Under the new law, CE marking will cover cybersecurity for connected products from December 2027. The BSI gains market surveillance powers, can demand fixes, impose fines and pull non-compliant products from the market.
The German parliament has passed the implementing law for the Cyber Resilience Act. From December 2027, extended CE marking will apply to products with digital elements, ranging from connected household devices to security chips. The BSI is named market surveillance authority, notifying body, national CSIRT and complaints office for consumers.
As market surveillance authority, the BSI can inspect products randomly or targeted, demand corrections, impose fines and remove non-compliant products from the market. Manufacturers must now prove cybersecurity across the entire product lifecycle starting at the design stage, not only before launch.
The BSI has already coordinated Cyber Resilience Act incident reports since September 11, 2026, and plans support for small and medium enterprises during implementation. It remains open whether enough certification bodies will be accredited in time for manufacturers to meet the December 2027 deadline.
What this means for decision-makers
- Check which of your connected products will fall under the extended CE requirement from December 2027.
- Document cybersecurity measures starting at the design stage rather than just before market launch.
- Clarify early which notified body can assess your products against the Cyber Resilience Act.
This story was produced automatically from the source named above and checked by software before publication. The image is symbolic and shows neither the event nor a real person. How this paper is made