CRA

The Cyber Resilience Act (CRA), (EU) 2024/2847, which came into effect in late 2024, regulates the cybersecurity of products with digital elements sold within the EU market. Its implementation occurs in stages, with all requirements to be met by the end of 2027.

Initially, from September 11, 2026, companies that manufacture, import, or distribute hardware or software for commercial purposes within the EU are subject to reporting obligations for actively exploited vulnerabilities and serious security incidents according to a strict timeline. The Federal Office for Information Security (BSI) organizes webinars and provides a comprehensive overview of the CRA on its website. There, you can learn about the affected products, the timeline, specific actions needed, and how the BSI provides support. References to the European Commission's relevant information and FAQs are also included.

NIS-2

The "Second Directive on Security of Network and Information Systems," or NIS2 Directive (EU) 2022/2555, is a binding EU cybersecurity standard that has been in effect in Germany since December 6, 2025, through the NIS2UmsuCG. Since then, approximately 29,000 institutions in 18 critical sectors whose IT failures could have significant impacts on the economy and society have been mandated to implement strict risk management, reporting obligations, and personal liability for management.

Registration with the BSI was required for this; the extended deadline expired on July 31, 2026. However, the BSI still provides an overview of its assistance pages on its website for the implementation of the NIS-2 Directive. Companies can find there a "NIS-2 impact assessment," a FAQ collection, or a page "What to do?" with practical guidance and legal background. On a subpage, the BSI summarizes, with the hashtag #nis2know, information packages on NIS-2 obligations.

BSI portal