CRA vs DORA vs NIS2: what is the difference?
The CRA regulates products, NIS2 regulates organisations in key sectors, and DORA regulates financial firms and their ICT providers. All three are EU laws. The UK's own regime is the Cyber Security and Resilience Bill (CSRB), but UK businesses can still be caught through EU activity.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
The short version
These are three separate EU laws, and none of them is UK law. The Cyber Security and Resilience Bill (CSRB) is a fourth, separate regime for the UK.
Each EU law answers a different question:
- The Cyber Resilience Act (CRA) asks: is this product secure?
- NIS2 asks: is this organisation managing cyber risk, given the sector it works in?
- DORA asks: can this financial firm withstand and recover from ICT disruption?
So a single business can face more than one. A UK software company could sell a product caught by the CRA, offer a managed service caught by NIS2, and sign a contract with an EU bank that passes down DORA terms.
Side-by-side comparison
| CRA | NIS2 | DORA | UK Bill | |
|---|---|---|---|---|
| Legal form | EU regulation 2024/2847 | EU directive 2022/2555, implemented through national laws | EU regulation 2022/2554 | UK Bill amending the NIS Regulations 2018 |
| Regulates | Products with digital elements | Organisations in listed sectors | Financial entities and their ICT providers | Essential services, cloud, marketplaces, search, MSPs, critical suppliers |
| In force | Reporting from 11 September 2026; most duties from 11 December 2027 | National laws were due by 17 October 2024 | Applied from 17 January 2025 | Not yet law |
| Incident timing | 24-hour early warning and 72-hour notification, with a later final report | 24-hour early warning, 72-hour notification, final report within one month | Set by EU technical standards for major ICT incidents | 24 hours and 72 hours, both from first awareness |
| Who gets the report | CSIRTs and ENISA | CSIRT or competent authority | Financial supervisor | Regulator, with a copy to the CSIRT |
| Maximum fine | Up to €15m or 2.5% of worldwide turnover for key failures | At least €10m or 2% for essential entities; at least €7m or 1.4% for important entities | Set by member states | Greater of £17m and 4% of turnover in the higher band |
CRA vs DORA
These two rarely compete, because one regulates what you sell and the other regulates how a financial firm runs.
The CRA follows the product. It covers hardware and software with digital elements placed on the EU market, and it puts duties on manufacturers, importers and distributors. DORA follows the financial firm, plus the ICT services it relies on.
They can meet in one supply chain. A vendor might need CRA compliance for its software while its EU bank customer asks for DORA contract terms covering how that software is supported.
CRA vs NIS2
The test here is usually product or service:
- Selling a connected device or software product into the EU points to the CRA.
- Running a service in a NIS2 sector, such as cloud or managed services, points to NIS2.
- A company that does both may need to deal with both, usually with different teams and evidence.
The reporting duties also differ. The CRA covers actively exploited vulnerabilities and severe incidents affecting a product. NIS2 covers significant incidents affecting the service an organisation provides.
DORA vs NIS2
DORA is written for the financial sector and is more detailed on testing, ICT third-party risk and contract terms. NIS2 is the broader cross-sector regime. EU law treats DORA as the specific rule for financial entities it covers, so those firms mainly work to DORA for these matters.
Where UK businesses fit
None of these laws applies just because a business is based in the UK. They reach UK businesses through EU activity:
- CRA: you sell products with digital elements in the EU, directly or through importers and distributors.
- NIS2: you have an EU establishment, or offer certain digital services in the EU.
- DORA: you have an EU-regulated group entity, or EU financial customers put DORA terms in your contract.
For the detailed tests, see Does NIS2 apply to UK companies? and Does DORA apply to UK firms?. Northern Ireland can raise extra questions for product rules, so take specific advice if you place products on the market there.
How to work out which applies
Answer these four questions in order:
- Do you sell a product with software or connectivity into the EU? If so, assess the CRA.
- Do you have an EU establishment, or offer cloud, data centre, managed or similar digital services in the EU? If so, assess NIS2 in each relevant member state.
- Are you an EU financial firm, or an ICT supplier to one? If so, assess DORA.
- Do you provide services in the UK? If so, assess the UK Bill using OES vs RDSP vs RMSP.
Keep the answers in one register of laws, with an owner for each. Evidence such as asset inventories, incident procedures and supplier reviews can often be reused, but check each regime's specific wording before relying on one set of evidence for another.
Sources
Frequently asked questions
The CRA sets security requirements for products with digital elements sold in the EU. DORA sets digital operational resilience requirements for EU financial entities and covers their ICT service providers.
The CRA follows the product, while NIS2 follows the organisation and the service it provides. A company can be subject to both if it sells a covered product and runs a covered service.
None is UK law, but they can reach UK businesses through EU activity, such as selling products into the EU, offering certain digital services there or supplying EU financial firms.
Its reporting duties apply from 11 September 2026, and most other obligations apply from 11 December 2027.
No. The Cyber Security and Resilience Bill is a separate UK law that amends the NIS Regulations 2018. It overlaps with NIS2 on themes such as 24-hour and 72-hour reporting, but scope, regulators and detail differ.