CRA vs NIS2 vs GDPR: which one applies to you

"We already have GDPR, so we don't need the CRA" — this sentence comes up often, and it's wrong. The CRA, NIS2 and GDPR are three different laws, each aimed at something else, and they can easily apply at once. Let's distinguish them by the single question that decides it all: what do they actually regulate?

The CRA — products

The Cyber Resilience Act (Regulation (EU) 2024/2847) concerns products with digital elements and those who place them on the EU market (manufacturers, importers, distributors). It's about making the product itself secure:

1. who: makers of software and devices, importers and distributors,
2. what: secure-by-design properties (Annex I Part I), vulnerability handling (Part II), reporting of actively exploited vulnerabilities (Art. 14), technical documentation, CE,
3. when: reporting from 11 September 2026, full conformity from 11 December 2027.

NIS2 — running services

NIS2 (Directive (EU) 2022/2555) covers the cybersecurity of operations at selected entities — not a product, but how an organisation protects its services and networks. Key differences from the CRA:

1. who: "essential" and "important" entities by sector and size (energy, transport, health, digital infrastructure, IT service providers and more) — this includes many SaaS providers,
2. what: risk-management measures, incident reporting to the national CSIRT, management accountability,
3. form: it's a directive, which each state transposes into its own law — the transposition details differ by country.

This is exactly why pure SaaS is mostly out of the CRA but may be within NIS2's scope — more in the CRA and SaaS article.

GDPR — personal data

GDPR (Regulation (EU) 2016/679) concerns the processing of personal data — regardless of whether you make a product or run a service. If you process data about people, it applies:

1. who: anyone processing the personal data of people in the EU,
2. what: a lawful basis for processing, security of processing, data-subject rights, notification of a personal-data breach to the supervisory authority within 72 hours (Art. 33),
3. beware confusing the clocks: the 72 hours in GDPR (a data breach) is a different duty from the 24/72 hours in the CRA (an actively exploited vulnerability/incident). Don't mix them up.

Beware confusing the deadlines

The most common practical mistake isn't about scope but about reporting deadlines — each law has its own:

1. CRA (Art. 14): an actively exploited vulnerability / severe incident → 24 h early warning and 72 h notification (from becoming aware), then a final report (vulnerability: 14 days from a corrective measure being made available; incident: one month from the 72-hour notification) — via the SRP simultaneously to the coordinating CSIRT and ENISA.
2. GDPR (Art. 33): a personal-data breach → 72 h to the supervisory authority (in Slovakia, the Office for Personal Data Protection).
3. NIS2 (Art. 23): an incident at an essential/important entity → the deadlines are in the directive itself (Art. 23(4)): a 24 h early warning, a 72 h notification, and a final report within one month of the notification. Transposition (national law) governs whom you report to and how — in Slovakia, the national CSIRT.

The same event can bind you to several reports at once — e.g. an incident that is both a personal-data breach and a hit to the product's security. That's why it pays to be clear in advance which tracks apply to you.

When they apply at once

The difference in scope doesn't mean "pick one". Common combinations:

1. A maker of a device that processes personal data → CRA (product) + GDPR (data).
2. A SaaS provider in a regulated sector → NIS2 (operations) + GDPR (data); usually not the CRA, unless it ships an installable product.
3. A small software maker with no personal data and outside NIS2 sectors → mostly just the CRA.

Why companies confuse them

The mix-up arises because all three laws talk about "cybersecurity" and have reporting deadlines — yet each aims elsewhere. One sentence each helps: CRA = a secure product, NIS2 = secure operations of an organisation, GDPR = protection of personal data. When, for a given obligation, you ask "does this concern my product, my operations, or data about people?", you almost always hit the right law.

The second source of confusion is assuming "one is enough". It isn't — they're independent regimes with their own authorities. Meeting GDPR doesn't mean meeting the CRA, and vice versa. So it pays to first map which of the three apply to you at all, then handle the details; for the CRA part, the first step is the scope-checker.

FAQ

1. We're an online shop, does the CRA apply? The shop as a service usually doesn't (more likely GDPR, possibly NIS2). But if you sell your own software or a device, that part falls under the CRA.
2. We have an app and a cloud — which law? Quite possibly both worlds: the CRA for the installable part and its necessary backend, GDPR for the personal data you process.
3. Does the GDPR 72-hour deadline also apply to the CRA? No — they're two different duties with different recipients. Don't conflate them.

Key point

Three laws, three different questions. The CRA (Regulation 2024/2847) asks "is your product secure?", NIS2 (Directive 2022/2555) "is your organisation's operation secure?", and GDPR (Regulation 2016/679) "do you protect personal data?". They're not alternatives you choose between — they can apply at once: a device maker that processes personal data is under both the CRA and GDPR; a SaaS provider in a regulated sector under both NIS2 and GDPR. The most common practical trap isn't scope but reporting deadlines: the 72 hours under GDPR (a personal-data breach, Art. 33) is a different duty with a different recipient than the 24/72 hours under the CRA (an actively exploited vulnerability, Art. 14). So first map which of the three apply to you at all, then deal with the details. For the CRA part the first step is the scope-checker; NIS2 and GDPR are separate worlds with their own tools.

How CRAguard helps

CRAguard addresses the CRA part specifically — product security, vulnerability monitoring, a reporting channel and inputs for self-assessment. NIS2 and GDPR are separate worlds with their own tools; we don't pretend to cover them. What we can do is take the CRA paperwork and monitoring off your hands. Find out whether the CRA applies to you, or join the waitlist.

This article is informational and not legal advice. It is based on Regulation (EU) 2024/2847 (CRA), Directive (EU) 2022/2555 (NIS2) and Regulation (EU) 2016/679 (GDPR, Art. 33). It gives only scope and basic obligations, not the details of NIS2 national transposition.