The notice arrives on an ordinary Tuesday. It is an email, or a formal letter, from your Member State's market surveillance authority, and it is written in the flat register of an agency that has already made up its mind to look. It says the authority has sufficient reason to consider that one of your products with digital elements presents a significant cybersecurity risk, that it is opening an evaluation, and that you are required to cooperate. Attached is a request for your technical documentation. There is a date by which you must respond.
Nothing about that first contact is dramatic. That is exactly why teams mishandle it. The people who receive it are usually in support or sales, the subject line does not read as an emergency, and the instinct is to route it to legal and wait. Meanwhile a clock you did not start is already running, and the next step the authority can take does not require your agreement.
What the authority can actually demand
Start with who is on the other side of the letter. The Cyber Resilience Act does not build a new enforcement machine from scratch. Under Article 52 it plugs product-security enforcement into the EU's existing market-surveillance system: each Member State designates one or more market surveillance authorities, and those authorities inherit the investigative and enforcement powers of the Union's general market-surveillance regulation. In practice that means an agency you already know by another name. Germany's work runs through the BNetzA orbit; France coordinates ANSSI expertise with consumer-protection enforcers like the DGCCRF. The exact agency and its internal procedure are national and vary, so confirm yours before you need it rather than during the incident.
Their first tool is documentary. On a reasoned request, the authority can compel access to the data it needs to assess how your product was designed, developed, produced, and how you handle vulnerabilities, including your internal documentation, in a language it can read. This is not a polite invitation to share a datasheet. It is the reason the ten-year technical file exists as a cold, complete, retrievable artifact rather than a folder someone assembles under pressure. If you cannot hand over a coherent file on demand, the gap itself reads as non-conformance. That archive, and why it has to be built to survive staff turnover and tooling changes, is its own subject.
The escalation ladder in Article 54
The core of the regime is one article, and every crisis-response plan should be built around its shape. Article 54 sets a three-rung ladder, and each rung tightens.
The first rung is evaluation. Where the authority has sufficient reason to suspect a significant risk, it carries out an evaluation of the product's compliance without undue delay, and you are required to cooperate. This is the stage where your file, your point of contact, and your candor decide how the rest goes.
The second rung is the order. If that evaluation finds non-compliance, the authority will, without delay, require you to take one of three actions: bring the product into compliance, withdraw it from the market, or recall it, within a reasonable period the authority itself prescribes, sized to the severity of the risk. Withdrawal and recall are not synonyms. Withdrawal stops further units reaching the market. Recall reaches back for units already in users' hands. The authority chooses which the risk demands, and the period it gives you is theirs to set, not yours to negotiate from scratch. Your obligation runs Union-wide: whatever remedy is ordered, you must apply it to every affected unit you placed on the market anywhere in the Union, not only in the country that wrote to you.
The third rung is the one you are trying to avoid. If you do not take adequate corrective action within the period you were given, the authority takes over. It can adopt provisional measures itself to prohibit or restrict the product on its national market, to withdraw it, or to recall it, and it notifies the Commission and every other Member State that it has done so. At that point the action is no longer yours to shape.
The response ladder, and the clock on each rung
Map each action the authority can take to the move it demands from you and the clock attached to it. Print this. The value is having it before the notice, not after.
| Authority action | What it means | Your move | The clock |
|---|---|---|---|
| Reasoned request for documentation | They want the technical file: design, development, production, and vulnerability-handling records, plus internal docs | Hand over the archived file as-is, in a readable language; do not improvise or backfill | Respond by the deadline in the request |
| Evaluation of significant risk | They suspect a significant cybersecurity risk and are assessing conformity | Assign one named point of contact; preserve evidence; cooperate visibly | They act "without undue delay"; you have until their deadline |
| Order to correct, withdraw, or recall | A binding order to fix the product, stop new units, or reach back for shipped units | Execute the ordered remedy Union-wide; document every step | "a reasonable period ... as the market surveillance authority may prescribe" |
| Provisional measures | You missed the period, so the authority restricts, withdraws, or recalls the product itself | Damage control; this is the rung you plan to never reach | Notified EU-wide, then deemed justified if unchallenged (below) |
| Safeguard / Union-level review | Cross-border disagreement, or the Commission steps in directly | Engage counsel; this is where your procedural rights run | Commission decides within nine months |
One line in that table sets the tempo for everything else. Once a national provisional measure is notified, if no Member State and not the Commission objects within three months, the measure is deemed justified across the Union. Silence hardens it. And a measure that reaches that point sits directly upstream of the penalty regime: an authority that has formally found your product non-compliant has handed the evidence to whoever calculates the fine. How that number is built is a separate calculation, but the trigger for it is the finding you are responding to now.
Where you push back — and how slow it is
You are not without recourse, but the recourse is deliberate and unhurried. The market-surveillance framework carries a right to be heard before a measure bites, and it is the single most valuable procedural asset you have. Use it early, with your file, not late, with a lawyer's letter.
Beyond the national level, Article 55 sets the Union safeguard procedure. When a Member State objects to another's measure, or the Commission believes a national measure breaks Union law, the Commission consults the parties, evaluates the measure, and decides whether it was justified within nine months of the original notification. If the measure stands, every Member State withdraws the product. If it falls, the initiating state must pull its measure back. Article 56 sits above even that: where the Commission has reason to believe a significant risk persists and no effective national measures have been taken, it can evaluate compliance itself and, in circumstances that justify immediate intervention, adopt implementing acts requiring withdrawal or recall across the whole Union.
Read those two routes for what they are. They are real, and they matter for a genuinely contested finding. They are also measured in months. You cannot keep a product on the shelf by invoking them; withdrawal and recall bite while the review runs. The dispute machinery protects your rights over the long arc. It does not pause the clock on the shelf.
The first 72 hours
Everything above is knowable today, which is the point. The response is an operations drill, and drills are run before the event. When the notice lands, the first three days are about not compounding the problem.
- Route it in minutes, not days. The notice will arrive at a generic inbox. Have a rule that any regulator contact escalates immediately to a named crisis lead, not a support queue.
- Assign one point of contact. The authority should hear one voice. Multiple threads from engineering, legal, and sales produce contradictions that become findings.
- Produce the file, do not build it. If you are assembling the technical documentation after the request arrives, you have already lost the first battle. Hand over what exists; note honestly what does not.
- Pre-decide withdrawal versus recall. For each product line, know in advance which distributors hold stock, which units are in the field, and how you would reach both. The remedy the authority orders should map to a plan you already wrote.
- Log the clock. Record the date of every request and the period you were given, in writing, the day it arrives. The deemed-justified window and the corrective-action period are the two dates that govern everything.
You can walk the same evaluation-to-remedy path end to end in a live conformity walkthrough, and the essential-requirement baseline the authority measures you against is set out in the CRA reference.
Build the response playbook now, while no authority is watching, because the day one is watching is the day you no longer have time to build it.