NIS2 and the Cyber Resilience Act: where things stand

Two pieces of EU law are changing what companies have to do about cyber security. NIS2 sets security and reporting duties for organisations in important sectors, and it now applies in the Netherlands, Germany and Belgium. The Cyber Resilience Act (CRA) sets rules for the products themselves, and its first reporting duties for manufacturers started on 11 September 2026. This is where things stand at the end of October 2026, and what to do about it. It is a summary, not legal advice: check your own position with your national regulator or a lawyer.

NIS2: does it apply to you?

NIS2 (Directive (EU) 2022/2555) covers 18 sectors, from energy, transport, health, water and digital infrastructure to manufacturing, food, postal services, waste and chemicals. As a rule, an organisation is in scope if it works in one of those sectors and is medium-sized or larger: in EU terms, 50 or more staff, or more than €10 million in turnover and balance sheet. Some are in scope whatever their size, including telecoms providers, DNS providers and central and regional government (Article 2).

In-scope organisations are either essential or important. The duties are the same; the difference is in how closely the regulator supervises and how high the fines go. National law must allow maximum fines of at least €10 million or 2% of worldwide turnover for essential entities, and at least €7 million or 1.4% for important ones, whichever is higher (Article 34).

What it asks

Article 21 lists ten areas every organisation in scope must cover, in proportion to its risks: risk analysis and security policies, incident handling, business continuity (backups, disaster recovery, crisis management), supply-chain security, secure buying, development and maintenance of systems including handling vulnerabilities, checking that the measures work, basic cyber hygiene and training, cryptography, staff security and access control, and multi-factor authentication with secured communications (Article 21).

Significant incidents must be reported to the national CSIRT or regulator in stages: an early warning within 24 hours, a notification within 72 hours and a final report within a month (Article 23). And responsibility sits with the board: management must approve and oversee the measures, can be held liable when they fall short, and has to follow training (Article 20).

Where each country stands

Member states had to turn NIS2 into national law by 17 October 2024. Most were late. On 8 July 2026 the Commission took Ireland, Spain and France to the EU Court of Justice over the delay, and some reports also name the Netherlands (Hunton, Law Society Gazette). For our readers' main countries:

If you are a supplier

NIS2 does not apply to a company just because it sells to one that is in scope. But in-scope organisations must manage the security of their direct suppliers, taking into account each supplier's weaknesses, product quality and development practices (Article 21(3)). In practice that means security questionnaires, contract clauses and sometimes audits. Managed service and managed security providers, cloud and data-centre providers are in scope in their own right.

The Cyber Resilience Act: rules for products

The CRA (Regulation (EU) 2024/2847) covers almost any hardware or software product that connects to a device or network, from smart cameras and routers to business software. The main duties fall on manufacturers, but importers may only sell products that comply and must check the documentation and CE marking (Article 19). Medical devices, cars, aviation and defence products have their own rules and are excluded (Article 2). It comes in step by step (Article 71):

• 10 December 2024: the law entered into force.
• 11 June 2026: the rules for the bodies that will check high-risk products started to apply.
• 11 September 2026: manufacturers must report actively exploited vulnerabilities and severe incidents. This also covers products already on sale (Article 69).
• 11 December 2027: everything else applies, including security requirements for new products and CE marking for cyber security.

The reporting duty that started in September works like NIS2: an early warning within 24 hours of becoming aware of an actively exploited vulnerability, a notification within 72 hours, and a final report no later than 14 days after a fix is available (one month after the notification for a severe incident). Reports go through ENISA's Single Reporting Platform to the national CSIRT, and the manufacturer must tell affected users (Article 14, European Commission). ENISA opened the platform on 11 September and says it will add functions over the coming months (ENISA). Breaking the reporting or security rules can cost up to €15 million or 2.5% of worldwide turnover.

For companies that only buy products, the CRA is good news: within a few years, connected products sold in the EU must come with security updates and a way to report flaws. Until then, ask suppliers how long they support their products with security updates, and prefer those who answer clearly.

And the UK?

EU law no longer applies in the UK. Its counterpart, the Cyber Security and Resilience Bill, would bring managed service providers, data centres and critical suppliers under regulation. It is not law yet: report stage in the House of Lords begins on 26 October 2026 (UK Parliament), and most of the detail will follow in secondary legislation after it passes.

What to do now

1. Work out whether NIS2 applies to you, sector by sector, in every EU country where you operate. If it does, check you are registered: in the Netherlands and Germany registration is already required.
2. Put your board in charge. NIS2 makes management responsible, so cyber security belongs on the board agenda, with training for its members.
3. Prepare for the 24-hour clock. Decide now who reports an incident to whom, and test it: a first warning within a day is hard to meet if you start working it out during an incident.
4. Check the ten areas of Article 21 against what you do today. A framework such as ISO 27001 or CyberFundamentals covers much of this; check supply-chain security and testing whether measures work in particular, as they are easy to miss.
5. If you make or import connected products, set up CRA vulnerability reporting now: it has applied since 11 September 2026.
6. If you are a supplier to in-scope companies, expect security questionnaires, and have your answers and evidence ready.

To keep the incident-reporting clock from starting at all, the basics still matter most: patch internet-facing systems quickly. Our monthly patch round-up lists the flaws attackers are actually using.

Sources are linked in the text. The legal text was read through springlex.eu, which reproduces the Official Journal. Dates and status were checked on 26 October 2026. This article is general information, not legal advice.