Provetry
FRDEGet early access
Free check
Get early access

Provetry opens in November 2026. The free CRA check, the tools and the guides are available now.

The CRA and NIS2: who does what

7 min read

On this page
  1. Side by side
  2. Who is under NIS2
  3. Where they meet
  4. If both apply to you
  5. How Provetry helps
  6. Sources

The European Union has two big cybersecurity laws that companies keep confusing: the Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) and the NIS2 Directive (Directive (EU) 2022/2555). The short version: the CRA is about the security of the products you sell; NIS2 is about the security of the organisation that runs essential or important services. Many companies are under one; some are under both.

Side by side

Cyber Resilience Act NIS2
What it covers Products with digital elements placed on the EU market Essential and important entities in listed sectors
Who carries the duties Manufacturers, importers, distributors (and open-source stewards) The entities themselves, and their management bodies
Legal form Regulation: applies directly, the same text everywhere Directive: transposed into national law, with national differences
Main obligations Secure design (Annex I), vulnerability handling, SBOM, technical documentation, CE marking Risk-management measures, supply chain security, incident reporting, governance
Reporting Actively exploited vulnerabilities and severe incidents affecting the product, through ENISA’s Single Reporting Platform Significant incidents affecting the entity’s services, to the national CSIRT or competent authority
Deadlines for reports Early warning 24 h, notification 72 h, final report 14 days after a fix (vulnerabilities) or one month after the notification (incidents) Early warning 24 h, notification 72 h, final report one month after the notification
Dates Reporting since 11 September 2026; everything else from 11 December 2027 Transposition deadline 17 October 2024
Maximum fines €15 million or 2.5% of worldwide turnover At least €10 million or 2% for essential entities; at least €7 million or 1.4% for important ones (national laws set the ceiling)

Who is under NIS2

NIS2 applies to medium-sized and large organisations (and some smaller ones regardless of size) in the sectors listed in its annexes: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure (including cloud computing and data centre providers), ICT service management, public administration, space, postal and courier services, waste management, chemicals, food, manufacturing of certain products, digital providers (online marketplaces, search engines, social networks) and research. Each Member State’s transposition law defines the details and the registration process.

A pure software-as-a-service company is not under the CRA for its service, but may well be under NIS2 as a digital or ICT service provider. See the CRA and SaaS.

Where they meet

The supply chain

NIS2 entities must manage the security of their supply chain, including the security practices of their suppliers and the products they buy. The CRA gives them something concrete to ask for: CE-marked products, a support period, an SBOM on request, a disclosure policy, security updates. Expect NIS2 customers to put CRA requirements in their contracts, sometimes before December 2027.

Coordinated vulnerability disclosure

NIS2 gives each Member State a CSIRT that coordinates vulnerability disclosure and created the EU Vulnerability Database, run by ENISA. The CRA’s disclosure policy and reporting duties plug into that same network of CSIRTs.

Reporting

The two reporting duties are separate. An incident can trigger both:

  • a manufacturer that is also an NIS2 entity, and whose own systems are hit by an incident that also affects the security of its products, may have to report under NIS2 (for its services) and under the CRA (for its products);
  • the timelines look alike (24 hours, 72 hours) but the recipients, forms and triggers differ.

Plan one incident process with two exits, and decide in advance who checks each.

If both apply to you

  1. Map your products (CRA) and your services (NIS2) separately.
  2. Use one risk-management framework for both: the NIS2 measures (Article 21) and the CRA’s Annex I overlap a lot, in access control, cryptography, vulnerability handling and incident handling.
  3. Merge the incident and vulnerability processes, with a decision step: is this a CRA report, an NIS2 report, both, or neither?
  4. Keep the evidence in one place: decisions, timestamps, reports sent.

How Provetry helps

Provetry covers the CRA side: SBOMs, vulnerability watch, the CRA reporting clock with drafts for ENISA, disclosure policy, advisories and the technical file. Its evidence journal records what you decided and when, which also helps when an NIS2 customer audits you as a supplier.

This guide is general information, not legal advice.

Sources