National cybersecurity certification authority

(1) The BSI is the national cybersecurity certification authority under Article 58(1) of Regulation (EU) 2019/881.
(2) The BSI may, on application, authorise conformity assessment bodies that become active within the scope of application of Regulation (EU) 2019/881 and of section 52 of this Act to act as such, where the conditions of the relevant European cybersecurity certification scheme under Article 54 of Regulation (EU) 2019/881, or of section 52 of this Act, are satisfied. Conformity assessment bodies may not become active within the scope of application of Regulation (EU) 2019/881 without authorisation by the BSI.
(3) Insofar as necessary for performing its tasks under Article 58(7) of Regulation (EU) 2019/881 and section 52 of this Act, the BSI may require from conformity assessment bodies authorised under subsection (2), from holders of European cybersecurity certificates, and from issuers of EU declarations of conformity within the meaning of Article 56(8) of Regulation (EU) 2019/881, the necessary information and other support, in particular the submission of documents or samples. Section 3(1), first and third sentences of the Accreditation Body Act applies accordingly.
(4) The BSI may carry out investigations in the form of audits under Article 58(8)(b) of Regulation (EU) 2019/881, at conformity assessment bodies authorised under subsection (2), at holders of European cybersecurity certificates, and at issuers of EU declarations of conformity within the meaning of Article 56(8) of Regulation (EU) 2019/881, to review compliance with the provisions of Title III of Regulation (EU) 2019/881. Section 3(1), first to third sentences of the Accreditation Body Act applies accordingly.
(5) The BSI is empowered to enter and inspect the business premises and operational rooms of conformity assessment bodies authorised under subsection (2), and of holders of European cybersecurity certificates within the meaning of Article 56(8) of Regulation (EU) 2019/881, during the times the premises are normally available for the respective business or operational use, and to examine documents and samples found there, insofar as necessary for performing its tasks under Article 58(7) of Regulation (EU) 2019/881 and under this section. Section 3(1), first to third sentences of the Accreditation Body Act applies accordingly.
(6) The BSI may revoke cybersecurity certificates issued by it, or cybersecurity certificates issued by a conformity assessment body authorised under subsection (2) under Article 56(6) of Regulation (EU) 2019/881, or declare EU declarations of conformity within the meaning of Regulation (EU) 2019/881 invalid,
1. where those certificates or EU declarations of conformity do not satisfy the requirements under Regulation (EU) 2019/881 or of a European cybersecurity certification scheme under Article 54 of Regulation (EU) 2019/881, or
2. where the BSI cannot establish compliance under no. 1 because the holder of the European cybersecurity certificate or the issuer of the EU declaration of conformity has not fulfilled its duties to cooperate under subsection (3), or has obstructed the BSI in exercising its powers under subsection (4) or, in the case of a holder of a European cybersecurity certificate, also under subsection (5). Revoked cybersecurity certificates or EU declarations of conformity declared invalid under the first sentence may not be used.
(7) The BSI may revoke authorisations it has granted under subsection (2),
1. where the conditions of the relevant European cybersecurity certification scheme under Article 54 of Regulation (EU) 2019/881, or of section 52 of this Act, are not satisfied, or
2. where the BSI cannot establish compliance with those conditions because the conformity assessment body has not fulfilled its duties to cooperate under subsection (3), or has obstructed the BSI in exercising its powers under subsections (4) and (5).