NIS2 (Directive (EU) 2022/2555)
Many manufacturers fall under both sets of rules: NIS2 for their own operations, the CRA for their products. The deadlines are similar, the recipients and triggers are not.
NIS2 is Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union. It requires entities in 18 sectors to secure their own IT and to report security incidents; the CRA, by contrast, places obligations on manufacturers for their products.
Definition in the Regulation
The CRA draws the line with NIS2 in its recitals. Recital 12 assigns pure cloud services such as SaaS, PaaS and IaaS to the NIS2 Directive, not to the CRA. Recital 24 explains that products developed in a secure manner should make it easier for digital infrastructure providers to comply with the NIS2 supply chain requirements. NIS2 applies to entities from medium size upwards in sectors such as energy, transport, health and manufacturing. Germany transposed it with the German NIS2 implementation act (NIS2UmsuCG), which entered into force on 6 December 2025. Entities in scope report significant incidents to the BSI under section 32 of the German BSI Act (BSIG): an early warning within 24 hours, a notification within 72 hours and a final report after one month.
What it means for manufacturers
In Germany, a machinery manufacturer with at least 50 employees, or with an annual turnover and an annual balance sheet total each above EUR 10 million, is an important entity (section 28(2), point 3, and Annex 2 BSIG) and can at the same time be a manufacturer under the CRA. Two separate reporting obligations then apply: if your own build environment is compromised, this can trigger a NIS2 report to the BSI reporting portal and a CRA notification via the ENISA platform. Neither replaces the other; in its FAQ on the CRA platform, the BSI says that such an incident is reported under both sets of rules, each with a reference to the other report. A ransomware incident at a customer is not automatically a severe incident under the CRA; under Article 14(3) and (5), what matters is whether the incident affects the security of the product. The BSI says the same about ransomware at the manufacturer. If the attacker got in through a vulnerability in the product or through access held by the manufacturer, such as remote maintenance, a CRA reporting obligation may apply (Article 14(1) or Article 14(5)(b)). A sensible approach is a joint reporting organisation with separate channels. In Austria, the Network and Information Systems Security Act 2026 (NISG 2026) has applied since 1 October 2026.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit