CRA vs NIS2

The CRA binds the product; NIS2 binds the operator who deploys it. A sensor sold to a water utility meets the CRA on its own and then meets NIS2 through the utility's supplier contract. Both carry 24-hour reporting clocks, but for different events reported to different bodies.

	EU Cyber Resilience Act	EU NIS2 Directive
Applies when	Any product with digital elements placed on the EU market, consumer or industrial	Operators in essential and important sectors in the EU; obligations flow down to their suppliers
Who demands it	Market access, mandatory (CE marking)	Operator obligations, passed to component suppliers by contract
What it is	Regulation	Directive
Scope	Security by design, SBOMs, 24-hour reporting of actively exploited vulnerabilities to the CSIRT and ENISA, coordinated disclosure, post-market monitoring for the support period	Risk management, supply-chain security, incident reporting within 24 hours (early warning) and 72 hours (notification) for operators
In force	In force 10 Dec 2024; reporting duties from 11 Sep 2026; main obligations from 11 Dec 2027	Transposition deadline 17 Oct 2024
Penalties	Up to EUR 15M or 2.5% of global turnover	Essential entities up to EUR 10M or 2%; important entities up to EUR 7M or 1.4%
Authoritative text	CRA text ↗ · on this site	NIS2 text ↗

What a product team should do

Expect NIS2 flow-down clauses in every tender from an essential-sector customer: incident notification to the operator, security patches within a stated window, and evidence of your own risk management. The CRA conformity file is the cheapest way to answer them.

Check your own product

The IoT security scorecard grades a product against these frameworks in 19 questions, and the requirements generator turns the applicable ones into PRD-ready requirements. Both cite the same provisions this page does. The full map is on the regulatory landscape reference.

Sources: EU Cyber Resilience Act (official text) and EU NIS2 Directive (official text). Educational reference, not legal advice. See Chapter 18 and Chapter 19 of Tangibles.

← All comparisons