Cyber Resilience Act: decree names ANSSI as France's notifying authority

Decree No. 2026-944 of October 9, 2026, published in the Journal officiel (France's official gazette) on October 11, designates the Agence nationale de la sécurité des systèmes d'information (ANSSI), France's national cybersecurity agency, as the notifying authority under the Cyber Resilience Act (CRA), the European regulation (EU) 2024/2847 on cyber resilience. The text takes effect the day after its publication.

What a notifying authority does

The CRA sets cybersecurity requirements for “products with digital elements,” from software to connected devices. For the most sensitive products, conformity must be assessed by an independent third-party body. These bodies must be recognized, or “notified,” to the European Commission by a national authority.

In France, that role therefore falls to ANSSI. Under Article 1 of the decree, it notifies conformity assessment bodies and then oversees their activity.

The planned procedure

• In principle, a body must first be accredited by COFRAC, the French accreditation committee, before submitting its application to ANSSI.
• It may be notified before accreditation if its file is complete and its accreditation application is admissible. In that case, it is limited to 25 conformity certificates over a period of no more than 12 months.
• ANSSI has two months from receipt of a complete file to notify the body or give reasons for its refusal.
• Notified bodies must then keep ANSSI informed of certain aspects of their activity, as provided for by the regulation.

The decree also applies in New Caledonia, French Polynesia, Wallis and Futuna, and the French Southern and Antarctic Lands.

The CRA timeline

The regulation's provisions on the notification of bodies have applied since June 11, 2026. Since September 11, 2026, manufacturers have had to report actively exploited vulnerabilities and serious incidents affecting their products. All obligations will apply from December 11, 2027.

What this means for manufacturers

The decree creates no new obligation for companies. It sets up the tool that will let them have their products assessed in France. Software vendors and manufacturers subject to third-party assessment should:

• check now which product category they fall into;
• follow the list of notified bodies, which the European Commission will publish;
• plan for delays: there will be few bodies at first, and demand is likely to be high as December 2027 approaches.