Updated: 30 March, 2026
26 March, 2026
If you are doing business in Europe, cybersecurity is no longer an optional feature, it is now a mandatory legal requirement. The fundamental difference between the Cyber Resilience Act and NIS2 is that the former regulates the security of digital products, while the latter regulates the security of organizations and services.
Navigating the EU’s digital strategy can feel like assembling a high-stakes puzzle. However, these two laws are not competing; they are complementary. One ensures that the digital tools you buy are safe, while the other ensures that your business operates securely. By understanding your specific role, you can turn regulatory pressure into a competitive advantage through the “compliance handshake.”
Key takeaways
- The Cyber Resilience Act regulates the security of hardware and software products, while the NIS2 Directive focuses on the cybersecurity of organizations and the essential services they provide.
- As a “Regulation,” the Cyber Resilience Act applies directly and uniformly across all EU Member States, whereas the NIS2 “Directive” requires each country to transpose the rules into their own national legislation.
- Manufacturers must demonstrate compliance through the CE marking system and provide technical documentation like a Software Bill of Materials (SBOM), while service providers under NIS2 must implement specific risk-management measures and maintain board-level accountability.
- Both frameworks mandate a 24-hour window for early warning reports, but the triggers differ: NIS2 focuses on operational incidents that disrupt services, while the Cyber Resilience Act focuses on technical vulnerabilities actively exploited within a product.
- These laws create a “compliance handshake” where an organization’s mandatory NIS2 supply chain audit is simplified by procurement policies that require products already certified under the Cyber Resilience Act.
Who falls under the NIS2 Directive and the Cyber Resilience Act?
To understand the EU’s cybersecurity strategy, you must first distinguish between regulated entities and regulated products. While these laws often overlap, they target different parts of the digital ecosystem.
NIS2 Directive: Securing the operators
The NIS2 Directive focuses on organizations that provide services vital to the economy and society. If your company manages critical infrastructure, you likely fall under its jurisdiction.
- Target: It applies to public and private “essential” and “important” entities.
- Sector Scope: Coverage includes energy, transport, banking, health, and digital infrastructure.
- Size-Cap Rule: Generally, it applies to all medium and large enterprises with over 50 employees or an annual turnover exceeding €10 million.
- Exceptions: Certain entities, such as DNS and trust service providers, are in scope regardless of their size.
For a detailed list of affected industries, see our NIS2 compliance guide.
Cyber Resilience Act: Securing the products
Conversely, the Cyber Resilience Act regulates the “supply side” of technology. It applies to any business placing digital tools on the EU market.
- Target: Responsibilities fall on manufacturers, importers, and distributors of “products with digital elements.”
- Product Scope: It covers any software or hardware product with a direct or indirect data connection. This ranges from smart home cameras to industrial routers and operating systems.
- Commercial Activity: The law only applies to products provided in the course of a commercial activity.
Can you fall under both?
Yes, a company can be subject to both frameworks. For example, a business that manufactures a digital product and also provides an essential service using that product must comply with both. Understanding this overlap is the first step toward the “compliance handshake.”
Key differences between the NIS2 Directive and the Cyber Resilience Act?
The primary difference between these two laws lies in their legal nature. The NIS2 Directive is a “Directive,” meaning each EU country must translate it into national law. Consequently, specific rules and enforcement may vary slightly across different borders. On the other hand, the Cyber Resilience Act is a “Regulation.” It applies directly and uniformly across the entire Union, ensuring every manufacturer follows the same set of rules.
The focus of each law also targets a different stage of the digital ecosystem:
- NIS2 Directive regulates the Operator. It demands that organizations maintain secure services and internal risk-management processes to protect critical infrastructure.
- Cyber Resilience Act regulates the Manufacturer. It ensures that hardware and software are built securely from the ground up before they ever reach the user.
Finally, the compliance mechanisms differ significantly. NIS2 requires organizations to implement internal security policies and report significant breaches within 24 hours. The Cyber Resilience Act relies on the CE marking system. Manufacturers must conduct formal conformity assessments to prove their products meet essential security standards before they can be sold in the EU.
Want to learn if the Cyber Resilience Act applies to you? Then check out this article we wrote on “Who needs to comply with the Cyber Resilience Act (CRA)?”.
Important compliance deadlines for the Cyber Resilience Act and NIS2
Navigating the transition period for these regulations is critical because their enforcement follows different timelines. While some deadlines have already passed, others are fast approaching in 2026 and 2027. Understanding this roadmap helps you prioritize your compliance efforts and avoid sudden regulatory pressure.
The NIS2 Directive is already in the implementation phase across the EU. Member States were required to transpose the directive into national law by October 17, 2024. Because it is a directive, you should check your specific local legislation to see the exact registration and reporting dates that apply to your business.
The Cyber Resilience Act follows a tiered rollout strategy to give manufacturers time to adapt. While the law is currently in force, the first major technical obligations begin this year.
- June 11, 2026: EU Member States must notify the “notified bodies” authorized to carry out third-party security assessments.
- September 11, 2026: Manufacturers must begin reporting actively exploited vulnerabilities and severe security incidents to authorities within 24 hours.
