Skip to content
← Blog

Swiss cybersecurity law: what the 25 September 2026 decision changes for a manufacturer

The Federal Council has tasked the DDPS with a federal cybersecurity act modelled on the CRA, due June 2027. What awaits Swiss manufacturers, and where to start in your build chain.

crasecuritysuisse

In short. On 25 September 2026, the Federal Council tasked the DDPS with drafting a federal cybersecurity act by June 2027. The text will draw on the EU Cyber Resilience Act (CRA) and set binding requirements for manufacturers, importers and retailers of software and hardware, with market surveillance and the power to ban the distribution of insecure products. A product sold only in Switzerland, out of the CRA’s reach today, will therefore enter the same framework. What you build now for the CRA will serve twice.

Already exporting to the EU? Nothing new for you, and that is the good news: the Federal Council wants a harmonised law precisely to spare you a second compliance effort. An SME selling only in Switzerland? This page is written for you.

➡️ Check whether your product is in scope: 3 minutes, no email required

What the Federal Council decided🔗

At its meeting of 25 September 2026, the Federal Council merged three parliamentary mandates into a single federal cybersecurity bill, entrusted to the DDPS with a June 2027 deadline:

  • motion 24.3810 on the cyber resilience of digital products, the one that had already led to the mandate of 20 August 2025;
  • motion 23.3002 on the protection of Switzerland’s essential digital data;
  • motion 25.3011 on the role of hosting and cloud providers.

For manufacturers, the press release is explicit. The act will set binding requirements for manufacturers, importers and retailers of technical products, lay the groundwork for market surveillance and make it possible to ban the distribution of insecure products. It will draw on the EU CRA and must keep the administrative burden on businesses low. The Federal Council’s central argument: internationally active companies already comply with the CRA, and a harmonised Swiss law spares them additional compliance work.

The rest of the text does not concern you directly: the Information Security Act (ISA) remains the law for federal authorities, the duty to report cyberattacks on critical infrastructure, in force since 1 April 2025, is carried over, and sector rules (telecommunications, electricity supply) stay in place.

What it changes, case by case🔗

You sell in the EU. You are already a manufacturer under the CRA, with 24-hour reporting since 11 September 2026 and full application on 11 December 2027. The Swiss act adds nothing if it follows the CRA as announced; on the contrary, it removes the risk of a second rulebook for your Swiss sales. We detail your obligations case by case in Does the CRA apply to Swiss SMEs?.

You sell only in Switzerland. Today, no Swiss law requires cybersecurity for your product. That is the gap the Federal Council wants to close: design requirements, documentation, vulnerability handling, market surveillance and the withdrawal of insecure products. The exact content will depend on the DDPS draft, but the direction was set on 20 August 2025 and confirmed on 25 September 2026: the model is the CRA.

You supply a component or firmware to a Swiss manufacturer. If your customer exports, they already ask you for a software inventory and vulnerability tracking. If they sell only in Switzerland, they will ask as soon as the bill goes to consultation, because they cannot wait for it to enter into force before rebuilding their chain.

The timeline that matters🔗

DateWhat appliesTo whom
11 September 2026CRA reporting of actively exploited vulnerabilities: early warning within 24 h, notification within 72 h, report within 14 daysManufacturers selling in the EU, products already shipped included
June 2027Federal cybersecurity bill delivered by the DDPS, then public consultationAll of Switzerland
11 December 2027Full application of the CRA: Annex I, SBOM, security updates, CE markingManufacturers selling in the EU
Not datedAdoption by Parliament and entry into force of the Swiss actManufacturers, importers and retailers in Switzerland

The press release gives no date beyond June 2027. We will not guess one for you; we only note that setting up a compliant delivery chain takes months, not weeks, and that the CRA, for its part, already has its dates.

Where to start, in your chain🔗

If the Swiss act follows the CRA, the requirements will be those of its Annex I: know your components, track their vulnerabilities, fix and ship security updates, report. Each one is produced at a precise point in your development chain, and that is where we start, not in a binder.

  1. A software bill of materials (SBOM) generated at every build, in CycloneDX format, from your repository rather than a spreadsheet. For bare-metal C++ and Rust, the method is published: SBOM and CVE auditing in CI/CD for bare-metal embedded.
  2. CVE scanning in the pipeline, with a severity gate that blocks the release, and Dependency-Track on your side to watch every shipped version after it leaves.
  3. VEX statements to document the CVEs that do not affect you, so your team fixes only what matters.
  4. A reporting procedure rehearsed with a dry run: who detects, who qualifies, who reports, within 24 hours. A procedure that has never been used does not hold on a Friday evening.
  5. Evidence filed as you go. What a market surveillance authority will ask for is known: the checklist, obligation by obligation.

All of this plugs into your existing GitLab, GitHub or Jenkins, with no parallel chain. The CRA & Dev wiki shows every technique with its code.

What we do for you🔗

From Le Locle, we audit your product and your chain, we set up SBOM, CVE scanning and Dependency-Track in your CI, we write and rehearse your reporting procedure, and we ship the fixes in your code. Prices are published and the audit is not billed if your product is out of scope: our CRA offer. You keep your CE marking, and you reach the Swiss act with a chain already in place.

➡️ Check whether your product is in scope: 3 minutes, no email required

Frequently asked questions🔗

Is the Swiss cybersecurity act already in force?🔗

No. On 25 September 2026, the Federal Council tasked the DDPS with drafting a bill by June 2027. A consultation will follow, then the parliamentary debate. No entry-into-force date has been announced.

Will a product sold only in Switzerland have to comply with the CRA?🔗

Not the CRA itself, which only covers the EU market. But the future Swiss act will draw on it, with binding requirements for manufacturers, importers and retailers and market surveillance. Building your chain on the CRA today prepares you for both.

I already export to the EU: does the Swiss act add obligations?🔗

The Federal Council announces the opposite: a law harmonised with the CRA to spare internationally active companies additional compliance work. The exact content will depend on the DDPS draft.

What should I do while waiting for the bill?🔗

What the CRA already requires of any manufacturer selling in the EU: a software inventory at every build, vulnerability tracking, a rehearsed reporting procedure and security updates. Our 3-minute diagnostic tells you whether your product is in scope and where to start.

References🔗