Cyber Resilience Act Response Center Request a demoDemo

Guide Last updated 14 min read

CRA and NIS2 compared: product or entity, two reporting obligations

The Cyber Resilience Act and the NIS2 Directive have similar deadlines but different subjects. The CRA looks at the product, NIS2 at how the company runs its operations. A manufacturer can fall under both, and then it notifies twice.

The CRA requires manufacturers to notify actively exploited vulnerabilities and severe incidents affecting their products (Article 14). NIS2 requires certain entities to notify significant incidents in their own IT (Article 23 NIS2; in Germany, section 32 of the BSI Act, BSIG). The deadlines look similar, but the trigger, the recipient and the content differ. A machinery manufacturer with connected machines can fall under both. Neither notification replaces the other, and the General Data Protection Regulation continues to apply alongside them.

Key points

  • CRA: the product, addressed to the manufacturer. NIS2: an entity in one of the 18 sectors, addressed to the entity itself.
  • CRA notifications go via the ENISA platform to CERT-Bund at the BSI; NIS2 notifications go to the BSI's reporting portal.
  • A manufacturer that is also a NIS2 entity has both sets of obligations. One notification does not satisfy the other.
  • Germany: the German NIS2 implementation act has applied since 6 December 2025. The German CRA implementation act has not been promulgated.
  • Depending on the product, the Machinery Regulation, radio equipment law, the AI Act and product liability law also apply.

How do the CRA and NIS2 differ?

The CRA is product law. It applies to products with digital elements made available on the market (Article 2(1)) and is addressed to the economic operators that place them on the market. NIS2, by contrast, regulates the organisations that run services. Directive (EU) 2022/2555 applies to entities in 18 sectors that are medium-sized or larger, or that meet specific criteria, and requires risk management and notifications for their own network and information systems. The CRA itself draws the line: software, platforms and infrastructure delivered from the cloud (SaaS, PaaS, IaaS) fall under NIS2 according to recital 12. According to recital 24, the CRA is meant to make it easier for operators of digital infrastructure to meet the supply chain requirements of the NIS2 Directive, because the products they use already have to meet requirements of their own.

CRA (Article 14)NIS2 (Article 23, section 32 BSIG)GDPR (Article 33)
SubjectProduct with digital elementsEntity (the company and its IT)Personal data
AddresseeManufacturer; importers and distributors inform the manufacturerEssential and important entitiesController
TriggerActively exploited vulnerability in the product; severe incident having an impact on the security of the product (paragraphs 1, 3, 5)Significant incident in the entity itselfPersonal data breach
Early warning24 hours from awareness (paragraph 2, point (a), paragraph 4, point (a))24 hoursNo separate stage
Notification72 hours (paragraph 2, point (b), paragraph 4, point (b))72 hours72 hours
Final stageVulnerability: 14 days after a corrective or mitigating measure is available (paragraph 2, point (c)); incident: one month after the 72-hour notification (paragraph 4, point (c))One monthCan be supplemented later
RecipientENISA platform, coordinating computer security incident response team (CSIRT) of the Member State of the main establishment (Germany: CERT-Bund at the BSI)Germany: BSI reporting portalData protection supervisory authority
Informing third partiesImpacted users (paragraph 8)Recipients of the services (Article 23(1) NIS2)Data subjects where there is a high risk (Article 34)
Administrative fineUp to EUR 15 million or 2.5 per cent (Article 64(2)), from 11 December 2027Essential entities up to EUR 10 million or 2 per cent, important entities up to EUR 7 million or 1.4 per cent (Article 34 NIS2, section 65 BSIG)Up to EUR 10 million or 2 per cent (Article 83)
Status in GermanyImplementation act not promulgated; reporting obligation has applied directly since 11 September 2026NIS2UmsuCG in force since 6 December 2025In force since 2018

The number of NIS2 entities in Germany comes from secondary sources, not from the text of the law.

When is a manufacturer covered by both?

When it places products with digital elements on the market and is also an entity under NIS2. Manufacturing, including the machinery sub-sector, is listed in Annex II to the NIS2 Directive. In Germany, a machinery manufacturer (NACE division 28) is an important entity if it has at least 50 employees or an annual turnover and an annual balance sheet total each exceeding EUR 10 million (section 28(2), point 3 and Annex 2 BSIG); partner and linked enterprises are generally counted too. Because machinery appears only in Annex 2, even a large machinery manufacturer remains an important entity rather than an essential one, unless it operates critical infrastructure. Secondary sources estimate around 29,500 entities in Germany. Among mid-sized manufacturers, being covered by both is therefore not unusual.