- December 11, 2027: Full enforcement begins. Every product with digital elements must meet all security requirements and bear the CE mark to stay on the market.
This staggered approach means you cannot wait until 2027 to start. The September 2026 reporting deadline effectively requires you to have a vulnerability management system and a Software Bill of Materials (SBOM) ready much sooner. Therefore, starting your internal audits now is the best way to ensure a smooth transition.
How Cyber Resilience Act certification simplifies your NIS2 supply chain audits
One of the most challenging parts of the NIS2 Directive is managing supply chain security. This law requires you to assess the cybersecurity practices of every vendor you use. Historically, this meant conducting long manual audits for every new software or hardware purchase. However, the Cyber Resilience Act changes this dynamic through what we call the “compliance handshake.”
The Cyber Resilience Act simplifies your NIS2 obligations by standardizing product security across the EU. Instead of investigating every vendor from scratch, you can rely on standardized proof. You should look for these three key elements during your procurement process:
- The CE Mark: This mark serves as visible proof that a product meets mandatory EU security standards.
- The EU Declaration of Conformity: This document provides legal assurance that the manufacturer has completed all required risk assessments.
- Software Bill of Materials (SBOM): Manufacturers must document their software components. This allows your team to track vulnerabilities within your infrastructure instantly.
Essentially, the manufacturer performs the heavy lifting of technical verification. Consequently, your NIS2 supply chain audit becomes a straightforward review of standardized documentation. If you are a manufacturer preparing these documents, you can find more details in our Cyber Resilience Act compliance guide.
Incident reporting rules for services and products under EU law
Both regulations require fast communication with authorities during a cybersecurity crisis. However, the trigger for reporting depends on whether the issue affects your business operations or the products you sell.
Under the NIS2 Directive, organizations must report “significant incidents” that disrupt their services or cause serious damage.
- 24-hour early warning: You must notify authorities within 24 hours of becoming aware of a significant incident.
- 72-hour notification: You must provide a detailed assessment and initial impact analysis within 72 hours.
- Final report: A comprehensive analysis is due one month after the incident.
The Cyber Resilience Act focuses on the technical security of the product itself rather than the provider’s operations.
- Actively exploited vulnerabilities: Manufacturers must report any vulnerability that a malicious actor is currently using within 24 hours.
- Severe incidents: Any event that impacts the development or security of a product must also be reported within 24 hours.
- User notification: Unlike the NIS2 Directive, this law often requires you to inform your customers directly so they can apply security patches immediately.
Ultimately, these rules ensure that threats do not spread across the EU unnoticed. By using a single reporting platform managed by ENISA, the Cyber Resilience Act aims to streamline this process. Consequently, businesses can focus more on fixing the security flaw and less on navigating complex paperwork.
3 practical steps to prepare for the NIS2 Directive and the Cyber Resilience Act
Complying with these two frameworks requires a proactive approach. You should not wait for the final deadlines to begin your transition. Follow these three steps to align your business with the new EU standards.
- Conduct a scope and inventory audit
First, you must determine exactly how these laws affect your business. Identify if your organization qualifies as an “essential” or “important” entity under the NIS2 Directive. Simultaneously, list every digital product you manufacture or use. This inventory helps you understand where you need to apply organizational security measures versus product-specific technical updates.
- Establish a vulnerability management system
Both regulations prioritize the rapid handling of security flaws. You must implement a process to discover, report, and patch vulnerabilities. If you are a manufacturer, this includes creating a Software Bill of Materials (SBOM) for every product. This documentation is essential for your own security and for your customers’ compliance audits. For a deeper dive into these specific requirements, see our guide on how to prepare for the Cyber Resilience Act.
- Update your procurement and vendor policies
The “compliance handshake” depends on your legal agreements. Therefore, you should update your procurement policies to require that all new digital tools eventually meet Cyber Resilience Act standards. Additionally, ensure your vendor contracts reflect the 24-hour incident reporting window mandated by the NIS2 Directive. By aligning your supply chain now, you reduce the risk of future regulatory fines and operational disruptions.
Conclusion
The NIS2 Directive and the Cyber Resilience Act represent two pillars of a single goal: a safer digital Europe. While their requirements target different areas, their impact is deeply interconnected. Organizations that embrace these standards early will benefit from more efficient operations and stronger vendor relationships.
Ultimately, the “compliance handshake” ensures that cybersecurity is a shared responsibility. Manufacturers provide the secure building blocks, and operators maintain the secure environment. To summarize your path forward, keep these key points in mind:
- Prioritize transparency: Use the Software Bill of Materials (SBOM) to maintain a clear view of your digital assets.
- Act early: Do not wait for 2027. The first reporting obligations begin as early as September 2026.
- Leverage standardization: Use CE marks and formal declarations to simplify your internal and external audits.
Embracing these regulations now will protect your business from legal risks. Furthermore, it will strengthen your reputation in an increasingly security-conscious market.
Are you ready for CRA?
With the CRA Framework in SAMMY, you can assess CRA compliance for your different products. The questions and quality criteria give you a complete checklist of everything that is required by CRA. SAMMY also makes it easy to compare products groups, manage compliance roadmaps and collaborate with team members.
Find out more about the SAMMY tool for CRA assessments.
