How NIS2, the CRA, and the Cybersecurity Act Fit Together
In recent years, the European Union has introduced several important laws to strengthen cybersecurity in Europe. Three of them form the central pillars: the NIS2 Directive, the Cyber Resilience Act (CRA), and the Cybersecurity Act (CSA). This article explains how these laws connect and where their scopes differ.
Contents
NIS2 Directive: protecting critical infrastructure
The NIS2 Directive (Directive (EU) 2022/2555), the second Network and Information Security Directive, succeeds the original NIS Directive of 2016. It aims to improve cybersecurity in critical sectors. Its scope covers essential and important entities in critical sectors such as energy, transport, banking, health, and digital infrastructure. Its main goals are strict cybersecurity measures, reporting obligations for cyber incidents, and better cooperation between EU Member States.
One important aspect of NIS2 is a possible obligation to use certified ICT products, ICT services, and ICT processes. Under Article 24, Member States can require entities to use particular products that are certified under European cybersecurity certification schemes based on the Cybersecurity Act.
Cyber Resilience Act: security of connected products
The Cyber Resilience Act (CRA) (Regulation (EU) 2024/2847) is a new regulation that focuses on the cybersecurity of products with digital elements. Its scope extends to almost all connected devices and software, including the Internet of Things (IoT) and hardware and software products. The CRA has three aims:
- to introduce cybersecurity requirements for products,
- to oblige manufacturers to consider security throughout the product lifecycle, and
- to create a uniform legal framework for product cybersecurity in the EU.
The reporting obligations for manufacturers have applied since September 11, 2026, and the remaining obligations for products apply from December 11, 2027. Our page on the Cyber Resilience Act gives an overview of all dates.
The CRA introduces a conformity assessment system that extends the existing rules on CE marking. Among other things, it adds the option of certification under the Cybersecurity Act. Article 27 covers products for which an EU statement of conformity or a certificate has been issued under a European cybersecurity certification scheme. These products are presumed to meet the essential cybersecurity requirements of the CRA, insofar as the statement or certificate covers those requirements.
Under Article 8, the Commission can also adopt delegated acts. They determine which critical products with digital elements must obtain a European cybersecurity certificate under the Cybersecurity Act at assurance level at least “substantial”.
Cybersecurity Act: EU-wide certification
The Cybersecurity Act (CSA) (Regulation (EU) 2019/881) does two things. It strengthens the role of the EU Agency for Cybersecurity (ENISA), and it creates a framework for European cybersecurity certification. It applies to ICT products, ICT services, and ICT processes and provides for voluntary certification and, in some cases, mandatory certification.
The main goals of the CSA are an EU-wide cybersecurity certification framework, greater trust in certified products and services, and a higher level of cybersecurity across the EU.
The CSA plays a central role in implementing both NIS2 and the CRA. Manufacturers and entities can use the certification schemes developed under the CSA to demonstrate compliance with the requirements of both laws. So far, however, the Commission has adopted only one such scheme: the EUCC for ICT products based on the Common Criteria (Commission Implementing Regulation (EU) 2024/482).
How NIS2, the CRA, and the CSA connect and differ
NIS2 focuses on the security of critical infrastructure and sectors, while the CRA targets the security of products with digital elements. The CSA provides an overarching certification framework that can be relevant for both NIS2 and the CRA.
The three laws complement each other. NIS2 strengthens cybersecurity at the organizational level in critical sectors. The CRA ensures the security of the products used. The CSA provides a framework for verifying and certifying security measures.
Outlook
Together, NIS2, the CRA, and the CSA form a broad set of rules to strengthen cybersecurity in the EU. Their scopes partly overlap, but they address different aspects of cybersecurity. Companies and organizations should keep an eye on all three to develop and implement a consistent approach to cybersecurity.
Which requirements apply to your company?
NIS2, the CRA, and the CSA affect companies at different levels: organization, products, and certification. We help you sort out the relevant requirements and derive concrete next steps for products, processes, and evidence.
