Cyber Resilience Act for Energy & Smart Grid Equipment in Germany
A practical country and industry compliance guide — obligations, evidence, and next steps.
Direct answer
Energy & Smart Grid Equipment manufacturers in Germany must classify their products by CRA category, apply Annex I essential cybersecurity requirements, establish a vulnerability handling process, prepare technical documentation and CE marking, and report actively exploited vulnerabilities to ENISA. Full obligations apply from 11 December 2027; vulnerability reporting starts 11 September 2027.
What are the CRA obligations for Energy & Smart Grid Equipment in Germany?
Energy & Smart Grid Equipment manufacturers in Germany must classify their products by CRA category, apply Annex I essential cybersecurity requirements, establish a vulnerability handling process, prepare technical documentation and CE marking, and report actively exploited vulnerabilities to ENISA. Full obligations apply from 11 December 2027; vulnerability reporting starts 11 September 2027.
- Classify smart meters, SCADA interfaces, and grid-connected hardware by CRA category
- Apply IEC 62443-4-2 as the primary technical standard for CRA compliance evidence
- Establish vulnerability reporting contact visible in device documentation and on product website
- Coordinate with energy sector regulator (BNetzA, CRE, ACM) for overlap with sector rules
- Plan security update support over the full grid equipment lifetime (often 15+ years)
| Country | Germany |
| Industry | Energy & Smart Grid Equipment |
| Regulation | Regulation (EU) 2024/2847 |
| Supervision | Germany's BSI will be the primary CRA market-surveillance authority for most product categories, with BNetzA covering telecom hardware |
The CRA applies to manufacturers and importers of products with digital elements (hardware and software) sold or made available in the EU market. It requires essential cybersecurity requirements, CE marking, vulnerability handling throughout the product lifetime, and incident reporting to ENISA. Critical and important product categories face conformity assessment by notified bodies.
All essential cybersecurity requirements, secure-by-design obligations, CE marking, and vulnerability management obligations apply from 11 December 2027.
Source: Regulation (EU) 2024/2847, Articles 3, 6, 13, 14 and Annex I
Energy & Smart Grid Equipment CRA checklist
Action checklistDetermine whether your product is Default (most products), Important Class I (e.g. browsers, password managers, VPNs, network monitoring tools), Important Class II (firewalls, IDS/IPS, microprocessors), or Critical (HSMs, smart cards). Category determines conformity assessment route.
Articles 6, 7, Annex III, Annex IV
Implement secure-by-default and secure-by-design: minimal attack surface, no default passwords, access control, encrypted communications, data minimisation, integrity protection, vulnerability remediation capability, and security update mechanism.
Article 13, Annex I Part I
Document a coordinated vulnerability disclosure policy, a process to receive and assess security reports, a remediation and update release workflow, and a communication channel for security researchers.
Article 13, Annex I Part II
Compile technical documentation covering product design, risk assessment, essential requirements compliance evidence, test results, and instructions for users. Issue an EU Declaration of Conformity before affixing the CE mark.
Articles 26, 28, 32
Notify ENISA (via national CSIRT) within 24 hours of becoming aware of an actively exploited vulnerability or severe incident. Provide early warning, followed by a full notification within 72 hours and a final report within 14 days.
Article 14
Commit to a support period during which security updates will be released — minimum 5 years or the expected product lifetime, whichever is longer. Communicate the end-of-support date to users.
Articles 13(8), 13(9)
What is specific to Germany
Germany's BSI will be the primary CRA market-surveillance authority for most product categories, with BNetzA covering telecom hardware. The BSI has deep experience with IT-Grundschutz and the KRITIS framework and is expected to issue sector-specific CRA guidance building on these baselines. German manufacturers should align CRA technical documentation with BSI IT-Grundschutz profiles and existing EN-series IEC standards adopted in Germany.
Priority actions for Energy & Smart Grid Equipment
- Classify smart meters, SCADA interfaces, and grid-connected hardware by CRA category
- Apply IEC 62443-4-2 as the primary technical standard for CRA compliance evidence
- Establish vulnerability reporting contact visible in device documentation and on product website
- Coordinate with energy sector regulator (BNetzA, CRE, ACM) for overlap with sector rules
- Plan security update support over the full grid equipment lifetime (often 15+ years)
Turn this guide into a real assessment
Use EuroComply's free tools to check your specific scope, estimate fine exposure, and build an evidence file.
Informational only. This page is not legal advice — consult qualified counsel for your specific situation. Last reviewed: .