"The BSI won't inspect anything before December 2027, so we have time." Since it became clear that the BSI, Germany's Federal Office for Information Security, will be the competent authority for the Cyber Resilience Act (EU CRA), that thought is tempting. For most obligations the date is right. If you build routers, modems or switches, do not rely on it. For these products of all things, time is tightest.
In short: Routers, modems and switches are important products of class I under Annex III of the Cyber Resilience Act. Until a harmonised standard is cited in the Official Journal, the safe route to CE marking goes through a notified body. The assessment must be complete before the first device ships from 11 December 2027. Reporting has applied since 11 September 2026.
On 20 November 2026 the Bundesrat, Germany's upper house, will take its final vote on the German implementation act (document 621/26, item 7). This post reflects the status as of 13 November 2026.
What does the German implementation act for the Cyber Resilience Act change?
Manufacturer obligations sit in the Cyber Resilience Act itself, because the EU regulation applies directly. A national implementation act only governs enforcement. It decides which authority is competent, who notifies conformity assessment bodies and how infringements are penalised, in Germany through amendments to the BSI Act. Under the version the Bundestag adopted on 15 October 2026, the BSI takes on its roles at different dates:
| From | What applies | Legal basis |
|---|---|---|
| Since 11 September 2026 | Reporting of actively exploited vulnerabilities and severe incidents, including devices already in the field. Notifications go through the Single Reporting Platform to ENISA and, at the same time, to the BSI as CSIRT coordinator for manufacturers with their main establishment in Germany. | Articles 14(1), 69(3) and 71(2) EU CRA; BSI Act |
| From the day after promulgation | The BSI becomes notifying authority and notifies conformity assessment bodies for the Cyber Resilience Act to the European Commission. | Article 4(1) of the German implementation act (Bundestag document 21/8622) |
| From 11 December 2027 | The BSI becomes market surveillance authority and gains the power to impose fines. At the same time the essential cybersecurity requirements of Annex I, conformity assessment and CE marking apply. | Article 71(2) EU CRA; Article 4 of the German implementation act |
All deadlines are covered in the EU CRA roadmap 2026/2027. How reporting works in detail is explained in the post on the 24-hour deadline from awareness.
Why is "we have time until 2027" wrong for routers?
Two things undercut that comfort for routers: the Bundestag wants the BSI to check routers first, and conformity assessment usually needs a notified body, of which there are hardly any for the Cyber Resilience Act yet.
Together with the act, the Bundestag adopted a resolution on 15 October 2026 (document 21/8622). It calls on the federal government to have the BSI give priority to inspecting routers as part of market surveillance. The reasoning points to system-critical components from untrustworthy manufacturers in every household, naming routers and inverters. A resolution is not legally binding. Still, I think it is very likely that the BSI will start exactly there from December 2027.
Which conformity assessment do routers, modems and switches need?
Routers, modems and switches need a notified body under Article 32(2) EU CRA unless the manufacturer fully applies a harmonised standard, common specifications or a suitable certification scheme. "Routers, modems intended for the connection to the internet, and switches" are listed as important products of class I in Annex III point 12 of the Cyber Resilience Act. Self-assessment by internal control (Module A) is only allowed if one of these is applied in full, and a certification scheme must be at assurance level "substantial" or higher. Otherwise a notified body is required, either for EU-type examination followed by internal production control (Modules B and C) or for full quality assurance (Module H).
To date, no harmonised standard for the Cyber Resilience Act is cited in the Official Journal, and there are no common specifications. Whether a suitable standard for routers, modems and switches is cited before December 2027 is open. If you plan today, treat the notified body as the default and self-assessment as an option.
How many notified bodies are there for the Cyber Resilience Act?
Based on my research, there are hardly any notified bodies for the Cyber Resilience Act across the EU so far (status 13 November 2026). The rules on notifying authorities and notified bodies (Chapter IV, Articles 35 to 51 EU CRA) have applied since 11 June 2026. German bodies, however, can only be notified by the BSI once the implementation act is promulgated. The European Commission lists notified bodies in its NANDO database.
Manufacturers can use any body notified in the EU with a matching scope. The problem is that every maker of important products will ask at the same time, and each body has to be accredited and notified before it may assess anything.
If a radio router already holds an EU-type examination certificate under the Radio Equipment Directive and Delegated Regulation (EU) 2022/30, look at Article 69(1) EU CRA: such certificates remain valid until 11 June 2028 unless they expire earlier. The provision only governs validity, though. How far such a certificate counts as evidence for Annex I of the Cyber Resilience Act is disputed. Ask your assessment body what it will accept.
