation,” had not been confirmed in public reporting as of this writing. Until that happens, the exact date the BSI’s market surveillance and notifying authority roles become formally effective in Germany is not yet fixed, even though its enforcement powers will not bite before 11 December 2027 regardless.
Why this is worth tracking if you are not in Germany
Germany is the fourth Member State we have covered setting up its own answer to the same two open questions the CRA leaves to national governments: who checks your technical documentation, and who can fine you. Malta split the roles across two agencies; Hungary and Finland each centralised differently; Germany now centralises almost everything in the BSI, with a narrow AI Act carve-out. If you manufacture or place products with digital elements on the German market, the BSI is the authority whose published guidance and sandbox programme are worth following directly. Our vaatimustenmukaisuusmatriisi tracks the Annex I obligations these authorities enforce, and our support planner can help smaller manufacturers work out what to ask a national authority’s SME support function for, once it is actually staffed and running.