Cyber Resilience Act and NIS2

The CRA covers products with digital elements. NIS2 covers essential and important entities

Direct answer. The Cyber Resilience Act, Regulation (EU) 2024/2847, sets cybersecurity requirements for products with digital elements placed on the EU market and the obligations of their manufacturers, importers, and distributors. NIS2, Directive (EU) 2022/2555, sets cybersecurity risk-management and reporting measures for essential and important entities. Article 1 of the Regulation says “This Regulation lays down” rules for making those products available, essential cybersecurity requirements and economic-operator obligations, vulnerability-handling requirements, and market-surveillance rules. Article 1(1) of the Directive says: “This Directive lays down measures that aim to achieve a high common level of cybersecurity across the Union, with a view to improving the functioning of the internal market.” Quotes below are from the English Official Journal texts. This page is not legal advice, and it does not say that any named business is in or out of scope.

CRALedger Duty Records (Shopify App Store · Write a review): “Track CRA product duties, Article 14 incident deadlines, encrypted ENISA SRP draft packs, vulnerability forwarding, and audit records.”

Related: EUDR Records Manager — DDS reference numbers on supplier lots.

Free check first: CRA role and scope self-check runs in your browser and sends nothing.

Checklist before you treat the two acts as the same job

What each Article 1 says

Regulation (EU) 2024/2847, Article 1:

This Regulation lays down:

(a) rules for the making available on the market of products with digital elements to ensure the cybersecurity of such products;

(b) essential cybersecurity requirements for the design, development and production of products with digital elements, and obligations for economic operators in relation to those products with respect to cybersecurity;

(c) essential cybersecurity requirements for the vulnerability handling processes put in place by manufacturers to ensure the cybersecurity of products with digital elements during the time the products are expected to be in use, and obligations for economic operators in relation to those processes;

(d) rules on market surveillance, including monitoring, and enforcement of the rules and requirements referred to in this Article.

Article 3(12) defines “economic operator” as “the manufacturer, the authorised representative, the importer, the distributor, or other natural or legal person who is subject to obligations in relation to the manufacture of products with digital elements or to the making available of products with digital elements on the market in accordance with this Regulation”. Article 3(13) defines “manufacturer” as “a natural or legal person who develops or manufactures products with digital elements or has products with digital elements designed, developed or manufactured, and markets them under its name or trademark, whether for payment, monetisation or free of charge”.

Directive (EU) 2022/2555, Article 1(1): “This Directive lays down measures that aim to achieve a high common level of cybersecurity across the Union, with a view to improving the functioning of the internal market.”

Article 1(2): “To that end, this Directive lays down:”

(a) obligations that require Member States to adopt national cybersecurity strategies and to designate or establish competent authorities, cyber crisis management authorities, single points of contact on cybersecurity (single points of contact) and computer security incident response teams (CSIRTs);

(b) cybersecurity risk-management measures and reporting obligations for entities of a type referred to in Annex I or II as well as for entities identified as critical entities under Directive (EU) 2022/2557;

(c) rules and obligations on cybersecurity information sharing;

(d) supervisory and enforcement obligations on Member States.

Article 2(1), first sentence: “This Directive applies to public or private entities of a type referred to in Annex I or II which qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC, or exceed the ceilings for medium-sized enterprises provided for in paragraph 1 of that Article, and which provide their services or carry out their activities within the Union.” Later paragraphs add size exceptions. This page does not apply Annex I, Annex II, or those exceptions to any business.

Recitals that explain the relation

The English text of Regulation (EU) 2024/2847 mentions Directive (EU) 2022/2555 in recitals 3, 12, 13, 23, 24, 34, 46, 47, 48, 52, 58, 66, 69, 70, 72, 73, 76, 107, 111, 112, 114, and 125. The recitals that draw the boundary are quoted here. The others mention the Directive in passing and are not copied.

Recital 3: “However, existing Union law related to cybersecurity, including Regulation (EU) 2019/881 of the European Parliament and of the Council (3) and Directive (EU) 2022/2555 of the European Parliament and of the Council (4), does not directly cover mandatory requirements for the security of products with digital elements.”

Recital 12: “Cloud solutions constitute remote data processing solutions within the meaning of this Regulation only if they meet the definition laid down in this Regulation. For example, cloud enabled functionalities provided by a manufacturer of smart home devices that enable users to control the device at a distance fall within the scope of this Regulation. On the other hand, websites that do not support the functionality of a product with digital elements, or cloud services designed and developed outside the responsibility of a manufacturer of a product with digital elements do not fall within the scope of this Regulation. Directive (EU) 2022/2555 applies to cloud computing services and cloud service models, such as Software as a Service (SaaS), Platform as a Service (PaaS) or Infrastructure as a Service (IaaS). Entities providing cloud computing services in the Union which qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC, or exceed the ceilings for medium-sized enterprises provided for in paragraph 1 of that Article, fall within the scope of that Directive.”

