The Cyber Resilience Act is just another expected-to-be-delayed NIS2 variant, right? No!
You may recall that NIS2 is a Directive, whereas CRA is a Regulation. Does it matter? Yes!
| Aspect | Directive (e.g., NIS2) | Regulation (e.g., CRA) |
|---|---|---|
| Legal nature | Framework law — sets goals and minimum requirements for Member States. | Directly binding law — applies as written across all Member States. |
| Transposition | Must be implemented into national law (e.g., Denmark’s Lov nr. 434/2025). | No transposition — automatically becomes part of national law upon entry into force. |
| Flexibility | Allows national adaptation (terminology, authorities, penalties). | Uniform — identical text and obligations in all Member States. |
| Scope of variation | High — each country may tailor enforcement and sector coverage. | Low — only interpretation guidance; no national rewriting. |
| Legal hierarchy | Below regulations in direct effect; depends on national implementation. | Highest form of EU law after treaties; overrides conflicting national law. |
| Example in Denmark | NIS2 → Danish NIS2 Act (Lov nr. 434/2025). | CRA → Applies directly once published in the Official Journal; no Danish act needed. |
In short, a Directive tells us what to achieve, not strictly when; just look at the delays in the Danish NIS2 implementation:
A Regulation, on the other hand, tells us exactly how to do it, with no room for national delay or reinterpretation.
The deadlines for the Regulation (here, CRA) are thus carved in stone.
If you got this wrong with CRA, expecting the hard deadlines from the Commission to be delayed the same way as with NIS2, then you are in for a surprise.
So what to do?
Knowing that the dates will not change, the only sensible approach, should you not already have done so, is to establish a top-priority project to ensure you’ll meet the deadlines.
If you do not have a valid CE sticker on your products after DEC 11, 2027, you are not permitted to place them on the EU market.
So no, CRA is not another NIS2 expected to be delayed. Dates are carved in stone.
A need to understand the CRA a little better? Have a look at this article and its CRA quiz.