The 3rd meeting of the Administrative Cooperation Group for the Cyber Resilience Act (AdCo CRA) took place in Berlin on 23 June 2026, focusing on the coordination of the operational implementation of market surveillance under the Cyber Resilience Act.

Representatives of the European Commission, ENISA and the Member States’ Market Surveillance Authorities came together to discuss the practical steps needed to support the effective and harmonised implementation of CRA market surveillance across the EU. The Market Surveillance Authority of Cyprus, which holds the position of Vice-Chair of the AdCo CRA, also contributed to the discussions and to the ongoing coordination of a common European approach to CRA market surveillance.

Key topics included:

• The organisation of AdCo CRA working groups on technical and legal matters, as well as cooperation with other market surveillance authorities
• The reporting obligations of manufacturers under the CRA, which will apply from 11^th of September 2026, and cooperation with National CSIRTs.
• The use of automation and machine-readable tools to support the CRA processes

The discussions underlined the importance of a coordinated, risk-based and pragmatic approach to market surveillance, considering the different capacities and structures of Member States. Continued cooperation and exchange of expertise will be essential to ensure the effective and consistent implementation of the CRA across the European Union.

The CRA will apply gradually, with reporting obligations for actively exploited vulnerabilities and severe security incidents starting from 11^th of September 2026, and the main obligations becoming applicable by 11^th December 2027.

*It is noted that the Market Surveillance Authority for the purposes of the Cyber Resilience Act in Cyprus is the Digital Security Authority – National Cybersecurity Certification Authority.