Cyber Resilience Act and NIS2
The EU's security layer. The Cyber Resilience Act puts cybersecurity requirements on products with digital elements; NIS2 puts them on the organisations that run essential and important services. One is about what you ship; the other is about how you operate.
In one line
CRA makes security a condition of selling digital products in the EU; NIS2 makes risk management and incident reporting a duty for a wide set of entities.
Cyber Resilience Act — Regulation (EU) 2024/2847
| Date | Event |
|---|---|
| 2024-12-10 | entered into force |
| 2026-09-11 | vulnerability and incident reporting obligations apply |
| 2027-12-11 | the full set applies, including CE marking and conformity assessment |
What it does:
- requires manufacturers of products with digital elements to meet essential cybersecurity requirements across the lifecycle — secure by design, vulnerability handling, security updates;
- introduces conformity assessment and CE marking for the products in scope;
- imposes active exploitation and incident reporting to ENISA and national authorities.
NIS2 — Directive (EU) 2022/2555
| Date | Event |
|---|---|
| 2023-01-16 | entered into force (twentieth day after the OJ publication of 27 December 2022) |
| 2024-10-17 | deadline for Member States to transpose into national law |
What it does:
- covers essential and important entities across many sectors (energy, transport, health, digital infrastructure, public administration, manufacturing, and more);
- requires risk-management measures, including supply-chain security and management accountability;
- requires incident notification within defined deadlines;
- coordinates supervision through national authorities and the Cooperation Group.
Why this pair matters for AI
- An AI-enabled product sold in the EU can need AI Act conformity plus CRA conformity — two different assessment regimes over the same device.
- Supply-chain security under NIS2 reaches the model and data providers a company depends on.
Unverified / TODO
- Confirm the CRA's Official Journal date — the snapshot's masthead carries the OJ of 20 November 2024 (L series, 2024/2847); twenty days later is the 2024-12-10 entry into force
- Confirm the CRA's exact scope thresholds — the CRA sets no turnover or headcount threshold; scope is Article 2, and the tiering is by product category (Annex III important, Class I/II, and Annex IV critical), with the technical descriptions left to a Commission implementing act due by 2025-12-11 under Article 7(4) [gap:not_located]
- Confirm the NIS2 transposition deadline against the directive — Article 41(1): Member States had to adopt and publish the measures by 17 October 2024
- Note which Member States have not yet transposed NIS2 [gap:not_located]
- Cross-reference the AI Act's cybersecurity requirements for high-risk systems
Source quotes
This Regulation shall apply from 11 December 2027. However, Article 14 shall apply from 11 September 2026 and Chapter IV (Articles 35 to 51) shall apply from 11 June 2026.— CRA Article 71(2) — reporting from 2026-09-11, full set from 2027-12-11 (snapshot:snapshots/eu/cra.txt)By 17 October 2024, Member States shall adopt and publish the measures necessary to comply with this Directive.— NIS2 Article 41(1) — the 2024-10-17 transposition deadline the card marked unverified (snapshot:snapshots/eu/nis2.txt)