The Cyber Resilience Act covers a company that makes products with digital elements available on the Union market. NIS2 covers it by sector and size, or as the operator of a critical facility. The two tests run separately, and a company that meets both is subject to both acts.
What is the difference between the Cyber Resilience Act and NIS2?
The Cyber Resilience Act attaches to the product, NIS2 to the operation of an entity. Regulation (EU) 2024/2847 sets out which cybersecurity properties a product with digital elements must have before it is placed on the market. It also governs the manufacturer's vulnerability management after placing on the market. Directive (EU) 2022/2555 sets out how an entity protects its own network and information systems and reports security incidents.
In Germany the BSI Act (BSIG) transposes the Directive. The Cyber Resilience Act guide and the NIS2 guide explain the duties on each side in detail.
Who has to comply with the Cyber Resilience Act, and who with NIS2?
The Cyber Resilience Act applies to anyone who makes products with digital elements available on the Union market in the course of a commercial activity (Article 3(22)). Sector and company size do not matter. Manufacturers carry the main duties. Importers and distributors count as manufacturers if they place a product on the market under their own name or substantially modify it (Article 21).
Under § 28 BSIG, NIS2 applies to an entity of a type listed in Annex 1 or 2 that reaches the size thresholds. Important entities employ at least 50 people or have an annual turnover and an annual balance sheet total each above EUR 10 million. Operators of critical facilities are particularly important entities regardless of their size (§ 28(1) no. 1). The page on NIS2 scope explains how the test works.
Does software as a service fall under the CRA or under NIS2?
Software as a service falls under the Cyber Resilience Act only as the remote data processing of a product. Article 3(2) defines remote data processing as processing at a distance whose software the manufacturer designs and develops itself or under its responsibility. The second condition: without that processing, the product could not perform one of its functions.
The cloud control of a connected device is therefore part of the product. A standalone cloud service without such a product counts as operation. Annex 1 BSIG lists “providers of cloud computing services” as a type of entity in the digital infrastructure sector (no. 6.1.4). Whether the provider is covered depends on the size thresholds of § 28 BSIG.
When does a company fall under both acts?
A company falls under both acts if it places products with digital elements on the market and, as an entity, reaches the BSIG thresholds. Example: a machine builder with at least 50 employees ships controllers with a network interface. Machine building is a type of entity in Annex 2 BSIG (no. 5.4).
The two sets of duties then concern different objects. The product duties attach to the shipped controller and run for its support period. The operator duties attach to the systems the company uses for its own production and administration.
Side by side
| Criterion | Cyber Resilience Act | NIS2 |
|---|---|---|
| Legal act and form | Regulation (EU) 2024/2847. It applies directly in every Member State. | Directive (EU) 2022/2555. It takes effect through national law; in Germany through the BSIG as amended by the NIS2 Implementation Act, in force since 6 December 2025. |
| Subject matter | Products with digital elements whose intended purpose or reasonably foreseeable use includes a direct or indirect data connection to a device or network (Article 2(1)). | The IT systems, components and processes an entity uses to provide its services (§ 30(1) BSIG). |
| Who is addressed | Manufacturers, importers and distributors, regardless of sector and size. Anyone who places a product on the market under their own name or substantially modifies it takes on manufacturer duties (Articles 21, 22). | Particularly important and important entities under § 28 BSIG: types of entity in Annexes 1 and 2 above the size thresholds; operators of critical facilities regardless of size. |
| Exclusions from scope | Article 2(2) to (4), (6) and (7) lists the exclusions exhaustively, among them medical devices, in vitro diagnostics, vehicles, certified aviation products, marine equipment, identical spare parts and products solely for national security or defence. | An equivalence test instead of a list: sector-specific Union law displaces NIS2 only where its requirements are at least equivalent (Article 4). In the BSIG, § 28(5) to (7) sets the exceptions, for example for financial entities under DORA. |
| Application | Reporting duties (Article 14) since 11 September 2026, rules on conformity assessment bodies (Chapter IV) since 11 June 2026, all other duties from 11 December 2027 (Article 71(2)). | Since 6 December 2025. The first registration deadline ended on 6 March 2026. |
| Core duties | Annex I Part I: product properties such as a secure default configuration, protection against unauthorised access and data minimisation. Annex I Part II: vulnerability handling with a software bill of materials (SBOM), coordinated disclosure and security updates. | Risk management measures under § 30(2) BSIG in ten minimum areas, from risk analysis to multi-factor authentication; plus registration (§ 33) and reporting of significant security incidents (§ 32). |
| Support period | At least five years, unless the product is expected to be in use for less time (Article 13(8)). During that period the manufacturer handles vulnerabilities under Annex I Part II. | No equivalent. The BSIG requires security in the acquisition, development and maintenance of systems, including vulnerability management and disclosure (§ 30(2) no. 5). |
| Evidence | Technical documentation, EU declaration of conformity and CE marking. | No marking and no declaration of conformity. The entity documents compliance (§ 30(1), third sentence, BSIG). |
| Review by third parties or the authority | Important products of class II need a third-party assessment or a certification; internal control (module A) is not open to them (Article 32(3)). | The BSI can order particularly important entities to submit evidence no earlier than three years after the BSIG entered into force on 6 December 2025 (§ 61(3)), and important entities when facts suggest a breach (§ 62). |
