Germany’s BSI publishes interim Cyber Resilience Act guidance ahead of reporting deadline
Germany’s Federal Office for Information Security (BSI) has published TR-03183, a non-binding technical guide to help manufacturers prepare for the EU Cyber Resilience Act (CRA). The BSI guide sets out risk-assessment and security controls, while manufacturers must begin reporting actively exploited vulnerabilities and severe incidents on 11 September 2026; the CRA’s full requirements apply from 11 December 2027.
Bottom line — TR-03183 offers manufacturers a practical reference, but the BSI says it creates no legal obligations or presumption of CRA compliance.
Go deeper 7
-
The BSI guide has three parts: general requirements, software bills of materials, and vulnerability reports and notifications.
-
Under the CRA, manufacturers must send an early warning within 24 hours of becoming aware of an actively exploited vulnerability, according to the BSI guide.
-
The BSI guide sets out follow-up deadlines of 72 hours for a fuller notification and 14 days after a fix is available for a final vulnerability report.
-
The BSI says the guide is a living document and is intended to be superseded when its content is covered by European harmonised standards.
-
The BSI guide says reporting duties also cover in-scope products already on the market before 11 December 2027.
-
The German government’s draft implementation act would make the BSI a market surveillance authority, but OT-Cyber.de said it could not verify that the act had been enacted as of 12 October 2026.
-
OT-Cyber.de reports that CRA violations can lead to fines of up to €15 million or 2.5% of worldwide annual turnover.