Swiss cyberattack reporting and the CRA: different duties for operators and product manufacturers

What it is

Status as of 25 October 2026. Switzerland's Information Security Act (ISA) and Cybersecurity Ordinance establish a cyberattack reporting duty for covered critical-infrastructure operators, in force since 1 April 2025. Re-check the current Swiss scope and exceptions, the authority's reporting instructions, and CRA guidance before maintaining a cross-border reporting plan. Swiss authority's legal-basis page.

The Swiss recipient is the Federal Office for Cybersecurity, BACS; its English guidance uses National Cyber Security Centre (NCSC). The CRA instead addresses in-scope products made available on the EU market. Its manufacturer reporting obligations have applied since 11 September 2026. Swiss location does not remove a manufacturer from those product-market rules: Article 14(7) expressly provides a recipient-selection route for manufacturers without a main EU establishment. Regulation, Articles 2 and 14.

Why it matters

The following comparison separates the roles described by the two regimes:

Question	Swiss ISA reporting	CRA manufacturer reporting
Who is covered?	Operators within the statutory scope and ordinance exceptions	Manufacturers of in-scope products supplied to the EU market
What triggers assessment?	A qualifying cyberattack against the covered infrastructure	Active exploitation of a product vulnerability or a severe product security incident
First deadline	Within 24 hours of discovery	Promptly, no later than 24 hours after awareness
Recipient and route	NCSC through its published reporting channels	Coordinating CSIRT and ENISA through the SRP

These distinctions follow the Swiss FAQ and Commission reporting guidance. A company's operator and manufacturer roles therefore need separate assessment, even when one event supplies evidence relevant to both.

How to apply

• Check Swiss scope before relying on a sector label. The ISA identifies covered authorities and organisations; the ordinance provides exceptions. The Swiss FAQ says the NCSC can give an organisation a formal decision about whether it is subject to the duty. Do not turn a general sector example into a definitive classification.
• Apply the Swiss attack criteria. The authority lists threats to critical-infrastructure operability, information manipulation or leakage, attacks remaining undetected for a prolonged period, and blackmail, threats or coercion. A discovered software weakness alone is not the same as a qualifying cyberattack.
• Record and complete the Swiss notification. The authority requires an initial report within 24 hours even if information is incomplete. Its procedure gives 14 days after the initial submission to complete the report; the FAQ specifies calendar days. The Cyber Security Hub provides the reporting form, with an alternative email-template route described by the authority. Swiss reporting procedure.
• Assess the EU product duty independently. A Swiss manufacturer supplying an in-scope product must apply Article 14's triggers. Where it lacks a main EU establishment, the statutory order considers the authorised representative, importer, distributor, then users, using the largest relevant product or user counts within each applicable criterion. Preserve the reasoning for the chosen coordinating CSIRT.
• Keep separate clocks and receipts. As a practical record design, link both reporting assessments to the same evidence but retain each recipient, submission, deadline and follow-up. CRA reporting also has a 72-hour stage and different final-report triggers for vulnerabilities and incidents; the Swiss completion period cannot substitute for them.

Pitfalls

A Swiss reporting receipt should not be assumed to fulfil CRA reporting. The cited rules prescribe different triggers and recipients. Similarly, do not treat every Swiss business as critical infrastructure or every internal IT incident as a severe product incident. The Swiss guidance pages cited here display no revision date; check their current wording and any organisation-specific determination before reuse.