NIS2 vs Cyber Resilience Act vs EU AI Act: which applies to your company?
NIS2, the Cyber Resilience Act and the EU AI Act are three separate EU laws that regulate different things. NIS2 regulates the organisations that provide essential and important services, the Cyber Resilience Act (CRA) regulates the products with digital elements those organisations make and sell, and the AI Act regulates AI systems by level of risk. A company can fall under one, two or all three.
The confusion is understandable. All three mention cybersecurity, all three carry serious fines and all three are arriving at the same time. This guide shows how they differ, how to tell which ones apply to you, and how to avoid doing the same work three times.
Key takeaways:
NIS2 is about organisations, the CRA is about products, and the AI Act is about AI systems.
One company, several laws. A software company building an AI-enabled product for hospitals can meet all three.
Three clocks, one bad day. A single incident can trigger reporting under more than one law, each with its own recipient.
The foundations overlap. An asset inventory, vulnerability handling, incident response, supplier management and training serve all three.
What is the difference between NIS2, the CRA and the EU AI Act?
The simplest way to separate the three is to ask what each one regulates. NIS2 looks at how an organisation manages cybersecurity risk in the services it runs. The CRA looks at the security of the products it sells. The AI Act looks at how AI systems are built and used, based on the risk they create.
NIS2 — Network and Information Security Directive
Legal act: Directive (EU) 2022/2555
What it regulates: Organisations operating in essential and important sectors.
Who is in scope: Generally medium-sized and large entities operating in the sectors covered by the directive.
Key obligations: Cybersecurity risk management, supply chain security, incident reporting, and management accountability.
Key dates: In force through national legislation, with implementation and enforcement depending on the member state.
Maximum fines: Up to €10 million or 2% of worldwide annual turnover for essential entities; €7 million or 1.4% for important entities.
Cyber Resilience Act (CRA)
Legal act: Regulation (EU) 2024/2847
What it regulates: Products with digital elements made available on the EU market.
Who is in scope: Manufacturers, importers, and distributors, including businesses based outside the EU.
Key obligations: Security by design, vulnerability handling throughout the support period (at least five years in general), reporting obligations, and CE marking.
Key dates: Reporting obligations apply from 11 September 2026; the main requirements apply from 11 December 2027.
Maximum fines: Up to €15 million or 2.5% of worldwide annual turnover.
EU AI Act
Legal act: Regulation (EU) 2024/1689
What it regulates: Artificial intelligence systems, with obligations determined by their risk classification.
Who is in scope: AI providers and deployers, including certain organisations established outside the EU.
Key obligations: Prohibition of certain AI practices, AI literacy, transparency requirements, and strict obligations for high-risk AI systems.
Key dates: Phased application beginning in February 2025, with high-risk AI requirements scheduled for 2 December 2027 and 2 August 2028 under the revised timeline reflected in your source.
Maximum fines: Up to €35 million or 7% of worldwide annual turnover for prohibited AI practices.
How do I know which law applies to me?
Three questions get you most of the way there. Do you make, import or sell anything with software or connectivity in the EU? If yes, the CRA is likely relevant. That includes standalone software and connected hardware.
Do you operate in a sector NIS2 lists, at medium size or above? Energy, transport, banking, health, digital infrastructure, ICT services and public administration are the most obvious, and a wider set of manufacturing, food, chemicals and digital providers count as important entities. If yes, NIS2 is likely relevant.
Do you build, or use, AI systems? If yes, the AI Act applies to you in some form. The question is which level.
Many companies answer yes to two or three. That is normal, and it is manageable if you look at the laws together.
What is NIS2 and how does it work in Romania?
NIS2 is the EU directive that raises the baseline of cybersecurity across essential and important sectors. It requires risk management measures, supply chain security and incident reporting, and it makes management personally accountable for oversight. Being a directive, it applies through national law.
In Romania, NIS2 is implemented through Government Emergency Ordinance 155/2024, and the National Cybersecurity Directorate (DNSC) is the competent authority. Details such as registration and reporting procedures are set by the authority, so check DNSC’s current guidance for your sector.
Under the directive, significant incidents follow a three-step rhythm: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month.
What does the Cyber Resilience Act cover?
The CRA covers the products, not the organisation. Manufacturers of hardware and software with digital elements must build them securely, support them with security updates for at least five years, report actively exploited vulnerabilities and severe incidents within 24 hours of awareness, and show conformity through CE marking. Reporting has applied since 11 September 2026, and the full requirements apply from 11 December 2027. Our Cyber Resilience Act compliance guide covers the details.
What does the EU AI Act cover?
