CRA vs. NIS2 vs. DORA: different subjects of regulation, sometimes the same companies

Three EU cybersecurity laws are easily confused: the Cyber Resilience Act (CRA), the NIS2 Directive and the DORA Regulation. They overlap thematically but pursue different subjects of regulation. The key sentence first: the CRA regulates products, while NIS2 and DORA regulate organisations. Keeping these levels apart makes it much easier to place your own exposure correctly.

The CRA: product regulation with CE marking

The Cyber Resilience Act - Regulation (EU) 2024/2847 - is a horizontal product regulation. It sets cybersecurity requirements for products with digital elements (software and hardware with a direct or indirect data connection to a device or network). The addressees are the economic operators along the supply chain: manufacturers, importers and distributors.

The manufacturer must meet the essential requirements of Annex I, run a conformity assessment procedure, draw up technical documentation, issue an EU declaration of conformity and affix the CE marking. Throughout the support period (at least five years, shorter only where the expected period of use is shorter, Art. 13(8)), vulnerabilities must be handled in line with Annex I Part II, including an SBOM (software bill of materials) and a mandatory coordinated vulnerability disclosure (CVD) policy. Importers and distributors have graduated verification and due-care obligations (Art. 19 and 20). They do not carry out their own conformity assessment. The importer only places compliant products on the market and first ensures, among other things, that the conformity assessment, technical documentation and CE marking are in place; before making a product available, the distributor checks in particular the CE marking and whether manufacturer and importer have met their obligations.

Not every product needs a notified body: products in the default category go through self-assessment (Module A). For important products in Class I, Module A is only sufficient where harmonised standards, common specifications or a European cybersecurity certification scheme at least at assurance level ‘substantial’ are applied in full (Art. 32(2)). Class II always requires third-party assessment: Module B+C or H with a notified body or, where available, a European cybersecurity certificate at least at assurance level ‘substantial’ (Art. 32(3)). Critical products under Annex IV need a mandated European certification scheme (Art. 8(1)); otherwise the Class II routes apply (Art. 32(4)). The CRA is thus horizontal and at the same time risk-based: the more security-relevant the product function, the stricter the conformity route.

The CRA applies on a staggered basis: entry into force on 10 December 2024, the reporting obligations under Art. 14 since 11 September 2026, and general application with conformity assessment and CE marking from 11 December 2027. No 2024 or 2025 date is a compliance deadline for the substantive product duties. More on our page about the Cyber Resilience Act.

NIS2: organisational rather than product regulation

The NIS2 Directive - Directive (EU) 2022/2555 - addresses entities, i.e. companies and organisations that provide services or carry out activities in certain sectors. It distinguishes essential and important entities in the sectors listed in its Annexes I and II, such as energy, transport, health, drinking water, digital infrastructure, ICT service management and public administration. In principle it covers entities from the size of a medium-sized enterprise upwards; for some service providers NIS2 applies regardless of size (Art. 2(1) and (2)). As a directive, NIS2 must be transposed into national law; the transposition deadline expired on 17 October 2024. Germany has transposed NIS2 through the revised BSI Act (BSI-Gesetz) of 2 December 2025 (Federal Law Gazette 2025 I No. 301), which refers to particularly important and important entities (Section 28 BSIG).

The focus is on organisational duties: risk management, technical and organisational measures, supply-chain security, management-level governance responsibility and reporting obligations for significant incidents. NIS2 requires no CE marking and does not assess individual products for conformity - it is about the security level of the operation.

Important for the boundary: standalone SaaS or cloud services generally fall outside the CRA. The CRA captures cloud/back-end only where it is remote data processing belonging to a product with digital elements: the software for it is designed and developed by or under the responsibility of the manufacturer, and without it the product could not perform one of its functions (Art. 3(2), recital 12 CRA). Whether the provider of a cloud service falls under NIS2 depends on whether it is an entity in a NIS2 sector that meets the size thresholds, for example as a cloud computing service provider (Art. 2 NIS2, recital 12 CRA). Art. 26(2)(a) CRA provides for Commission guidance on where remote data processing begins and ends.

DORA: sector-specific for the financial sector

The DORA Regulation - Regulation (EU) 2022/2554, the “Digital Operational Resilience Act” - is sector-specific. It addresses financial entities (banks, insurers, investment firms, payment institutions, crypto-asset service providers and further categories) and their ICT third-party providers. The aim is digital operational resilience: the ability to withstand, respond to and recover from ICT disruptions.

As a directly applicable regulation, DORA has applied since 17 January 2025 - without national transposition. It requires an ICT risk-management framework, incident reporting, resilience testing, third-party risk management (including a register of information) and establishes an EU oversight framework for critical ICT third-party providers. NIS2 covers entities across sectors; DORA is tailored to the financial sector and more detailed there. For financial entities, DORA counts as a sector-specific Union legal act within the meaning of Art. 4 NIS2: for ICT risk management and the reporting of ICT-related incidents, the DORA rules apply instead of the NIS2 provisions (recital 28 NIS2). In Germany, Section 28(6) BSIG exempts financial entities under DORA from, among other things, the risk-management and reporting obligations of the BSI Act.

The comparison table

One company, several regimes

The legal acts do not exclude one another - they overlap. Typical constellations:

• A manufacturer of connected devices that is at the same time a medium or large important entity under NIS2 must have its products conformity-assessed under the CRA and secure its operation under NIS2.
• A bank is subject to DORA for its operational resilience; if it places its own software or hardware products on the market, the CRA may apply in addition.
• An ICT service provider can be affected at the same time by DORA (contractually through its financial-sector customers and, if designated as critical, directly through EU oversight), by NIS2 (where it is itself covered as an entity) and by the CRA (for products it ships).

Whether the CRA applies to your products can be assessed with our page on CRA exposure; whether NIS2 or DORA applies to your company is for your legal department or law firm to confirm. For smaller companies specifically, we have compiled the reliefs and particularities on our SME page. This information is general technical and organisational in nature and does not replace legal advice in an individual case.