An overview of the most important EU cybersecurity regulations relevant to your organisation.
The European Union has built up a comprehensive package of cybersecurity regulations in recent years. The Cyber Resilience Act (CRA) is the most recent and far-reaching regulation, focused on products with digital elements. In addition to the CRA, NIS2, the Cybersecurity Act and the AI Act are also relevant for organisations that develop, import or distribute digital products. CRA-Portal helps you understand which regulations apply to your organisation.
Entered into force on 10 December 2024. Requires manufacturers, importers and distributors of products with digital elements to comply with strict cybersecurity standards. Deadline: 11 December 2027.
The Network and Information Security Directive 2 applies to essential and important entities in sectors such as energy, transport, healthcare and digital infrastructure. Significantly increases security obligations and reporting requirements.
Establishes the framework for European cybersecurity certification schemes for ICT products, services and processes. ENISA plays a central role as the permanent EU cybersecurity agency.
The EU AI Act introduces risk-based requirements for AI systems. For organisations integrating AI into connected products there is an overlap with CRA obligations that needs to be carefully mapped.
Non-compliance with the CRA can lead to fines of up to €15 million or 2.5% of global annual turnover, whichever is higher. Market surveillance authorities can withdraw and ban products from the market. In addition to financial damage, non-conformity leads to reputational harm and loss of market access throughout the EU.
Our experts analyse your situation and provide a clear overview of your obligations.