An example: a manufacturer of packaging machinery with 120 employees supplies machines with remote maintenance and its own app. Attackers compromise its build server, which is used to build and distribute firmware. Three notifications may then be due:

  • CRA, if products are affected: an incident that can lead to malicious code being introduced into the product is a severe incident under Article 14(5). Notification via the ENISA platform to CERT-Bund.
  • NIS2, if the manufacturer is an important entity: the attack on its own infrastructure is an incident in the entity. Notification to the BSI reporting portal.
  • GDPR, if personal data are affected, for example login credentials in the app: notification to the data protection supervisory authority within 72 hours (Article 33 GDPR).

Conversely, not every incident triggers all three. A ransomware attack at a customer that does not touch the machine is, on the wording of Article 14(3) and (5), not a severe incident under the CRA, because the security of the product is not affected. There is no official example for exactly this case, but in its FAQ on the CRA platform the BSI clarifies a related case: ransomware at the manufacturer is not automatically a severe incident, but only if it affects the security of the product or can lead to manipulation of software, updates, signing keys or product functions. The position is different if the attacker got in through a vulnerability in the machine (then there may be an actively exploited vulnerability under Article 14(1)) or through an access route of the manufacturer such as remote maintenance or the update channel (then Article 14(5)(b) may apply). An incident in the manufacturer's office IT with no link to the product is a NIS2 case. What counts under the CRA is explained in Severe incident under the CRA.

Does one notification replace the other?

No. The CRA does not provide for notifications under other legal acts to count towards it, and the BSI states explicitly in its FAQ on the CRA platform: if an incident must be notified under both NIS2 and the CRA, it is notified under both, through the BSI portal and through the CRA platform; each notification can include a reference to the other. Both notifications end up at the BSI, but by different routes: the CRA notification via ENISA's single reporting platform to CERT-Bund, the NIS2 notification via the BSI reporting portal. Whether the BSI combines the two internally is not documented. Specialist articles from September 2026 agree in advising against assuming that a CRA notification satisfies other regimes, and recommend a single reporting organisation with separate channels. A Commission proposal (Digital Omnibus, COM(2025) 837 of 19 November 2025) would in future treat the CRA notification of a severe incident as a NIS2 notification as well; as of October 2026 it has not been adopted, and the responsible committee of the European Parliament has not yet voted.

The content differs too. The CRA early warning names the actively exploited vulnerability and the Member States concerned; the 72-hour notification covers the product, the nature of the exploitation and the corrective or mitigating measures. The NIS2 notification describes the incident in the entity and its impact on the services. On the three CRA stages: Early warning, notification, final report.

How far has implementation got in Germany?

The German NIS2 implementation act (NIS2-Umsetzungs- und Cybersicherheitsstärkungsgesetz, NIS2UmsuCG) was passed by the Bundestag, the federal parliament, on 13 November 2025 and by the Bundesrat, the chamber of the federal states, on 21 November 2025; it entered into force on 6 December 2025 without a transitional period. The reporting obligation is in section 32 BSIG, the duties of management in section 38 BSIG.

The German CRA implementation act (Bundestag printed paper 21/6134) had its first reading on 11 June 2026 and is with the Bundestag's Committee on Internal Affairs (Innenausschuss); there is no record of promulgation (as of 7 October 2026). This makes no difference to the reporting obligation: as a regulation, the CRA applies directly, and Article 14 has done so since 11 September 2026. The act mainly provides for the BSI to become market surveillance authority, notifying authority, CSIRT and fining authority: The German CRA implementation act. The act to strengthen cybersecurity (Gesetz zur Stärkung der Cybersicherheit, Bundestag printed paper 21/6585) is a separate project with no connection to the CRA.

Which other rules apply alongside the CRA?

In short: the CRA governs the product, NIS2 the operation, the GDPR the data, the Machinery Regulation machine safety, radio equipment law the radio module, the AI Act the AI system and product liability law the damage.

Machinery Regulation (EU) 2023/1230

It applies from 20 January 2027 and contains its own cybersecurity requirements in Annex III, under point 1.1.9 (protection against corruption) and point 1.2.1 (safety and reliability of control systems). Both sets of rules apply in parallel; Article 28(3) CRA then requires a single EU declaration of conformity for all the legal acts concerned. Harmonised standards for this are lacking; since January 2026 industry associations have been calling for a postponement to 11 December 2027, but none has been adopted (as of October 2026). More in The CRA in machinery and plant engineering.

