The Commission's draft for the Cyber Resilience Act (CRA-E) mentions different authorities with different tasks for monitoring and compliance with the standards of the regulation.

National market surveillance authorities

The national market surveillance authorities form the core of the regulatory system in the CRA-E. According to Art. 41 (2) CRA-E, the Member States must appoint one or more market surveillance authorities and can also select existing authorities for this purpose. In Germany, for example, the Federal Office for Information Security (BSI) or the Federal Network Agency (BNetzA) could be considered due to their competencies.

The market surveillance authorities are responsible for drawing up guidelines and giving advice on the implementation of the CRA-E as well as for creating an annual activity report. On top of that, market surveillance authorities are obliged to carry out a review of a product with digital elements in accordance with Art. 43 (1) CRA-E if a significant cybersecurity risk is assumed and may request documentation and information from manufacturers. If a cybersecurity risk exists, the market surveillance authority may request the manufacturer to withdraw or recall the respective product from the market. In addition, the market surveillance authorities can conduct simultaneous coordinated control actions on certain products with digital elements in accordance with Art. 49 (1) CRA-E. In principle, however, these are coordinated by the European Commission and the ENISA also has the right to make proposals regarding the product categories to be checked. The regulation leaves open what exactly is meant by "sweeps", i.e. coordinated control actions. This could include simulated cyber attacks, for example, as this is probably the most effective way of identifying vulnerabilities in products with digital elements.

In addition, the national market surveillance authorities also have the investigative powers listed in Art. 41 - 43, 46 and 47 CRA-E. These include requesting access to the data of products with digital elements, requesting the implementation of corrective measures with regard to a product that does not meet the requirements of the CRA or requesting the manufacturer to remedy the formal non-conformity (e.g. affixing the conformity marking).

In addition, Art. 41 CRA-E provides for cooperation between the market surveillance authorities and other authorities, such as the national cybersecurity certification authorities, the ENISA and the European data protection authorities. This includes, in particular, the exchange of information or documents.

European Commission

The main task of the European Commission is to promote cooperation and the exchange of information between the national market surveillance authorities, as set out in Art. 41 (7) CRA-E.

In addition, according to Art. 45 (1) CRA-E, the Commission can also take action itself and request the inspection of a product with digital elements by the market surveillance authorities if it has reasons to believe that a product with digital elements poses a significant cybersecurity risk.

In exceptional circumstances that justify immediate intervention to ensure the good functioning of the internal market and where the market surveillance authorities have not taken effective action, the Commission may request the ENISA to assess compliance and request a corrective or restrictive measure at Union level, such as the withdrawal or recalling of a product with digital elements from the market.

ADCO

Art. 41 (11) CRA-E provides for the establishment of a special Administrative Cooperation Group (ADCO) made up of representatives of the market surveillance authorities and the single liaison bodies. According to Recital 56 sentence 1 CRA-E, the ADCO is to ensure uniform application of the CRA.

ENISA

The ENISA can carry out a conformity assessment at the request of the European Commission and also submit proposals to the market surveillance authorities for product categories for which sweeps could be organized. In addition, manufacturers are obliged to notify the ENISA immediately of any actively exploited vulnerability of a product with digital elements. The ENISA then forwards the notification to the Computer Security Incident Response Team (CSIRT) designated under Article 12 NIS 2 Directive for the coordinated disclosure of vulnerabilities.

Possible changes in the final version of the CRA-E

Based on the Commission's proposal for a regulation, the European Parliament's Committee on Industry, Research and Energy (ITRE) and the Council of the European Union have also published drafts. The legislative process is currently undergoing final coordination.

While the Council's draft is largely based on that of the Commission, the ITRE's proposal contains some interesting additions. For example, in Art. 43 and 45 CRA-E, it has been added that market surveillance authorities and, if necessary, the European Commission can also require economic operators to take corrective action if there is a non-technical risk, such as undue influence by third countries on suppliers. In addition, the provisions on sweeps were specified in Art. 49 CRA-E. This includes, for example, the inspection of products with digital elements that were acquired under a cover identity.

Practical recommendations

As the European Commission grants the member states the authority to decide on the designation of market surveillance authorities, it remains to be seen which authorities the national legislator will select or possibly create for this purpose. Companies should therefore continue to monitor the further legislative process and news relating to the CRA. The exact manner in which official measures will be implemented will only become clear once the CRA comes into force. We will inform about possible sanctions for violations in Episode 10.

In our CRA-Update series, we regularly present information on the proposed Cyber Resilience Act and keep you informed about changes in the ongoing legislative process. In each of our articles, we give you a brief overview of a specific topic, presenting the most important aspects and practical implications.