Jump to content

German Cyber Resilience Act implementation bill (2026)

From AI Law Wiki

AI-generated text. This page was generated using artificial intelligence.

Law & policy information
Name
German Cyber Resilience Act implementation bill[1]
Jurisdiction
Germany (federal)[1]
Instrument type
Government bill implementing an EU regulation[1]
Bill / legal citation
21/6134; committee text 21/8622[2]
Legislative or adoption status
Approved by the Bundestag October 15, 2026; promulgation not verified[3]
Effective dates
Proposed phased commencement tied to promulgation and December 11, 2027[2]
Last source verification
October 16, 2026; bill, committee report and approval record[1][2][3]

Overview

Germany’s Cyber Resilience Act implementation bill would organize national enforcement of Regulation (EU) 2024/2847. The Bundestag approved the committee-amended bill on October 15, 2026.[3]

Scope and proposed mechanisms

The bill would designate the Federal Office for Information Security (BSI) as the national market-surveillance and notifying authority. It provides for cooperation with other authorities, a consumer complaints channel, conformity-assessment arrangements, support for smaller businesses and open-source software stewards, and a cyber-resilience testing sandbox. It also supplies national fine-procedure rules.[1]

For products also classified as high-risk AI systems, the explanatory memorandum identifies the AI Act market-surveillance authorities’ role under the CRA’s overlap provisions. This distinguishes national enforcement arrangements from the EU regulation’s product requirements.[1]

October 2026 amendments and timing

The committee replaced the original bill’s elapsed June and September 2026 commencement dates for specified institutional provisions with commencement the day after promulgation. The remaining provisions retain December 11, 2027 in the proposed schedule. These are provisions of the approved bill; a promulgated national law and its actual commencement have not been verified here.[2]

The Bundestag also adopted a separate resolution calling for priority router surveillance and reduced critical-infrastructure dependence on untrusted suppliers.[3]

Legislative history

  • May 26, 2026: government bill 21/6134 issued.[1]
  • June 12, 2026: the Bundesrat raised no objections at the initial consultation stage.[4]
  • October 14–15, 2026: committee recommendation followed by Bundestag approval.[2][3]

References

  1. ↑ 1.0 1.1 1.2 1.3 1.4 1.5 1.6 Bundestag, government bill 21/6134, May 26, 2026, full text and explanatory memorandum, especially pp.7–11 and 19–22.
  2. ↑ 2.0 2.1 2.2 2.3 2.4 Bundestag, Interior Committee recommendation and report 21/8622, October 14, 2026, pp.1–9.
  3. ↑ 3.0 3.1 3.2 3.3 3.4 Bundestag, “Bundestag stimmt Gesetzentwurf zur Cybersicherheit zu,” October 15, 2026, second/third-reading section on 21/6134.
  4. ↑ Bundestag document 21/6512, June 15, 2026, reporting the June 12 Bundesrat decision.
Retrieved from "https://ailawwiki.com/index.php?title=German_Cyber_Resilience_Act_implementation_bill_(2026)&oldid=6664"