| Standards and certificates | Harmonised standards referenced in the Official Journal give a presumption of conformity insofar as they cover Annex I (Article 27(1)). Where none exist, the Commission can adopt common specifications (Article 27(2)). | The BSI can order particularly important entities to have audits, inspections or certifications carried out by independent bodies (§ 61(1)). A statutory ordinance can require EU certification for certain ICT products (§ 30(6)). |
| Reporting triggers | Actively exploited vulnerabilities in the product and severe incidents having an impact on the security of the product (Article 14(1) and (3)). | Significant security incidents in the operation of the entity's own systems (§ 32(1) BSIG). |
| Reporting deadlines | Early warning within 24 hours, notification within 72 hours. Final report 14 days after a corrective measure is available (vulnerability) or one month after the notification (incident). Intermediate report only on request. | Early initial notification within 24 hours and notification within 72 hours of becoming aware, final notification one month after the notification. Interim notification only at the BSI's request. |
| Reporting recipients | Simultaneously the CSIRT designated as coordinator in the Member State of main establishment and ENISA, via the single reporting platform (Articles 14(7), 16). In Germany the BSI is that CSIRT. | The joint reporting office set up by the BSI and the BBK (§ 32 BSIG). |
| Supervision | The market surveillance authorities each Member State designates (Article 52(2)). The Market Surveillance Regulation (EU) 2019/1020 applies to the products in scope (Article 52(1)). | The BSI: for particularly important entities without a triggering event (§ 61), for important entities when facts justify the assumption of a breach (§ 62). |
| Penalties | Tiered fines under Article 64, each as a fixed amount or a share of worldwide annual turnover, whichever is higher. | Maximum under Article 34(4) and (5) of the Directive: at least EUR 10 million or 2 % of worldwide annual turnover for essential (BSIG: particularly important) entities, at least EUR 7 million or 1.4 % for important ones, whichever is higher. German offences: § 65 BSIG. |
Our verdict
Anyone who makes products with digital elements available on the Union market checks the Cyber Resilience Act. Anyone who reaches the size thresholds in a sector of Annex 1 or 2 BSIG, or operates a critical facility, checks the BSIG. A company that answers yes to both runs two sets of duties for two objects: the shipped product and its own operations.
Does an incident have to be reported under both acts?
An incident is reported under both acts when it meets both triggers. Example: an actively exploited vulnerability in the company's own control software also causes a significant security incident in its own plant.
The manufacturer reports the vulnerability via the single reporting platform to the coordinating CSIRT and to ENISA. For manufacturers with their main establishment in Germany, the BSI is that CSIRT (§ 5(1), second sentence, BSIG).
The entity reports the operational incident under § 32 BSIG to the joint reporting office of the BSI and the BBK. Each report has its own recipient, content and final-report deadline. Decide before the first incident who files which report.
Which product law takes precedence when a device is already regulated elsewhere?
The product law that Article 2 of Regulation (EU) 2024/2847 names expressly takes precedence; the list is exhaustive. For all other products, the Cyber Resilience Act applies in addition to their own product law.
| Legal act | Products covered | Consequence for the Cyber Resilience Act |
|---|---|---|
| Regulation (EU) 2017/745 | Medical devices | does not apply (Article 2(2)(a)) |
| Regulation (EU) 2017/746 | In vitro diagnostic medical devices | does not apply (Article 2(2)(b)) |
| Regulation (EU) 2019/2144 | Motor vehicles and their systems | does not apply (Article 2(2)(c)) |
| Regulation (EU) 2018/1139 | Civil aviation products certified under it | does not apply (Article 2(3)) |
| Directive 2014/90/EU | Marine equipment | does not apply (Article 2(4)) |
| Directive 2014/53/EU with Delegated Regulation (EU) 2022/30 | Radio equipment to which Article 3(3)(d), (e) or (f) of the Directive applies | no exclusion; both regimes apply side by side |
Manufacturers of radio equipment therefore meet the requirements of Delegated Regulation (EU) 2022/30 and, in addition, those of the Cyber Resilience Act. Recital 30 provides for Commission guidance for the transition period. Article 2(5) allows the Commission to limit the scope by delegated act where sectoral law achieves the same or a higher level of protection.
Does the Cyber Resilience Act apply to existing products?
The Cyber Resilience Act applies to existing products in two parts. A product placed on the market before 11 December 2027 has to meet the requirements only after a substantial modification (Article 69(2)). The reporting duties of Article 14, by contrast, apply to all products in scope, including those placed on the market before that date (Article 69(3)).
Reporting capability therefore has to cover the installed base. Whether a feature update pulls an existing product into the full set of duties depends on the term substantial modification. Under Article 3(30), that is a change affecting conformity with Annex I Part I or the intended purpose for which the product was assessed.
Both sets of duties in one asset register
Rizzqo carries the Cyber Resilience Act as a requirement catalogue. Its requirements appear on the assets whose category they concern, for example on the software and hardware components of a product. If an asset's category changes, the requirements of the new category appear on it.
Each requirement carries an owner, the evidence and an answer that is finalised with name and timestamp. From these finalised answers Rizzqo computes coverage per asset.
NIS2 is supported in Rizzqo; its catalogue is enabled when a customer needs it. The same asset register then holds the shipped product's components and the company's own systems, each with the requirements of its catalogue.