Cyber Resilience Act for Swiss companies

Why it reaches Swiss companies

EU regulation 2024/2847 looks at where the product is sold, and the manufacturer's location doesn't matter. A machine with firmware, an installable program or a connected device entering the EU market has to comply. Without CE marking and documentation, it stays out from 2027.

The dates are the same as in the EU:

since 11 September 2026, exploited vulnerabilities and severe incidents must be reported: 24 hours, 72 hours, then a final report;
from 11 December 2027 all other obligations apply;
fines go up to EUR 15 million or 2.5% of worldwide turnover.

For companies in Ticino this is a practical question: Italy and Germany are next door, and the first to ask may be the distributor.

The Swiss law on the way

On 20 August 2025 the Federal Council asked for a bill on the cyber resilience of digital products, to go to consultation by autumn 2026. It has to take the CRA into account, so Swiss companies don't face conflicting rules, and it covers market surveillance and a basis for banning insecure devices. As of 31 October 2026 I found no sign the consultation had opened.

What to do now

What you need for the EU will probably also serve for the Swiss law:

knowing which software components each sold version contains;
a public address for anyone who finds a flaw, and someone reading it;
sending security fixes separately from new features;
a person who decides and reports within 24 hours, with access to the ENISA platform.

What I do

I work on the code and how it's released: a component list (SBOM) generated with each version, automatic vulnerability checks, clearing out abandoned libraries and the update channel, for desktop apps too. Details are on the Cyber Resilience Act page.

I work on software and firmware on common operating systems. On a factory PLC, where you need the maker's tools, I'll tell you first what I can touch.

What I don't do

Conformity assessment, CE marking and the technical file stay with a consultant and, for some categories, a notified body. This page summarises rules as read on 31 October 2026 and is not legal advice.

Frequently asked questions

We only sell in Switzerland. Does this concern us?

The regulation doesn't today, but Bern is preparing a law that will take the CRA into account. If your customers resell the product in the EU, the question will reach you through them anyway.

We sell machines with a PLC and a panel. Are we in?

Probably yes for the digital part, if the machine goes to the EU: the regulation covers connected hardware and software. Machines come with other EU rules too, so you need someone who knows your CE marking.

We only have an online service. Does anything change?

Software used only in the browser usually stays out and falls under NIS2, if that applies. An app to download or a program to install is in.

What will the importer ask us for?

An EU importer has to check that the manufacturer has done its part, including CE marking and documentation. Expect a request for documents and the component list, so it's worth having them ready.

If you are in Ticino or elsewhere in Switzerland

I work from Rovellasca, near Como, between Milan and the Swiss border, and part-time at a communication agency in Switzerland. For a Swiss company I built the AREAVISION website, business app and mobile app.

The service: Hacked sites and security
More pages like this: Rules to comply with in Switzerland

Cyber Resilience Act: if your Swiss company exports to the EU