Recital 13, the sentences on the Directive: “Furthermore, Directive (EU) 2022/2555 sets out cybersecurity risk-management measures for essential and important entities as referred to in Article 3 of that Directive that could entail supply chain security measures that require the use by such entities of products with digital elements meeting stricter cybersecurity requirements than those laid down in this Regulation. In accordance with Directive (EU) 2022/2555 and in line with its minimum harmonisation principle, Member States can therefore impose additional cybersecurity requirements for the use of information and communications technology (ICT) products by essential or important entities pursuant to that Directive in order to ensure a higher level of cybersecurity, provided that such requirements are consistent with Member States’ obligations laid down in Union law.”

Recital 24: “Directive (EU) 2022/2555 aims at ensuring a high level of cybersecurity of services provided by essential and important entities as referred to in Article 3 of that Directive, including digital infrastructure providers that support core functions of the open internet, ensure internet access and provide internet services.” The same recital later says: “This Regulation, which applies to all connectable hardware and software products, also aims at facilitating the compliance of digital infrastructure providers with the supply chain requirements under Directive (EU) 2022/2555 by ensuring that the products with digital elements that they use for the provision of their services are developed in a secure manner and that they have access to timely security updates for such products.”

Recital 125: “This Regulation will facilitate the compliance with supply chain security obligations of entities that fall within the scope of Regulation (EU) 2022/2554 and Directive (EU) 2022/2555 that use products with digital elements.”

Side by side

Each cell is a provision quoted on this page
Question CRA, Regulation (EU) 2024/2847 NIS2, Directive (EU) 2022/2555
Instrument Article 1 opens “This Regulation lays down”. Article 1(1) opens “This Directive lays down measures”.
Who it addresses Article 1(b) sets obligations for economic operators. Article 3(12) names the manufacturer, the authorised representative, the importer, the distributor, or another person subject to those obligations. Article 3(13) defines the manufacturer. Article 1(2)(b) sets measures for entities of a type referred to in Annex I or II and for entities identified as critical entities under Directive (EU) 2022/2557. Article 2(1) applies the Directive to public or private entities of those types that meet the size test in that paragraph and provide services or carry out activities within the Union.
What it covers Article 1(a) to (d): making products with digital elements available on the market, essential cybersecurity requirements and economic-operator obligations, vulnerability handling, and market surveillance. Article 1(2)(a) to (d): national strategies and authorities, risk-management measures and reporting obligations, information sharing, and Member State supervision and enforcement.
Reporting Article 14(1), first sentence: “A manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA.” Article 23(1), first sentence: “Each Member State shall ensure that essential and important entities notify, without undue delay, its CSIRT or, where applicable, its competent authority in accordance with paragraph 4 of any incident that has a significant impact on the provision of their services as referred to in paragraph 3 (significant incident).”
Application Article 71(2): “This Regulation shall apply from 11 December 2027.” Article 41(1): “By 17 October 2024, Member States shall adopt and publish the measures necessary to comply with this Directive.”

Article 71(2) has a further sentence on earlier dates for Article 14 and Chapter IV. That sentence, and the rest of the calendar, is on the timeline. Article 41 continues after the transposition sentence quoted above. This page does not add deadlines that are not in the sentences in the table.

A store is not, by that fact alone, a CRA manufacturer

Article 3(13) defines a manufacturer by developing or manufacturing products with digital elements, or having them designed, developed, or manufactured, and marketing them under its name or trademark. The definition does not say that operating a store meets it. Whether a person is a manufacturer, importer, or distributor is the definition in Article 3, read with the obligations in the Regulation. A role checklist that stays inside those articles is CRA manufacturer obligations. The browser check is the CRA role and scope self-check.

NIS2 status is Article 2: an entity of a type referred to in Annex I or II, with the size rule in Article 2(1), plus the size exceptions the Directive states later. This page does not read a merchant’s sector or size into those annexes.

What this page is not

Related pages

Not legal advice. Confirm the live Official Journal texts of Regulation (EU) 2024/2847 and Directive (EU) 2022/2555, including the annexes, before you treat a product or an entity as in or out of scope. The app tracks duty records you keep. It does not decide scope.