On 15 October 2026 the Bundestag adopted the government's bill implementing the EU Cyber Resilience Act (Regulation (EU) 2024/2847), in the version amended by the Interior Committee. The Bundestag's own record shows CDU/CSU, SPD and the Greens voting in favour, the AfD against and Die Linke abstaining. The law makes the Federal Office for Information Security (BSI) both the market surveillance authority and the notifying authority for products with digital elements. It amends the BSI Act, the Telecommunications Act and the Energy Industry Act.
The case for a strong BSI
The strongest argument for this design is simple. Insecure connected products impose costs on people who never chose them: a router with a default password is a botnet node, whoever owns it. Voluntary standards did not fix that. A single accountable regulator that can test products and act on findings gives the CRA's obligations real force. Without one, the regulation would be a paper promise. Concentrating the work in the BSI also avoids a patchwork of competing agencies, which would be worse for manufacturers.
The law also reflects some restraint. According to the Bundestag, the committee adopted a coalition amendment on when certain provisions take effect. A committee summary describes the bill as creating the legal basis for the BSI's roles and the fine procedure, not as a set of new substantive duties. Those duties come from the EU regulation itself.
The timetable is already running
The European Commission's CRA page confirms the sequence. The regulation entered into force on 10 December 2024. Manufacturers have had to report actively exploited vulnerabilities since 11 September 2026. The main obligations apply from 11 December 2027. So the reporting duty went live five weeks before Germany finished legislating for the authority that receives the reports. That gap is a design flaw in the EU's staging, not a German one. It does mean manufacturers have been complying with a regime whose enforcement rules were still unsettled.
The Bundestag also adopted an accompanying resolution asking the government to have the BSI prioritise routers in its market surveillance. That is a sensible, risk-based instinct. Concentrating early effort on a product class with a record of mass compromise is better than spreading thin across every smart toaster.
The capacity problem
The harder question is whether the BSI can carry the load. Boerse-Express reports that the plan provides 95 new positions in 2026 and 141 in total by 2029, plus roughly €10 million for a real-world testing lab and reporting systems. Those are modest numbers for a regulator taking on supervision of products from every manufacturer selling into Germany.
The NIS2 experience is a warning. The government expected roughly 29,500 entities to register with the BSI under the NIS2 implementation. It-daily reported that 18,845 had registered by the extended deadline of 31 July 2026, about 10,000 short. Of those, 6,490 classed themselves as particularly important entities and 12,355 as important entities. The same report says the Interior Ministry asked the Federal Statistical Office to recalculate the original estimate.
Two readings are possible. One is mass non-compliance. The other is that the estimate was simply too high. We do not yet know which, and that uncertainty is the point. A regulator that cannot say how many entities it supervises is not ready to add a second, larger population.
What proportionate implementation looks like
The CRA covers an enormous range of products, from industrial controllers to open-source components that ship inside commercial devices. Several things would keep the German regime proportionate:
- Publish the risk model. The BSI should say how it will choose products to test, starting with the routers the Bundestag named, so manufacturers can predict where scrutiny falls.
- Prefer fixes to removals. The law gives the BSI the power to require corrections and to pull products. Removal from the market should be the last step after a documented chance to remediate, especially for small manufacturers.
- Protect good-faith security research. A vulnerability-reporting regime only works if researchers are not treated as adversaries. The EFF has argued in a related context that rules anchored in established security practice age better than rules tied to a specific technology. The same logic applies here.
- Publish queue and backlog data. Registration counts, report volumes and response times should be public. The NIS2 shortfall was visible only because someone counted.
Bottom line
Giving the BSI statutory authority is the right call. The risk is not the authority but the arithmetic: a regulator whose NIS2 register is about a third short of expectations, and whose CRA staffing ramps up over three years, is being asked to start enforcing before it is built. Germany should spend the interval before December 2027 on transparency, guidance and a narrow, router-first enforcement plan. Any power to remove products from the market should be used rarely, and with a documented path to compliance first. That protects consumers without turning the CRA into a barrier for the small manufacturers and open-source maintainers that Europe's tech sector depends on.