Skip to content
← Blog

Does the CRA apply to Swiss SMEs?

What the EU Cyber Resilience Act means if you are based in Switzerland: it applies as soon as you sell in the EU. Your obligations by case, the deadlines, the Swiss bill.

crasecurityswitzerland

Yes, as soon as your product is made available on the European Union market. The CRA (Cyber Resilience Act, Regulation (EU) 2024/2847) attaches to the product and to the market where it is sold, not to the manufacturer’s country. A company in Neuchâtel, Vaud or Jura that sells a connected device, a firmware-driven machine or a piece of software in Germany, France or Italy is a manufacturer within the meaning of the regulation, with the same obligations as a manufacturer established in the EU.

In Le Locle, in the canton of Neuchâtel, we hear the question in three forms: we are in Switzerland, are we concerned? Doesn’t our German distributor take care of it? We only sell a component, so what? This page answers all three. For the offer itself, see CRA: turn compliance into an advantage.

➡️ Check whether your product is in scope: 3 minutes, no email

What Switzerland does not change🔗

Three things hold, Swiss headquarters or not:

  1. The deadlines. Reporting actively exploited vulnerabilities to ENISA, the EU cybersecurity agency, has applied since 11 September 2026 (Article 14: early warning within 24 hours). The technical requirements of Annex I (secure design, component inventory, vulnerability handling throughout the support period) will apply from 11 December 2027.
  2. No SME exemption. The regulation sets no size threshold. A ten-person company exporting a product in scope has the same obligations as a group.
  3. CE marking. From December 2027, your EU declaration of conformity will also have to cover the CRA. You keep your CE marking, and the access to the European market that comes with it, by building these requirements into your development chain rather than into a binder.

Your obligations by case🔗

The regulation distinguishes roles. Three situations cover most of the Swiss SMEs we meet.

You sell directly to customers in the EU🔗

You are the manufacturer (Article 13). The product’s conformity is on you: assessment, technical documentation, CE marking, vulnerability handling during the support period and reporting to ENISA since September 2026. You may appoint a representative established in the EU to keep the documentation available to the authorities (Article 18); it is not an obligation, and it does not transfer your responsibility. A representative keeps a file, it does not fix your firmware.

You go through a European importer or distributor🔗

Your partner has obligations of their own (Articles 19 and 20): they must verify that you carried out the conformity assessment, compiled the technical documentation and affixed the CE marking, and they cannot place a product on the market that does not meet these requirements. In practice, they are the ones who will ask you for the evidence: component inventory (SBOM, Software Bill of Materials), vulnerability handling policy, EU declaration of conformity. Without these documents, your product may sit on the loading dock, and you are not the one deciding when it leaves.

You supply a component or software integrated by a European manufacturer🔗

Your customer is the manufacturer of the final product; the regulation requires them to exercise due diligence on the components they integrate (Article 13). They will therefore ask you for the same things: an up-to-date SBOM, a channel to report and fix vulnerabilities, a commitment on updates. Answering fast, and with evidence, becomes a criterion for staying on their supplier panel. Put differently: the supplier who sends their SBOM the same day keeps their place in the bill of materials.

What if you only sell in Switzerland?🔗

The CRA does not apply directly to a product that stays on the Swiss market. Two points still deserve your attention:

  • Switzerland is preparing its own law. After a first mandate on 20 August 2025, the Federal Council tasked the DDPS on 25 September 2026 with drafting, by June 2027, a federal cybersecurity act modelled on the CRA: binding requirements for manufacturers, importers and retailers, market surveillance and a ban on insecure products. We detail the decision in Swiss cybersecurity law: what the 25 September 2026 decision changes for a manufacturer.
  • Your Swiss customers export. A Swiss integrator or manufacturer selling into the EU will ask you for the same evidence as a European customer.

Building your development chain on the CRA requirements today therefore also puts you ahead of Swiss law: one method for both markets, and no second project in two years.

The threat in Switzerland, in figures🔗

Reports keep coming in, and reporting is becoming your obligation:

  • 64,733 cyber incidents voluntarily reported to the Swiss NCSC in 2025: 35,727 in the first half, 29,006 in the second (semi-annual reports 2025/1 and 2025/2);
  • 325 cyberattacks reported by critical infrastructure operators since the reporting obligation took effect on 1 April 2025, as of 30 March 2026, 145 of them in the second half of 2025 (NCSC press release of 30 March 2026);
  • 57 ransomware cases reported to the NCSC in the second half of 2025, 79 in the first half of 2026 (semi-annual report 2026/1, published 24 August 2026);
  • 27,128 voluntary reports and 200 mandatory reports in the first half of 2026 (same report).