The AI Act covers how AI is built and used. It bans certain practices, expects organisations to support AI literacy, sets transparency rules for AI-generated content and imposes strict requirements on high-risk systems. Following the AI Omnibus, which entered into force on 27 July 2026, the high-risk rules apply from 2 December 2027 for stand-alone systems and 2 August 2028 for AI built into regulated products. Our EU AI Act compliance guide explains each step.
What happens on a single bad day?
A serious event can touch several laws at once, each with its own trigger, clock and recipient.
Scenario 1: Your build or update system is compromised and pushes malicious code to customers
NIS2: Significant incident affecting your services.
Cyber Resilience Act (CRA): Severe incident affecting your product.
EU AI Act: Possibly applicable if the product is a high-risk AI system.
Scenario 2: A vulnerability in your product is being exploited in the wild
NIS2: Applies if the vulnerability affects your own services.
Cyber Resilience Act (CRA): Early warning within 24 hours.
EU AI Act: Applicability depends on the AI system.
Scenario 3: An AI tool leaks customer data
NIS2: Incident covered by your risk management duties.
Cyber Resilience Act (CRA): Applies only if a product covered by the regulation is affected.
EU AI Act: Raises transparency and governance questions.
The lesson is not to memorise the table. It is to have one incident process that can answer the question “which of our obligations does this trigger?” in the first hour.
An illustrative example
Picture a Romanian software company that builds a scheduling platform with an AI assistant, sold to hospitals across the EU. The hospitals are likely NIS2 entities, so they will ask the company about supply chain security. The platform is a product with digital elements, so the CRA applies to the company as manufacturer. The AI assistant is an AI system, so the company is a provider under the AI Act, and if the assistant influences decisions about staff or patients, the classification deserves a careful look.
One company, three laws, and one shared foundation of asset inventory, vulnerability handling, incident response and supplier oversight.
How to prepare for all three without tripling the work
Start with what the three have in common:
One inventory. Products, services, AI tools and suppliers in a single register, with an owner for each.
One vulnerability and incident process. Detect, decide, report, learn. Map each law’s clock and recipient side by side.
One supplier conversation. Ask vendors the same set of questions about security, AI use and data handling, and use their answers for all three.
One awareness habit. Short, role-based guidance that covers security, AI use and reporting, refreshed regularly.
One roadmap. Sequence the work by deadline and effort. The CRA reporting duties and the AI transparency duties come first, the full CRA and high-risk AI rules follow.
How CUBE helps
CUBE brings together eight Romanian technology companies covering software, cloud, data, AI and infrastructure, so we can look at your products, your services and your AI in one conversation. Through CyberGlobal, part of our network, we add security assessment, penetration testing, monitoring and incident response. We prepare you for conformity, audits and assessments, and we stay by your side while independent bodies do their part.
Frequently asked questions
What is the difference between NIS2 and the Cyber Resilience Act?
NIS2 regulates organisations in essential and important sectors and their cybersecurity risk management, while the Cyber Resilience Act regulates the security of products with digital elements placed on the EU market. NIS2 is about how you run services, and the CRA is about what you sell.
Does the Cyber Resilience Act replace NIS2?
No. The two laws sit side by side. NIS2 covers the organisation and its services, and the CRA covers its products. A company that both operates in a NIS2 sector and sells connected products may have to meet both, with separate reporting duties.
Does the EU AI Act overlap with NIS2 and the CRA?
Yes, in practice. All three expect strong security, incident handling and supply chain oversight. The AI Act adds rules specific to AI systems, including risk classification, transparency and, for high-risk systems, requirements for robustness and cybersecurity.
Which EU law applies to a software company?
It depends on what the company does. A software company selling products in the EU is likely covered by the Cyber Resilience Act. If it also provides services in a sector NIS2 lists, or builds or uses AI systems, NIS2 and the AI Act may apply as well.
Who is the competent NIS2 authority in Romania?
The National Cybersecurity Directorate (DNSC) is the competent authority for NIS2 in Romania, under Government Emergency Ordinance 155/2024. Organisations should check DNSC’s current guidance on registration and incident reporting.
Where should a company start with EU cybersecurity regulations?
Start with one inventory of products, services, AI tools and suppliers, then work out which of the three laws each item touches. A short self-assessment, such as a cybersecurity health check, helps show where the biggest gaps are before you plan the work.
General information, not legal advice. Please involve your legal counsel for binding interpretation. Details checked against the directive, the two regulations and the AI Omnibus in October 2026.
Not sure which laws apply to you? Book a thirty-minute conversation with CUBE. Plain language, no pressure, and you keep the notes either way.