CRA or NIS2: which incident reporting applies to you?
Both texts ask for a 24-hour early warning and a 72-hour notification, so they are easy to mix up. They cover different things, go to different places, and can both apply to the same company. Here is how to tell them apart.
The Cyber Resilience Act: about your product
- Who: manufacturers of products with digital elements sold in the EU.
- What: an actively exploited vulnerability in the product, or a severe incident that affects its security.
- Where: one submission on ENISA’s Single Reporting Platform, which reaches the coordinating CSIRT and ENISA.
- When: early warning within 24 hours, notification within 72 hours, final report 14 days after a fix is available (one month after the notification for an incident).
- Since: 11 September 2026, for every product on the market, including those placed on it before.
NIS2: about the service you run
- Who: essential and important entities in the sectors listed by the NIS2 Directive, mostly medium and large organisations, and some regardless of size.
- What: a significant incident that affects the services you provide.
- Where: your national CSIRT or competent authority.
- When: early warning within 24 hours, notification within 72 hours, final report within one month of the notification (Article 23).
When both apply
A software vendor that also runs a NIS2-covered service, such as a managed service or a cloud service, can face both at once: the exploited flaw is in its product (CRA) and it disrupts its own service (NIS2). The two reports are separate, on separate channels, even when they describe the same event. Software sold only as a service falls outside the CRA, unless the remote processing is part of a product.
If personal data is involved, the GDPR adds a third clock: 72 hours to notify the data protection authority.
A simple test
Ask two questions for each event. Is the problem in something we sell? Then look at the CRA. Does it disrupt a service we provide as a NIS2 entity? Then look at NIS2. Write down both answers, and when you made them: the clocks start when you become aware.
For the CRA side, Clearlane CRA runs the three Article 14 clocks on the Jira work item and prepares every ENISA field. See also how to report an actively exploited vulnerability.
Sources: Regulation (EU) 2024/2847, Articles 14 and 69; Directive (EU) 2022/2555, Article 23. Checked on 16 October 2026. This guide is general information, not legal advice.