normakte / CRA and NIS2
Both frameworks deal with cybersecurity and have similar reporting deadlines – but they concern different things: the CRA the product, NIS2 the company.
| CRA | NIS2 | |
|---|---|---|
| Subject | products with digital elements | entities and their networks and services |
| Who | manufacturers, importers, distributors | medium and large entities in the listed sectors |
| Legal form | regulation, directly applicable | directive, national transposition |
| Reports | via ENISA's platform | to the competent national authority |
| Deadlines | 24 h, 72 h, final report | 24 h, 72 h, final report after one month |
The NIS2 Directive (EU) 2022/2555 requires medium-sized and large entities in certain sectors to secure their own networks and services and to report significant incidents. It is implemented by national laws, whose status differs between Member States.
The sectors include the manufacture of machinery, electrical equipment and computer and electronic products. A manufacturer of medium size or larger can therefore fall under NIS2 for its operations and under the CRA for its products.
Two reporting channels: incidents in your own operations under NIS2 to the national authority; actively exploited vulnerabilities and incidents affecting the product under the CRA via ENISA's platform. NIS2 entities also look at supply chain security – and increasingly require CRA-compliant products from suppliers.
Register, classification, SBOM, reports with deadlines and a target page for users – one trial file free until 20.01.2027.
Source. Regulation (EU) 2024/2847, OJ L, 2024/2847 of 20.11.2024. Summarised; only the official text is authoritative. normakte is not legal advice.