Can we trigger the safeguard procedure ourselves?

No. Article 55(1) knows only two triggers: an objection from another Member State inside the three-month window, or the Commission taking the view that the measure is contrary to Union law. The Regulation gives the economic operator concerned no right to initiate anything. Once the procedure is open the operator is at least consulted, although the language versions diverge here: the English text has the Commission consult the Member State “and” the economic operator, the German text says “or”. Your own route stays the remedy against the national measure, which the authority must point out under Article 18 of Regulation (EU) 2019/1020.

What happens if the Commission lets the nine months run out?

The CRA attaches no consequence to that. Article 55(1) obliges the Commission to decide within nine months of receiving the notification, but provides neither a deemed approval in the product’s favour nor any lapsing of the national measure. In practice the provisional restriction simply continues until a decision arrives. Redress against an inactive institution then follows general Union law rather than this Regulation.

Can we keep selling the product in the other Member States while the procedure runs?

The provisional measure itself covers only the national market of the authority that took it. Independently of that, Article 54(4) obliges the economic operator to extend the required corrective action to every affected product it has made available anywhere in the Union. The restriction reaches the whole Union only through two other provisions: Article 54(9) obliges the market surveillance authorities of all Member States to take appropriate restrictive measures without delay, with withdrawal from the market named there only as an example; Article 55(2) requires withdrawal outright once the Commission has decided. Until then nothing stops the authorities of other Member States from opening their own Article 54 procedure.

Cyber Resilience Act

Union safeguard procedure

Practical term

The Union safeguard procedure is the escalation stage of market surveillance under the Cyber Resilience Act (CRA). Article 55 governs what happens when a national measure against a product with digital elements is disputed: the Commission then decides whether that measure was justified, and its decision reaches every Member State.

It is not a separate enforcement route but the continuation of the national procedure in Article 54. Making sense of it means knowing the chain that leads into it.

How a case gets there

It begins with a market surveillance authority that has sufficient reason to consider a product presents a significant cybersecurity risk. The authority evaluates the product, where appropriate together with the relevant CSIRT, and on finding non-compliance requires corrective action within a period it prescribes itself and which must be commensurate with the nature of the risk (Article 54(1)).

Where adequate action does not follow, the authority takes provisional measures for its own market: it prohibits or restricts the product being made available, or requires the product to be withdrawn from the market or recalled. Those measures go to the Commission and the other Member States without delay, together with all available details, in particular those listed in Article 54(6): identification of the product, its origin, the nature of the alleged non-compliance and the risk involved, the nature and duration of the measure, and the arguments the economic operator put forward. The authority must also indicate whether the non-compliance is due to one or both of the two causes named there: a failure of the product or of the processes put in place by the manufacturer to meet the essential cybersecurity requirements in Annex I, or shortcomings in the harmonised standards, European cybersecurity certification schemes or common specifications referred to in Article 27.

That notification starts a three-month clock. If neither a Member State nor the Commission objects within it, Article 54(8) deems the measure justified and no safeguard procedure takes place at all.

The two triggers

Article 55(1) names exactly two situations: a Member State objects within the three months to another Member State’s measure, or the Commission considers the measure contrary to Union law. The economic operator concerned does not appear on that list.

Once either applies, the Commission enters into consultation without delay and evaluates the national measure. Its decision falls due within nine months, counted not from the objection but from receipt of the notification under Article 54(5). Once the objection window has closed, six months remain on paper.

Two possible outcomes

If the Commission holds the national measure justified, all Member States must take the measures needed to have the product withdrawn from their market and inform the Commission accordingly. A national restriction becomes a Union-wide exclusion.
If it holds the measure not justified, the Member State that took it has to withdraw it.

When the fault lies in the rulebook, not the product

Article 55 becomes revealing where the measure is held justified and the non-compliance traces back to the very framework the manufacturer built on. The CRA provides three follow-on routes:

Where the cause lies in a harmonised standard, the Commission applies the formal objection procedure in Article 11 of Regulation (EU) No 1025/2012. That can end with the standard’s reference in the Official Journal being restricted or withdrawn, and the Commission may where necessary ask the standardisation organisation to revise it.
Where it lies in a European cybersecurity certification scheme, the Commission considers whether to amend or repeal the delegated act adopted under Article 27(9).
Where it lies in common specifications, it considers the same for the implementing act adopted under Article 27(2).

The reach goes well beyond the single product. Restricting or withdrawing a reference costs every manufacturer that built on that standard the presumption of conformity to that extent. The Annex I requirements stay exactly as they were; what falls away is the convenient way of demonstrating them. Recital 110 singles this case out as the one where the Commission still has work to do even once Member States and Commission agree that the measure was justified.

What it means for the manufacturer

The provisional national measure stays in force throughout. The CRA gives the procedure no suspensive effect, so a product blocked in one market stays blocked there for the duration, whichever way the case ends.

At national level the economic operator is not without recourse. Article 18 of Regulation (EU) 2019/1020 applies to the measure itself: it must state the exact grounds on which it rests, the operator must be told which remedies are available and within which time limits, and before the measure is taken the operator must be given an opportunity to be heard within a period of no less than ten working days. Only urgency allows that hearing to come afterwards, and the measure must then be reviewed promptly.

The neighbouring procedures

Article 56 does something else: there the Commission is the starting point, acting on its own suspicion that a non-compliant product presents a significant cybersecurity risk, where appropriate on information from ENISA. Where the relevant market surveillance authorities have taken no effective measures and circumstances justify immediate intervention, it can adopt corrective or restrictive measures across the Union by implementing act, after consulting the Member States and economic operators concerned. Article 57 covers products that do comply with the CRA and still present a significant cybersecurity risk together with one of the further risks listed there, for instance to the health or safety of persons or to services provided by essential entities.

The safeguard procedure sits between them. It does not ask whether a product is safe, but whether an authority acted correctly.

Practical questions

: No. Article 55(1) knows only two triggers: an objection from another Member State inside the three-month window, or the Commission taking the view that the measure is contrary to Union law. The Regulation gives the economic operator concerned no right to initiate anything. Once the procedure is open the operator is at least consulted, although the language versions diverge here: the English text has the Commission consult the Member State “and” the economic operator, the German text says “or”. Your own route stays the remedy against the national measure, which the authority must point out under Article 18 of Regulation (EU) 2019/1020.
: The CRA attaches no consequence to that. Article 55(1) obliges the Commission to decide within nine months of receiving the notification, but provides neither a deemed approval in the product’s favour nor any lapsing of the national measure. In practice the provisional restriction simply continues until a decision arrives. Redress against an inactive institution then follows general Union law rather than this Regulation.
: The provisional measure itself covers only the national market of the authority that took it. Independently of that, Article 54(4) obliges the economic operator to extend the required corrective action to every affected product it has made available anywhere in the Union. The restriction reaches the whole Union only through two other provisions: Article 54(9) obliges the market surveillance authorities of all Member States to take appropriate restrictive measures without delay, with withdrawal from the market named there only as an example; Article 55(2) requires withdrawal outright once the Commission has decided. Until then nothing stops the authorities of other Member States from opening their own Article 54 procedure.

This glossary is for orientation and does not constitute legal advice. The wording of Regulation (EU) 2024/2847 prevails.