CRA Compliance for Swiss Manufacturers

Yes. The CRA follows the market location principle (Art. 2(1)): any product with digital elements made available on the EU market falls within scope — regardless of where the manufacturer is based. Swiss manufacturers must appoint an authorised representative in an EU member state (Art. 26). The representative is the point of contact for market surveillance authorities and must retain the technical documentation for 10 years.

Yes. The CRA applies per individual unit at the time of placing on the market (Art. 13(8), Annex I §2(a)). A device manufactured in 2026 and shipped in 2028 must be free of known actively exploited vulnerabilities at the moment of shipment. For Swiss machine builders with 12–24 month inventory cycles, this means every individual serial number requires its own up-to-date patch status — manual Excel tracking does not scale.

Both are strong foundations but do not fully cover the CRA. Specifically missing: SBOM obligation (Annex I §2), 24-hour notification of actively exploited vulnerabilities to ENISA (Art. 14), EU Declaration of Conformity per Annex V, and product-specific risk assessment. Harmonised CRA standards will likely build on IEC 62443 and ETSI EN 303 645 — investments in these standards are not lost, but need targeted extension.

A cloud application falls within CRA scope as a Remote Data Processing Solution (RDPS) per Art. 3(2) when it is an integral part of the product function — for example an app controlling a machine, or a backend without which a connected device cannot perform its main function. Standalone web apps or SaaS platforms without hardware coupling remain outside CRA scope (but may fall under NIS2 or data protection law).

Yes. Art. 33(5) allows simplified technical documentation for micro-enterprises (<10 staff, ≤€2M turnover) and small enterprises (<50 staff, ≤€10M). Additionally: exemption from fines for late 24h early warnings, reduced conformity assessment fees, CSIRT helpdesks and priority sandbox access. Important: The security requirements in Annex I are not reduced — only the procedural burden.

Shared responsibility. The EU importer must verify before placing on the market that CRA conformity is in place, that technical documentation is available, and that the manufacturer has appointed an authorised representative (Art. 19). Violations may be sanctioned for both importer and Swiss manufacturer — fines up to €15M or 2.5% of global annual turnover. EU importers increasingly require CRA evidence before adding products to their portfolio.

The Swiss Federal Council was mandated to propose its own cybersecurity regulation for digital products by autumn 2026 — closely aligned with the EU CRA. The Swiss law will be a safety net for the domestic market, not a delay for the EU export obligation. Anyone selling into the EU from December 2027 must implement the EU CRA today. Those who implement the EU CRA will largely be prepared for the upcoming Swiss equivalent.

From 11 September 2026: when an actively exploited vulnerability affects a product placed on the EU market, manufacturers must notify ENISA directly (Art. 14). Three-stage process: 24h early warning, 72h full notification, 14d final report. The EU authorised representative supports but is not the primary reporting channel — the deadline applies to the manufacturer itself. A Single Reporting Platform operated by ENISA will bundle notifications from 2026.

Annex III defines important products (Class I and II), Annex IV defines critical products. Class I includes firewalls, VPN software, microcontrollers with security functions, identity management components. Class II covers hypervisors, PKI solutions, IoT security gateways. Swiss industrial products — particularly machine controllers with embedded security functions — land in Class I more often than expected. Classification should be product-specific during conformity assessment.

For a mid-sized Swiss product portfolio (10–30 variants), manual effort typically runs 3–5 FTE-years for initial compliance, plus ongoing vulnerability monitoring with 24-hour response deadlines. With automated SBOM management, vulnerability tracking and audit documentation, this reduces to 0.2–1 FTE — with higher audit certainty. Methodology with sources and assumptions: https://kunnus.tech/en/methodology.