NIS2 vs Cyber Resilience Act: which rules apply to you?

NIS2 vs Cyber Resilience Act comes down to one distinction: NIS2 regulates organisations that run important services, while the Cyber Resilience Act regulates the security of products with digital elements sold in the EU. A hospital, energy supplier or managed IT provider is a NIS2 question; a smart lock, router firmware or mobile app is a CRA question. Many tech companies face both, one as a business and the other as a manufacturer.

Key takeaways

• NIS2 asks whether your organisation is secure; the CRA asks whether your product is secure.
• NIS2 applies by sector and size, mostly to medium and large entities; the CRA applies to any manufacturer placing products on the EU market.
• NIS2 is a directive needing national law, and Ireland has not yet transposed it; the CRA is a regulation that applies directly.
• Both use a 24-hour early warning and 72-hour notification, but for different events and through different channels.
• Standalone SaaS and cloud services sit mainly under NIS2; devices, apps and firmware sit under the CRA.

What is the core difference between NIS2 and the CRA?

NIS2 governs entities; the CRA governs products. NIS2, Directive (EU) 2022/2555, requires essential and important entities in listed sectors to manage cyber risk across their network and information systems and to report significant incidents. The CRA, Regulation (EU) 2024/2847, requires manufacturers of "a software or hardware product and its remote data processing solutions" to build security in, handle vulnerabilities for a support period, and carry the CE marking.

Put simply: NIS2 looks at how you run your organisation. The CRA looks at what you sell.

How do they compare side by side?

	NIS2	Cyber Resilience Act
Legal form	Directive: each Member State must transpose it	Regulation: applies directly across the EU
Regulates	Organisations (essential and important entities)	Products with digital elements and their manufacturers, importers and distributors
Who is in scope	Entities in Annex I and II sectors, generally medium-sized or larger (Article 2)	Any manufacturer making in-scope products available on the EU market, whatever its size
Key dates	Transposition due 17 October 2024 (Article 41)	Reporting from 11 September 2026; main obligations from 11 December 2027 (Article 71)
Core duties	Ten areas of risk-management measures (Article 21), management accountability	Annex I security requirements, vulnerability handling, SBOM, support period of at least five years, conformity assessment
What is reported	Significant incidents affecting your services	Actively exploited vulnerabilities and severe incidents affecting your product
Reporting clock	24-hour early warning, 72-hour notification, final report within one month (Article 23)	24-hour early warning, 72-hour notification, final report within 14 days of a fix or one month (Article 14)
Where reports go	National CSIRT or competent authority	ENISA Single Reporting Platform, routed to the coordinating CSIRT
Maximum fines	At least EUR 10m or 2% (essential), EUR 7m or 1.4% (important) (Article 34)	Up to EUR 15m or 2.5% for core obligations (Article 64)
Proof of compliance	Supervision, audits, registration	EU declaration of conformity and CE marking

How do I know if NIS2 applies to my business?

Check sector, then size. NIS2 covers entities in the sectors of Annex I and Annex II that are medium-sized enterprises or larger. Annex I includes energy, transport, banking, health, digital infrastructure and B2B ICT service management (managed service providers and managed security service providers). Annex II includes manufacturing of computer, electronic and optical products and of electrical equipment, as well as digital providers such as online marketplaces.

Small and micro firms are usually outside NIS2 directly, but they often feel it through contracts, because Article 21(2)(d) makes supply chain security a mandatory measure for in-scope entities.

In Ireland, the Directive has not yet been transposed. The Commission referred Ireland to the Court of Justice in July 2026. Our NIS2 Ireland update tracks where that stands.

How do I know if the CRA applies to my product?

Ask whether you make available a product with software or digital elements on the EU market in the course of a commercial activity. Connected devices, firmware, mobile and desktop apps, and the cloud back ends those products need are in. Standalone SaaS is generally out: Recital 12 says NIS2 "applies to cloud computing services and cloud service models". Medical devices, vehicles and certified aviation products are excluded under Article 2.

The CRA has no size threshold. A two-person startup selling a connected sensor has the same core duties as a multinational, with some relief: microenterprises and small enterprises cannot be fined for missing the 24-hour early-warning deadline (Article 64(10)) and may use a simplified technical documentation format (Article 33(5)). For the software edge cases, see does the CRA apply to software and SaaS.

Which situations trigger which law?

Your situation	NIS2	CRA
Startup selling a connected home camera in the EU	Unlikely unless medium-sized or larger in a listed sector	Yes, and cameras are an important Class I product
Mid-sized electronics manufacturer	Likely, as Annex II manufacturing	Yes, for the products it makes
Managed IT service provider, 80 staff	Likely, as Annex I ICT service management	Only if it also sells software or devices
SaaS platform with no client app	Possibly, if it is a cloud computing service provider of sufficient size	Generally no
SaaS platform with a mobile app	As above	Yes, for the app and the back end it needs
Hospital buying connected devices	Yes, as a health entity	No as buyer, but it will expect CRA-compliant suppliers

These are typical outcomes, not conclusions for any specific business.

Do the two laws overlap?

They connect rather than duplicate. NIS2 entities must manage supply chain risk and "vulnerability handling and disclosure" in what they acquire (Article 21(2)(e)); CRA-compliant products, with their SBOMs, support periods and security updates, are designed to make that easier. If you are both a NIS2 entity and a manufacturer, an incident could in principle require both a NIS2 report about your services and a CRA report about your product, through different channels. Build one incident process that asks both questions.

The reporting structures are similar enough to share a playbook. Both start with a 24-hour early warning, which Ireland's NCSC says should not wait for "a deep technical analysis" (NCSC CRA page).

What should a company that falls under both do first?

Start with what already applies. CRA reporting has applied since 11 September 2026, so make sure you can report actively exploited vulnerabilities through ENISA's Single Reporting Platform. Then:

1. Confirm your NIS2 status by sector and size, and prepare for national registration once Irish law is in force.
2. Map the Article 21 measures and CRA Annex I requirements onto one control set; secure development, vulnerability handling, cryptography and access control appear in both.
3. Assign clear owners: an organisational security lead for NIS2 and a product security lead for the CRA, even if one person holds both roles in a small company.
4. Keep one register of incidents and vulnerabilities, tagged by which law each might trigger.

For a wider map that includes the GDPR, AI Act and Data Act, see our digital regulation map for EU startups.

Frequently asked questions

Can a company be subject to both NIS2 and the Cyber Resilience Act?

Yes. A medium-sized electronics manufacturer, for example, can be an important entity under NIS2 for its own operations and a manufacturer under the CRA for its products. The obligations are separate and can both apply to one incident.

Does NIS2 apply to products?

Not directly. NIS2 regulates how in-scope organisations manage their own cyber risks and report incidents. Product security requirements come from the CRA and, until December 2027, the Radio Equipment Directive for some wireless devices.

Which law covers SaaS?

Mainly NIS2, where the provider is in scope as a cloud computing service provider of sufficient size. The CRA's Recital 12 points cloud services to NIS2, although a SaaS company's apps or SDKs can be CRA products.

Are the reporting deadlines the same?

The first two are: 24 hours for an early warning and 72 hours for a notification under both. Final reports differ: one month under NIS2, and 14 days after a fix or one month for incidents under the CRA. The events reported and the channels also differ.

Which applies first in Ireland?

The CRA reporting duty already applies directly, since 11 September 2026. NIS2 obligations will only bite in Ireland once the National Cyber Security Bill is enacted.

Building a connected product and want a second opinion on its security plan? Book a free 30-minute call with our team.

Cover photo by RDNE Stock project on Pexels.