BLOG

You May Owe Both: How NIS2 and the Cyber Resilience Act Overlap for Equipment Makers

Industrial manufacturers selling into Europe often assume they face one EU cybersecurity regime. They usually face two, and the two work differently enough that treating them as one creates real exposure. NIS2 regulates organizations that operate critical services. The Cyber Resilience Act regulates products placed on the EU market. A company that builds control systems and also operates European facilities can owe duties under both, on separate clocks, to separate authorities.

The good news is that the technical work overlaps heavily. The bad news is that the reporting duties do not overlap at all, and a single event can require two separate filings on two separate timelines. Our CRA Article 14 reporting guide covers the product side in detail.

The distinction in one table

	NIS2	Cyber Resilience Act
Legal form	Directive. Each member state writes national law, so obligations vary by country.	Regulation. Applies directly and identically in all 27 states.
What it regulates	Organizations operating critical services in the EU.	Products with digital elements placed on the EU market.
Who it binds	Essential and important entities in the listed sectors.	Manufacturers, importers and distributors, wherever based.
Reaches a US or Canadian company	Indirectly, through customer contracts and the supply chain obligation.	Directly, if the product reaches the EU market by any route.
Reporting trigger	A significant incident affecting your own services.	An actively exploited vulnerability or a severe incident in your product.
Final report	One month after the 72 hour notification.	Vulnerabilities: 14 days after a fix is available. Incidents: one month.
Status	In force. Transposition incomplete in several states.	Reporting live since 11 September 2026. Full application 11 December 2027.

Both regimes use a 24 and 72 hour structure, and that is a trap

The similarity is superficial and it catches teams out. Under NIS2 Article 23, an in-scope entity files an early warning within 24 hours, a notification within 72 hours, and a final report within one month, to the CSIRT or competent authority in each member state where it provides services. Under CRA Article 14, a manufacturer files an early warning within 24 hours and a notification within 72 hours through the EU Single Reporting Platform, which distributes to ENISA and one coordinating CSIRT.

So the clocks look alike but the destinations differ, the triggers differ, and the final report deadlines differ. If your vulnerability in a deployed product also disrupts your own European service operations, you may owe a CRA filing on the product and a NIS2 filing on the service, to different recipients, about the same event.

The scenario to plan for

A vulnerability in your controller is exploited at a customer site. If you are a manufacturer, that is a CRA Article 14 report. If the same flaw sits in equipment running your own in-scope European plant and disrupts operations, that is also a NIS2 significant incident. One root cause, two filings, two authorities, two deadlines. Decide now who owns each, because 24 hours is not the moment to work out the org chart.

What you build once

The technical artifacts serve both regimes, and this is where the budget argument lives:

Software bill of materials. A CRA requirement and the fastest answer to a NIS2 supplier questionnaire. See our SBOM guidance.
Secure development lifecycle mapped to IEC 62443-4-1. Covers CRA essential requirements and satisfies most of what an operator tests under Article 21.
Vulnerability handling and disclosure policy. Mandatory under the CRA, expected by every NIS2 questionnaire.
Asset and product inventory. You cannot report on what you cannot identify. Our OT asset inventory guide covers the method.
A single incident record. One internal source of truth that can generate either filing, rather than two parallel processes that diverge under pressure.

What you must keep separate

Three things do not merge. Scope determination, because product scope and entity scope are assessed differently and by different criteria. Reporting routes, because the Single Reporting Platform and the national CSIRTs are not interchangeable. And conformity assessment, which is a CRA concept with no NIS2 equivalent; no amount of NIS2 maturity produces a CE mark. Our CRA compliance roadmap covers that work.

Why Choose Arista Cyber

We work with manufacturers and with the asset owners who buy from them, which means we can tell you how your product obligations and your customers' operator obligations actually meet. Our consultants work to IEC 62443 and hold functional safety credentials on the same industrial assets. See our case studies.

Next Steps

Run one combined scoping exercise rather than two. Establish which products are on the EU market, whether any of your own European operations are in scope as an entity, and who owns each reporting duty. That single exercise usually reveals that the engineering work is shared and only the filing paths need separating.

Common Questions

Can one company be subject to both NIS2 and the CRA?

Yes, and it is common for equipment makers with European operations. The CRA attaches to your products, NIS2 to your in-scope services. They are independent.

If we report under the CRA, do we still need to report under NIS2?

Potentially yes. The duties arise from different facts and go to different recipients. A single root cause can require both filings.

Which one applies to us if we only sell hardware and have no EU offices?

The CRA, directly, if your product reaches the EU market by any route including through an OEM or distributor. NIS2 reaches you only through customer contracts.

Does the CRA replace NIS2 for products?

No. They are complementary. The CRA sets product requirements, NIS2 sets organizational requirements for operators, including how they manage suppliers.

Where should we start if we think both apply?

Scope first, in one exercise. Then build the shared artifacts, SBOM and secure development evidence above all, and separate only the reporting paths and the conformity assessment.

One event, two filings. Who owns each?

Arista Cyber runs combined NIS2 and CRA scoping for industrial manufacturers, mapping product scope against entity scope and assigning each reporting duty before you need it.

Request combined scoping