Product and sector laws

Required

• Decide whether NIS2 covers you

  Required

  Decide whether the NIS2 Directive covers you from your sector and size, record the decision, and register with the national authority when it does.

• Map the NIS2 measures to controls

  Required

  If NIS2 covers you, map each of the ten measures in Article 21(2) to checked controls. Management approves them and takes training on them.

• Decide whether the Cyber Resilience Act covers your product

  Required

  List every product with digital elements you place on the EU market, record whether the Cyber Resilience Act applies to each, and record its class.

• Report exploited vulnerabilities in your products

  Required

  Since 11 September 2026, report every actively exploited vulnerability and severe incident in a CRA product. Use the ENISA single reporting platform.

• Handle vulnerabilities for the whole support period

  Required

  State a support period of at least five years for each covered product, unless its use is shorter. Ship free security fixes until it ends.

• Prepare the technical file and CE marking

  Required

  From 11 December 2027, each covered product needs a technical file, an EU declaration of conformity and a CE marking. Keep them for ten years or the support period, whichever is longer.

• Meet the European Accessibility Act as a legal duty

  Required

  Record whether the European Accessibility Act covers your products or services. If it does, meet EN 301 549, publish how you meet it, and test it in every build.

• Let cloud customers leave under the Data Act

  Required

  If you sell a cloud or software service to EU customers, offer a tested full export and the switching terms of the Data Act. Charge nothing for switching from 12 January 2027.