Radio equipment: Delegated Regulation (EU) 2022/30

Since 1 August 2025, radio equipment has been subject to cybersecurity requirements under Delegated Regulation (EU) 2022/30 supplementing the Radio Equipment Directive. Delegated Regulation (EU) 2026/339 of 16 February 2026 repeals it with effect from 11 December 2027, because the CRA requirements contain all of its elements. Until then both apply; for radio equipment placed on the market in the meantime, market surveillance under radio equipment law remains possible. Under Article 69(1) CRA, EU type-examination certificates remain valid until 11 June 2028. Conformity under radio equipment law is not proof of CRA conformity.

AI Act, Regulation (EU) 2024/1689

Article 12 CRA links the two sets of rules. A product that is also a high-risk AI system is deemed to comply with the cybersecurity requirements of Article 15 of the AI Act. The condition is that it meets Annex I, Parts I and II of the CRA and that this is demonstrated in the EU declaration of conformity. Conformity assessment follows Article 43 of the AI Act, and the notified bodies under that Act also check the CRA requirements (Article 12(2)). According to secondary sources on the Digital Omnibus, the high-risk obligations apply from 2 December 2027 (stand-alone systems) and 2 August 2028 (systems integrated into products).

Product Liability Directive (EU) 2024/2853

The new Directive must be transposed by 9 December 2026 and applies to products placed on the market after that date. Software counts as a product regardless of how it is supplied; according to secondary sources, manufacturers are also liable for defects that arise after placing on the market through updates or missing security updates. A lack of cybersecurity can be a product defect. The German act to modernise product liability law (Gesetz zur Modernisierung des Produkthaftungsrechts) had its first reading on 4 March 2026; there is no record of it being passed (as of 7 October 2026). Unlike the CRA, product liability does not govern what a manufacturer has to do, but who pays.

Common mistakes

  • Treating a NIS2 notification to the BSI as a CRA notification. The CRA notification goes through the ENISA platform.
  • Not checking whether both apply. A manufacturing company with 50 or more employees, or with an annual turnover and balance sheet total of more than EUR 10 million, should know before the first incident whether it is a NIS2 entity.
  • Treating conformity under radio equipment law as proof of CRA conformity. Only the EU type-examination certificates remain valid until June 2028.
  • Assuming the Machinery Regulation has been postponed. It applies from 20 January 2027.
  • Overlooking product liability. From December 2026, a missing security update can become a liability case.
  • One call chain for everything, but no allocation. Whoever is alerted needs to know which notification goes to whom.

For the CRA part of such a reporting organisation, CRA Response Center provides readiness for Article 14: monitoring the reporting address, classification, notifying the people responsible and a history recording awareness and deadlines. NIS2 and data protection notifications remain with the responsible people in the company; the manufacturer submits the notification to the ENISA platform itself.

Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Frequently asked questions

Am I covered by the CRA or NIS2?

By the CRA if you place products with digital elements on the market in the EU. By NIS2 if your company operates in one of the 18 sectors and reaches the thresholds. Both at once is possible. The Applicability Check answers the CRA part.

Is one notification enough for all the rules?

No. Each legal basis has its own recipient, its own triggers and its own content. The CRA does not provide for one notification to count towards another, and the BSI confirms in its FAQ on the CRA platform that an incident covered by both sets of rules is notified twice. The Commission has proposed letting one count for the other (Digital Omnibus), but this has not been adopted.

Which deadlines apply under the CRA?

24 hours for the early warning, 72 hours for the notification, then 14 days after a corrective or mitigating measure is available (vulnerability) or one month after the 72-hour notification (incident), Article 14(2) and (4).

Does the Machinery Regulation already apply?

From 20 January 2027, including the cybersecurity requirements in Annex III. No postponement has been adopted (as of October 2026).

What happens to cybersecurity under radio equipment law?

Delegated Regulation (EU) 2022/30 is repealed by Delegated Regulation (EU) 2026/339 with effect from 11 December 2027. It continues to apply until then; after that, the CRA covers the requirements.

Is my company liable for missing updates?

Under the new product liability law (to be transposed by 9 December 2026), according to secondary sources a manufacturer can also be liable for damage caused by missing security updates. The German act has not yet been passed.

What applies to AI in my product?

If the product is a high-risk AI system, Article 12 CRA links the cybersecurity requirements of the two sets of rules. According to secondary sources, the high-risk obligations apply from December 2027 or August 2028 respectively.

Further reading

Sources

The reporting obligation already applies. Who answers at night at your company?

CRA Response Center monitors your security mailbox, recognises important reports using AI hosted in Germany (your e-mails never go to OpenAI, Anthropic or Google) and alerts your people by SMS and e-mail. EUR 190 per month including VAT. Try it free for 30 days.

Try it free for 30 days