Cyber Resilience Act vs NIS2: Products vs Organisations
The Cyber Resilience Act and NIS2 are often mentioned together, but they regulate different things. NIS2 sets security duties for organisations in critical sectors; the CRA sets security requirements for products with digital elements. Many technology companies will deal with both.
Side by side
| NIS2 (Directive (EU) 2022/2555) | Cyber Resilience Act (Regulation (EU) 2024/2847) | |
|---|---|---|
| Regulates | Organisations ("entities") in 18 sectors | Products with digital elements: hardware and software with a data connection |
| Who has duties | Essential and important entities, generally medium-sized and larger | Manufacturers (Art. 13), importers (Art. 19) and distributors (Art. 20), whatever their size |
| Legal form | Directive: applies through national law | Regulation: applies directly in all member states |
| Core requirements | Ten minimum cybersecurity risk-management measures (Art. 21), management duties (Art. 20) | Essential cybersecurity requirements for products and vulnerability handling (Annex I), conformity assessment, CE marking |
| Reporting | Significant incidents to the CSIRT or authority: 24 hours, 72 hours, one month (Art. 23) | Actively exploited vulnerabilities and severe incidents via ENISA's single reporting platform: 24 hours, 72 hours, final report (Art. 14) |
| Key dates | National laws due by 17 October 2024 | Reporting from 11 September 2026; most obligations from 11 December 2027 |
| Maximum fines | At least €10M or 2% (essential), €7M or 1.4% (important) | Up to €15M or 2.5% for Annex I and Articles 13 and 14; lower tiers for other obligations (Art. 64) |
Where the line falls for software and cloud
The CRA covers software and hardware products and their remote data processing solutions, meaning remote processing designed and developed by the manufacturer without which the product could not perform one of its functions. Recital 12 of the CRA is explicit about the boundary: cloud services designed and developed outside the responsibility of a product manufacturer are not in its scope, and NIS2 applies to cloud computing services and service models such as SaaS, PaaS and IaaS.
- A company selling installable software or connected devices is a CRA manufacturer for those products.
- A pure SaaS provider is generally outside the CRA for the service itself, but may be in scope of NIS2 as a cloud computing provider if it is at least medium-sized.
- A company doing both, for example an app with a backend it runs, may face the CRA for the product and its remote data processing, and NIS2 for its cloud services.
When both apply
A medium-sized or larger manufacturer of, for example, computers, electronic products or machinery (Annex II of NIS2) is an NIS2 entity and a CRA manufacturer. In practice:
- One security programme can serve both: NIS2's Article 21 measures for the organisation, CRA Annex I for the products you ship.
- One incident can trigger two reports: a severe incident affecting your product under CRA Article 14 and a significant incident under NIS2 Article 23, to different recipients.
- Vulnerability handling sits in both: NIS2 Article 21(2)(e) for your own systems, CRA Annex I for your products.
Not a manufacturer? you may still feel the CRA through your suppliers: from December 2027, products you buy must meet its requirements, which helps your own NIS2 supply chain duties.
What to do now
- List your products with digital elements on the EU market, and your services. Mark which are products (CRA) and which are services (possibly NIS2).
- Check your NIS2 scope: Does NIS2 apply to my company?
- If you are a manufacturer, set up CRA reporting now: it has applied since 11 September 2026. See CRA reporting obligations.
- Plan CRA conformity work (Annex I, technical documentation, conformity assessment, CE marking) for products you will place on the market from 11 December 2027.
One incident process for both laws. The Incident Response Playbook includes a master incident response plan, six scenario playbooks, regulatory notification templates and tabletop exercise scenarios.
Sources
- Regulation (EU) 2024/2847 (Cyber Resilience Act), Articles 2, 3, 13, 14, 19, 20, 64, 71, recital 12, Annex I, EUR-Lex
- Directive (EU) 2022/2555 (NIS2), Articles 2, 20, 21, 23, 34, Annexes I and II, EUR-Lex
Related tools
Further reading: CRA Reporting Obligations · What Is the NIS2 Directive?
ClevSec
Compliance & security tools for modern businesses
We build practical tools and templates that help startups and SMBs stay compliant with NIS2, GDPR, and DORA. Explore our free tools →
This article is for informational purposes only and does not constitute legal advice. Last updated: October 2026.