BSI and DAkkS build certification capacity for the Cyber Resilience Act

The Federal Office for Information Security (BSI) and the German Accreditation Body (DAkkS) updated their administrative agreement. In a joint announcement on 25 September 2026, the two bodies stated that the agreement now covers additional areas where the BSI is designated as the authority granting powers.

What the agreement covers

The agreement focuses on cooperation for accrediting conformity assessment bodies (CABs) that perform cybersecurity testing. It specifies that the BSI provides technical assessors for DAkkS accreditation procedures in information security.

BSI President Claudia Plattner explained the rationale. Manufacturers and service providers need an easy path to bring highly secure products to market, she said. This cooperation puts that process on a solid foundation.

What applies from the end of 2027

From the end of 2027, products with digital elements must meet the cybersecurity requirements of the Cyber Resilience Act (CRA). Otherwise, they cannot be placed on the European market. For certain product groups listed in the CRA, manufacturers must prove conformity through third-party assessment by a CAB. In Germany, these bodies require a valid DAkkS accreditation. A second step involves notification by the BSI.

The BSI says its CRA notification procedure started on 11 June 2026. This happened before the CRA implementing act was published, which is still in the legislative process. DAkkS already accepts applications from CABs for the CRA scope.

The second pillar: AI security

In parallel, the BSI is positioning itself as a testing authority for AI. Its specialist page outlines three intersections of AI and IT security: the security of AI systems themselves, the use of AI for defence, and new attacks enabled by AI methods. The BSI conducts foundational research for this purpose and develops requirements, test criteria, and methodologies. These include a criteria catalogue for integrating external generative AI models, a guide on AI coding assistants, "SBOM for AI", quality criteria for training data (QUAIDAL), and a checklist on evasion attacks against LLMs.

Manufacturers and testing houses face a double time pressure. Notified bodies must be established while test criteria for AI-supported products mature across several documents simultaneously.

Who is allowed to certify conformity determines how quickly CRA-compliant products actually reach the market.