NIS2, DORA, the CRA and the new PLD: Europe’s cyber package, decoded.

Why these laws reach you

Two of the four are ‘directives’, NIS2 and the Product Liability Directive. A directive sets goals that each EU country must write into its own national law, so the detail can vary by country. DORA and the CRA are ‘regulations’, which apply directly and identically across the EU.

None of them cares much where your company is incorporated. What matters is whether you provide services in the EU, sell products there, or supply businesses that are themselves in scope. A US or Indian software company selling into Europe can be covered directly, or indirectly through its customers’ contracts.

NIS2: who is in scope

NIS2 replaced the first NIS Directive, and member states had to transpose it into national law by 17 October 2024. Several were late, so national laws are still rolling out. It covers organisations in a long list of sectors, including cloud computing, data centres, managed IT and security services, online marketplaces, search engines and social networks.

As a rule, only medium and large organisations are caught. Broadly, that means at least 50 staff, or annual turnover or balance sheet above €10 million. Some providers are covered regardless of size, including DNS service providers, top-level domain registries and trust service providers.

In-scope organisations are either ‘essential’ or ‘important’ entities, which affects supervision and fines. National laws must allow fines of up to at least €10 million or 2% of worldwide turnover for essential entities, and €7 million or 1.4% for important ones, whichever is higher.

NIS2: what it asks for

NIS2 requires ‘appropriate and proportionate’ security measures. Senior management must approve those measures, oversee them and take training, and can be held personally accountable in some countries.

Incident reporting is staged. Significant incidents need an early warning to the national authority within 24 hours, a fuller notification within 72 hours and a final report within one month. Your plan needs to work on a weekend.

In January 2026 the Commission proposed targeted amendments to NIS2 alongside a revised Cybersecurity Act. They are still under negotiation, so build to the current rules.

• Risk analysis and information security policies.
• Incident handling, business continuity and backups.
• Supply-chain security, including your vendors.
• Secure development, vulnerability handling and disclosure.
• Access control, multi-factor authentication and encryption where appropriate.
• Staff cyber hygiene and training.

DORA: if your customers are financial firms

The Digital Operational Resilience Act has applied since 17 January 2025. It covers EU banks, insurers, investment firms, payment institutions, crypto-asset service providers and others. It requires them to manage ICT risk, test their resilience and report major ICT incidents.

DORA matters to technology suppliers mainly through contracts. Financial firms must include specific terms in contracts with their ‘ICT third-party service providers’, meaning anyone supplying them with digital or data services. They must also keep a register of those contracts. Expect these clauses in every deal.

A small number of providers face direct supervision. In November 2025 the European Supervisory Authorities designated the first ‘critical ICT third-party providers’, which include several major cloud companies. Most startups will never be designated, but they will be asked for the same evidence by their customers.

• Clear service descriptions, locations of data processing and service levels.
• Assistance with incidents, at a pre-agreed cost or free.
• Cooperation with the customer’s regulators, and termination rights.
• Participation in the customer’s security awareness training.
• For critical or important functions, audit rights, exit plans and participation in resilience testing.

The Cyber Resilience Act: what it covers

The CRA applies to ‘products with digital elements’ placed on the EU market. That means hardware and software that connects to a device or network, from smart cameras to desktop applications and many software libraries. Most commercial software products are in scope.

Pure software-as-a-service is generally outside the CRA, because NIS2 covers services. But a cloud backend may be caught where it is a remote data processing solution essential to a product’s functions, such as the app and server behind a connected device.

Duties fall mainly on ‘manufacturers’, meaning whoever develops a product, or has it developed, and sells it under their own name. Importers and distributors have lighter checking duties. Free and open-source software supplied outside a commercial activity is largely excluded. Open-source foundations that steward projects used commercially have a lighter regime of their own.

The Cyber Resilience Act: what it requires and when

Reporting duties began on 11 September 2026 and apply to products already on the market. Manufacturers must report actively exploited vulnerabilities and severe incidents through ENISA’s single reporting platform. An early warning is due within 24 hours, a notification within 72 hours, and a final report within 14 days of a fix being available for vulnerabilities, or within one month for incidents.

The full obligations apply from 11 December 2027. Products must be designed and built to meet essential security requirements, ship without known exploitable vulnerabilities and receive security updates through a ‘support period’. That period must be at least five years unless the product is expected to be used for less.

You will also need a ‘software bill of materials’, a list of the components inside your product, plus technical documentation and a conformity assessment before you apply the CE marking. Fines for breaching the core requirements can reach €15 million or 2.5% of worldwide turnover, whichever is higher.

The new Product Liability Directive: software is a product

The revised Product Liability Directive applies to products placed on the EU market from 9 December 2026. It expressly treats software, including AI systems, as a product. Manufacturers face ‘no-fault’ liability, meaning an injured person does not need to prove carelessness, only that the product was defective and caused the damage.

Recoverable damage includes death, personal injury, including recognised psychological harm, damage to property and the destruction or corruption of data not used for professional purposes. Damage to property used only for professional purposes is excluded, so most business-to-business losses fall outside it. Liability can continue after sale where you control the software, including through updates and the failure to supply security updates needed to keep it safe.

Claims must be brought within three years of the person learning of the damage, the defect and who is liable. There is a ten-year backstop from when the product was placed on the market, extended to 25 years for latent personal injury. Courts can order manufacturers to disclose evidence, and presumptions make claims easier where technical complexity makes proof hard.

How the four fit together

A single security flaw can trigger all four laws. A CRA report to ENISA. A NIS2 incident report by your customer, who then asks for your help under its contract. A DORA audit request from a bank. And, if the flaw causes harm to a consumer, a product liability claim.

So build one programme, not four. One vulnerability intake process, one incident playbook with the different reporting clocks mapped out, and one evidence pack you can reuse for audits and questionnaires. If you also operate in India, its CERT-In rules require certain incidents to be reported within six hours, so design to the fastest clock you face.

Finally, revisit your contracts. Liability caps in business contracts do not limit what an injured consumer can claim under the new directive. Check your indemnities and insurance cover with that in mind. The UK is not bound by these EU laws, but UK companies selling into the EU are. The UK is also catching up: its Cyber Security and Resilience Bill, going through Parliament in 2026, would bring managed IT service providers and data centres into scope and, as drafted, require an initial incident report within 24 hours and a fuller one within 72.