To assess your product’s exposure, take the free 3-minute self-assessment.

CRA compliance in Neuchâtel, the Jura and French-speaking Switzerland: where we work🔗

ADNT is based in Le Locle, in the canton of Neuchâtel, ten minutes from La Chaux-de-Fonds, at the heart of the Jura Arc and its industries: watchmaking, microtechnology, instrumentation, medical devices. In other words, products that carry firmware and ship to Europe. We travel across French-speaking Switzerland: Neuchâtel and La Chaux-de-Fonds, Vaud (Lausanne, Yverdon-les-Bains, the Riviera), Jura, Biel/Bienne and the Bernese Jura, Fribourg, Geneva. For the rest of Switzerland and customers established in the EU, we work remotely, directly in your development chain and your code: a pipeline does not need us in the same room.

Our way of working is detailed on the offer page: a free one-hour first read, then a fixed-fee industrialisation plan and, if you wish, its implementation inside your existing continuous integration chain.

See the CRA offer and indicative budget →

Where to start, for a Swiss SME🔗

An SME has neither a compliance department nor the budget for a second project in two years. The CRA is therefore won in the only place a small team can hold it: in the development chain it already has, not in a binder. Five building blocks, in this order, each in its place in your repository:

  1. A software bill of materials (SBOM) generated at every build, in CycloneDX format, from your repository. For bare-metal C++ and Rust, the method is published: SBOM and CVE auditing in CI/CD for bare-metal embedded.
  2. CVE scanning in the pipeline with a gate that blocks the release, and Dependency-Track to watch every shipped version.
  3. VEX statements to set aside the CVEs that do not affect you and fix only what matters.
  4. A reporting procedure rehearsed with a dry run: who detects, who qualifies, who reports to ENISA within 24 hours.
  5. Evidence filed as you go, following the checklist, obligation by obligation.

The regulation provides no size exemption, but its Article 33 calls for support measures for micro, small and medium-sized enterprises, including a simplified technical documentation form. The same chain will serve for the future Swiss cybersecurity act. We set it up in your repository, at published prices, and the audit is not billed if your product is out of scope: our CRA offer.

Frequently asked questions🔗

Is a ten-person Swiss SME really concerned?🔗

Yes, as soon as it places a product in scope on the EU market: the regulation sets no size threshold. Its Article 33 does provide support measures for micro, small and medium-sized enterprises, including a simplified technical documentation form. The obligations stay the same; the burden shrinks when they are built into the development chain rather than handled separately.

Does a Swiss company have to appoint a representative in the EU?🔗

No. It is an option provided for in Article 18, not an obligation. The representative keeps the documentation available to the authorities and cooperates with them; responsibility for the product remains yours.

Is my European distributor liable in my place?🔗

No. The importer and the distributor have their own verification duties (Articles 19 and 20), but the conformity assessment, the technical documentation, the CE marking and vulnerability reporting remain the manufacturer’s responsibility.

Is my current CE marking enough?🔗

Not beyond December 2027: the EU declaration of conformity will have to cover the cybersecurity requirements of Annex I of the CRA, on top of the texts you already apply. Reporting under Article 14, for its part, has applied since 11 September 2026, including to products already shipped.

Is a product sold only in Switzerland concerned?🔗

Not by the CRA. But a federal cybersecurity act modelled on the CRA is in preparation (DDPS draft due June 2027, then consultation), and your Swiss customers who export will ask you for the same evidence.

Is there mutual recognition between Switzerland and the EU for the CRA?🔗

Not to date. The CRA is a recent EU regulation; absent a specific agreement, a Swiss manufacturer is treated like any manufacturer established outside the EU.

You are in Le Locle: do you work outside the canton of Neuchâtel?🔗

Yes. From Le Locle, we cover all of French-speaking Switzerland (Neuchâtel, Vaud, Jura, Bern, Fribourg, Geneva) on site, and we work remotely for the rest of Switzerland and customers established in the EU.

References🔗