The major question for many companies in the European Union, which makes them feel uncertain, is “Which security rules should be followed and which of these are or are becoming important?” These rules are the Cyber Resilience Act (CRA) and the NIS2 Directive. While both focus on different aspects and their aim is to improve the level of digital security in Europe, many small and medium companies do not know which one they need to follow or if they need to follow both. The article’s purpose is to explain these two rules in simple language, highlighting the main differences and helping companies understand what they must do. Both rules and their aims are clearly presented and explained in publications from the European Commission (European Commission 2023a, European Commission 2023b). The CRA is a rule created to make digital products more secure before they reach customers and to keep them secure during their full lifetime. A digital product can be software, hardware, or at any device with a digital element. Any company that builds digital products, sells them, or brings them into the European Union must follow the CRA. This includes software developers, manufacturers of smart devices, distributors, and even companies based outside the European Union that want to place their products on the European market. The CRA asks companies to design products with care for security from the start, to carry out risk checks before release, to fix security problems quickly, to keep products updated, and to report serious issues. These expectations are described by the European Commission and supported by guidance from ENISA which is the security agency of the European Union (European Commission 2023a, ENISA 2023). NIS2 Directive focuses on how organizations run their services. It applies to companies, critical infrastructures, and public bodies that provide important services in areas such as energy, water, transport, health, public administration, and digital infrastructure. It also applies to managed service companies that look after systems for other organizations. NIS2 asks organizations to keep strong security practices in place, report incidents quickly, control risks from suppliers, prepare crisis and continuity plans, and ensure that leaders understand their responsibility. These points are listed in the NIS2 Directive and explained further in guidance produced by ENISA (European Commission 2023b, ENISA 2023). The main differences between the CRA and NIS2 are shown in Table 1, which provides a clear side by side comparison of their focus, scope, and legal structure.

Table 1: Comparison of the CRA and NIS2.

Main focus	Security of products with digital element	Security of the organization and its processes
What is applied to	Products that companies build or sell	Services that companies provide and the way they operate
Legal form	Applies directly across all European Union countries	Must be turned into national laws by each country
What it covers	Software and hardware products	Company systems, networks, operations, and service delivery
Core idea	Make products secure from the start and keep them secure	Keep organizational processes and services secure at all time
Basis of information	European Commission documents (European Commission 2023a)	European Commission documents (European Commission 2023b)

While the differences between CRA and NIS2 are clear, the situation in which companies must foll the CRA, NIS2 or both are presented in Table 2, which summarizes the main condition for these three cases.

Table 2: Which companies must follow CRA, NIS2 or both (ENISA 2023).

Rule / Case	Companies that must follow it	Examples
CRA	Companies that build software or digital devices, sell them in the European Union, or import them	Software developers, device makers, digital product distributors
NIS2	Companies that provide essential or important services, belong to a listed sector, or act as managed service providers	Energy providers, health services, transport operators, IT service companies
Both CRA and NIS2	Companies that build digital products and also operate in essential sectors, or software vendors that support critical fields	A medical device maker, a software company serving critical infrastructure, a managed service company that also builds products

There is also confusion for small and medium companies. Many software companies believe they must follow NIS2 even when they only build products and do not provide essential services. In most situations these companies fall under the CRA but not NIS2. Other companies think CRA applies to them even though they only offer services and do not develop products. These companies often fall under NIS2 but not the CRA. Software as a Service (SaaS) companies must look closely at their situation. More specifically:

• If a company delivers the product as a service, it might fall under NIS2.
• If the company also sells the software as a product, it might fall under the Cyber Resilience Act (CRA) as well.

These situations are discussed in various European guidance notes and explain why companies must review their setup carefully (ENISA 2023).

Every company should know what steps to take next. The steps for each different company situation are displayed in Table 3.

Table 3: Recommended Next Steps for Companies Under CRA, NIS2, or Both

Company Situation	Recommended Next Steps
Company must follow the CRA	Introduce security into every stage of product design and development. Set up a clear process for fixing security problems. Maintain required documentation. Determine the correct CRA product category. Learn about relevant reporting duties.
Company must follow NIS2	Review the current operational security level. Establish a fast incident-reporting process. Assess risks arising from suppliers. Train leadership in security responsibilities. Prepare for audits
Company must follow NIS2	Align product security efforts with operational security measures. Avoid duplicated work by using shared processes for reporting and risk management.

Both the European Commission and ENISA advise companies to begin preparing early because meeting the requirements takes time (European Commission 2023a, European Commission 2023b, ENISA 2023).

In conclusion, the CRA focuses on the security of products and the NIS2 directive focuses on the security of services. A company that builds products should look at the CRA. A company that runs essential services should look at NIS2. Some will need to follow both rules. Understanding the difference helps companies prepare and avoid confusion during this new period of digital security in the European Union.

This article is based on information from the European Commission and from ENISA which are the official sources for these rules.

References:

• ENISA 2023, Guidance on CRA and NIS2, European Union Agency for Cybersecurity, viewed 2023.
• European Commission 2023a, Cyber Resilience Act, European Commission, viewed 2023.
• European Commission 2023b, NIS2 Directive Information Page, European Commission, viewed 2023.