On 23 September 2026, a conference bringing together France's national cybersecurity agency (ANSSI), the National Frequency Agency (ANFR) and the Directorate-General for Enterprise (DGE) answered, for the first time clearly, the question every digital product manufacturer had been asking since the Cyber Resilience Act partially entered into force on 11 September: who is going to knock on my door, and to check what? The answer was unambiguous. What these clarifications change for your organisation deserves a careful reading, whatever your sector.
Two authorities, two distinct roles
The Cyber Resilience Act (CRA) rests on a two-tier institutional architecture, which the 23 September conference explicitly confirmed for France.
ANFR is the market surveillance authority. It is the body that will carry out checks on digital products placed on the European market: technical tests, conformity analyses and, where necessary, administrative measures or withdrawal orders. Its officers can require manufacturers to produce technical documentation, incident logs, and evidence that the essential cybersecurity requirements were built in from the design stage.
ANSSI, for its part, acts as the notifying authority. It does not enter into a direct relationship with the manufacturer to call it to account for its product. Its remit is different: it assesses, supervises and notifies conformity assessment bodies (CABs), that is, the third-party certifiers that will be able to issue attestations for products classified in the important or critical categories. ANSSI sets the level of requirement for those who assess, not for those who produce.
The DGE plays a supporting role for companies, in particular SMEs, helping them understand their obligations and access compliance resources.
What is already active and what waits for December 2027
The CRA applies progressively between September 2026 and December 2027. Two time horizons coexist, and it is essential not to confuse them.
Since 11 September 2026, Article 14 of the regulation has been fully applicable. Any manufacturer of a product with digital elements must notify any actively exploited vulnerability in its product within 24 hours, to ENISA and to the national CSIRT, which in France is the CERT-FR of ANSSI. A detailed full notification must follow within 72 hours, and a final report within 14 days. These deadlines admit no exceptions, and the obligations of Article 14 apply regardless of the date on which the essential requirements take effect. The operational details of this reporting platform are covered in the article on the ENISA platform going live and the first 24 hours.
The second horizon is 11 December 2027. On that date, all digital products placed on the European Union market must comply with the full set of CRA essential requirements: security by design, vulnerability management across the whole product lifecycle, complete technical documentation and, for the important and critical categories, assessment by an accredited third-party body. That is when ANFR will begin its market checks and when penalties can be imposed.
What the penalties imply about the level of preparation required
The regulation provides for deterrent penalties. For a manufacturer in breach of the essential requirements, the fine can reach EUR 15 million or 2.5 % of worldwide annual turnover for the preceding financial year, whichever is higher (source: CRA regulation, Article 64). For an importer or distributor, the ceiling is EUR 10 million or 2 % of turnover (source: CRA regulation, Article 64).
These figures mean that the CRA is not a low-intensity administrative compliance regime. Its architecture is modelled on the GDPR: the authority can impose sanctions proportionate to the size of the organisation, not only to the seriousness of an isolated infringement.
A concrete example: the multi-tenant SaaS publisher
Consider a French publisher selling a SaaS platform to European companies. Its product contains digital elements: it integrates agents, APIs and third-party components updated through subscription. Under the CRA, this publisher is a manufacturer. It must monitor vulnerabilities in every component it integrates, including third-party open source libraries. If an actively exploited vulnerability is discovered in one of these components, it has 24 hours to notify the CERT-FR, even if the flaw was not reported to it directly by a customer.
In December 2027, ANFR may inspect this product. It will check that the technical documentation is compliant, that security updates are distributed within reasonable timeframes, and that incident logs are kept. If the publisher cannot prove that its vulnerability management process has been operational since at least September 2026, the date of the first obligation, it exposes itself to an unfavourable outcome at that inspection.
What your organisation must do now
The 23 September conference confirmed that the regime will not wait for the generalisation of checks before producing its effects. Three workstreams are immediately priority.
Identify whether your products fall within the scope of the CRA. The regulation applies to any product with digital elements placed on the European Union market, with the exception of software developed exclusively for internal purposes and not made available to third parties. SaaS software, connected equipment, embedded components and security tools themselves: all fall within scope.
Activate the Article 14 notification process. If this has not been done, you have been in breach since 11 September. Your security teams must have a direct channel to the CERT-FR for reports, and an internal procedure that allows the 24-hour and 72-hour deadlines to be met.
Build the technical documentation now, not in 2027. ANFR will only begin checks from December 2027, but it will review the history of your practices from September 2026 onwards. The traceability of the patches applied, the vulnerabilities detected and the notifications made is evidence that you cannot reconstruct after the fact.
The question teams should be asking this month
Does your organisation have a designated CRA compliance owner for each digital product, who knows today which vulnerabilities are active in your third-party components, and who can trigger a notification to the CERT-FR within 24 hours?
If the answer is no, the institutional framework clarified on 23 September is not an abstraction. ANFR will be knocking on your door in fifteen months, and ANSSI will be copied in through the monitoring mechanism. The window to put the process in place is open. It will close.