Myth vs. fact
Myth: Until the BSI starts inspecting in 2027, router makers have time on the Cyber Resilience Act.
Fact: For routers, conformity assessment decides whether you can ship from December 2027, not the start of market surveillance. As long as no harmonised standard is cited, the safe route runs through a notified body, and capacity is scarce. For devices in the field, reporting has applied since 11 September 2026.
What happens if the assessment is not done by December 2027?
Without a completed conformity assessment, a router maker cannot place new devices on the market from 11 December 2027. Placing on the market means the first making available of a product on the EU market, and it counts per device, not per model. Every router first delivered from that date must comply, even if it was built in 2026. I covered this in the post on the grandfathering myth.
Take a mid-sized company with 120 employees that builds LTE routers, which machine builders use to connect their equipment for remote maintenance. It plans the technical documentation for summer 2027, the assessment for autumn and CE marking under the Cyber Resilience Act for December. If the assessment is stuck in a queue in autumn, deliveries stop in December. The same queue holds makers of operating systems, smart home products with security functionalities and microcontrollers with security-related functionalities.
Meanwhile the reporting obligation already applies to every LTE router running at customer sites. If a firmware vulnerability is actively exploited, the early warning is due within 24 hours of becoming aware of it, regardless of when the BSI starts spot checks. German fines apply only from 11 December 2027, and other member states have their own rules. The sanctions framework is explained in the post on Cyber Resilience Act penalties and fines.
What should network equipment makers do now?
1. Classify your products. Under Article 7(1) EU CRA, the core functionality decides. A standalone router falls under Annex III point 12. A machine tool with a built-in cellular modem does not become an important product, because integration alone does not upgrade the host product. For gateways, it depends on whether routing is the core functionality. The post on product classification by core functionality and the overview of the Cyber Resilience Act for telecom and network equipment show how to draw the line. Put the result in writing.
2. Plan for a notified body as the default. Count back from 11 December 2027: assessment time, rework, certificate, production changeover. Contact bodies that are seeking notification for the Cyber Resilience Act now, including abroad. Do not wait until your documentation is finished. The process is described in the guide to conformity assessment and CE marking. If a cited standard arrives in time, you can still switch to self-assessment.
3. Test the reporting route for devices in the field. Who reports at the weekend, who decides when a suspicion becomes a notification, and is access to the Single Reporting Platform set up? A dry run with a fictitious case shows where things break. Background is in the guide to vulnerability management under the Cyber Resilience Act.
What does this mean for your EU CRA roadmap?
A German implementation act does not move any deadline of the Cyber Resilience Act: reporting obligations have applied since 11 September 2026, and the regulation applies in full from 11 December 2027. For makers of important products the real deadline still moves forward, because the notified body's assessment must be complete before the first delivery from 11 December 2027. In my view, technical documentation and the vulnerability handling process should therefore be ready for assessment in early 2027.
The free EU CRA assessment shows which of your products fall under Annex III and where documentation and reporting stand.
Frequently asked questions
Will the BSI inspect products as soon as the German act is promulgated? No. Under the implementation act adopted by the Bundestag, the BSI becomes market surveillance authority only on 11 December 2027. From the day after promulgation it acts as notifying authority. As CSIRT coordinator, the BSI has received notifications under Article 14 of the Cyber Resilience Act since 11 September 2026.
Does the reporting obligation cover routers sold before 2027? Yes. Under Article 69(3) EU CRA, the Article 14 reporting obligation also applies to products placed on the market before 11 December 2027. The other requirements apply to those devices only after a substantial modification (Article 69(2)).
Do routers always need a notified body? Not always. A manufacturer that fully applies a harmonised standard cited in the Official Journal, common specifications or a suitable European certification scheme may self-assess under Module A (Article 32(2) EU CRA). As long as none of these exists, a notified body is the only route.
What is the legal effect of the Bundestag resolution on routers? The resolution of 15 October 2026 (Bundestag document 21/8622) is a political request to the federal government, not a legal obligation for manufacturers. How the BSI will put router priority into practice from December 2027 is still open. Router makers should read it as a signal.
Does this also apply to industrial switches? Annex III point 12 of the Cyber Resilience Act lists switches in general, industrial switches included. As I read Implementing Regulation (EU) 2025/2392, it describes switches as devices with a management plane. A managed switch is then an important product of class I, while an unmanaged switch would fall into the default class. Record your reasoning in the technical documentation.
Every Friday I take apart one Cyber Resilience Act myth here.