CRA vs. NIS2: Understanding the Differences and Overlaps

The EU's cybersecurity regulatory landscape includes both the CRA and NIS2 (Network and Information Security Directive 2). While they share the goal of improving cybersecurity, they regulate different things and apply to different entities.

CRA — Products

The CRA regulates products with digital elements. It applies to manufacturers, importers, and distributors. The focus is on ensuring products are designed, developed, and maintained securely throughout their lifecycle.

NIS2 — Operators and Services

NIS2 regulates essential and important entities — organizations that operate critical infrastructure or provide important services (energy, transport, health, digital infrastructure, etc.). The focus is on organizational cybersecurity measures, incident response, and risk management.

Where They Overlap

• Supply chain security — Both require attention to supply chain risks. NIS2 entities must ensure the products they use are secure; CRA ensures the products themselves are secure
• Incident reporting — Both have reporting obligations, but to different authorities and with different timelines
• Risk management — Both require risk-based approaches to cybersecurity

Practical Implications

If you're a NIS2 essential entity that also manufactures digital products, you need to comply with both. Your organizational security program (NIS2) and your product security program (CRA) should be aligned but are assessed separately.