Regulation
What exactly it obliges you to do
Not a summary of the directive: the concrete obligation, who it applies to, by when, and what evidence holds it up.
- NIS2 NIS2 — Directive (EU) 2022/2555 Directive (EU) 2022/2555 of 14 December 2022
- Who it applies to
- Entities in the sectors listed in Annexes I and II that exceed the medium-sized enterprise ceilings (50 or more staff, or more than EUR 10 million in annual turnover or balance sheet total). Regardless of size, qualified trust service providers, top-level domain name registries and DNS service providers are in scope. Member States may additionally designate specific entities on criticality grounds.
- Deadline
- Member States had to adopt and publish transposing measures by 17 October 2024 and apply them from 18 October 2024. National lists of essential and important entities were due by 17 April 2025. What binds you is the national transposition law, not the directive itself.
- DORA DORA — Regulation (EU) 2022/2554 Regulation (EU) 2022/2554 of 14 December 2022
- Who it applies to
- The financial entities listed in Article 2: credit, payment and electronic money institutions, investment firms, fund managers, insurance and reinsurance undertakings, crypto-asset service providers, central securities depositories, central counterparties, trading venues and credit rating agencies, among others. It also reaches the ICT third-party service providers that serve them, with a dedicated oversight regime for those designated critical.
- Deadline
- Applicable since 17 January 2025, with no transitional period. The recurring internal deadlines are annual: review of the ICT risk management framework, review of asset classification, testing of continuity plans, and reporting on the register of information. Threat-led penetration testing, at least every three years for identified entities.
- ENS ENS — Spanish Royal Decree 311/2022 Real Decreto 311/2022, de 3 de mayo, regulating the Esquema Nacional de Seguridad
- Who it applies to
- The whole Spanish public sector as defined in Article 2 of Law 40/2015. In addition — and this is what catches companies out — it applies to the information systems of private-sector entities when, under a contractual relationship, they provide services or supply solutions to public bodies for the exercise of their administrative powers (Article 2(3)). The same caution extends to those contractors' own supply chain to the extent the risk assessment requires.
- Deadline
- In force since 5 May 2022. Pre-existing systems had twenty-four months to reach full compliance; new systems apply it from design. The ordinary audit recurs at least every two years, and must be brought forward as an extraordinary audit whenever the system undergoes substantial modification.
- CRA CRA — Regulation (EU) 2024/2847 Regulation (EU) 2024/2847 of 23 October 2024
- Who it applies to
- Manufacturers, importers and distributors placing or making available on the Union market products with digital elements — any software or hardware product whose intended use includes a direct or indirect data connection to a device or network. Conformity assessment obligations vary depending on whether the product is default, important (Annex III, classes I and II) or critical (Annex IV). Products already covered by specific sectoral law, and free and open-source software developed outside a commercial activity, are among the exclusions.
- Deadline
- Fully applicable from 11 December 2027. Article 14, which imposes reporting of actively exploited vulnerabilities and severe incidents, applies earlier: from 11 September 2026. Chapter IV, on notified bodies, from 11 June 2026.
Want to see it on your own data?
The proof of concept stands up an environment with your real scope. No cost, no commitment to continue.