[REVISION HISTORY]

EU NIS-2, DORA, and CRA implementation trends

20 recorded revisions of this situation.

What changed

2026-10-20 15:08 UTC → 2026-10-29 06:34 UTC · added ~~removed~~

By late 2026, the implementation of NIS-2, DORA, and the Cyber Resilience Act (CRA) continues to reshape the European regulatory landscape. The CRA reporting mandates became active on September 11, 2026, requiring manufacturers of digital products to provide an initial warning within 24 hours and a detailed report within 72 hours of discovering actively exploited vulnerabilities or severe incidents via the CRA Single Reporting Platform (CRA-SRP). ~~Non-compliance risks fines of up to €15 million or 2.5% of global annual turnover.~~ To support this, ~~DEKRA has obtained accreditation from the Dutch National Accreditation Council~~ Green Hills Software launched a platform designed to provide CRA certification services. In Austria, the NISG 2026 law takes effect on October 1, 2026, mandating cybersecurity standards for medium and large companies in 18 sectors. Meanwhile, Germany faces significant readiness gaps, assist manufacturers with ~~approximately 12,000~~ security-by-design and Software Bill of ~~an estimated 30,000 affected institutions missing implementation deadlines.~~ Materials (SBOM) management. In Poland, the NIS-2 Directive and amendments to the National Cybersecurity System Act (UKSC) affect ~~roughly~~ approximately 38,000 ~~entities. While the Ministry of Digital Affairs works on criteria~~ entities, including 27,000 public institutions. A critical self-registration deadline for ~~reporting serious incidents,~~ key or important entities is set for October 3, 2026. Non-compliance carries severe penalties, such as up to €10 million or 2% of total annual turnover under the UKSC. Notably, the law shifts legal responsibility directly to management boards, who cannot transfer risk management obligations to third-party providers. Despite this, a ~~study by~~ Blackpartners ~~reveals~~ study highlights a major knowledge gap: ~~although~~ while 91% of board members have heard of NIS-2, only 11.5% correctly understood registration deadlines and personal financial liability. ~~This comes as Polish organizations face rising threats from phishing and ransomware. Despite these frameworks, experts~~ In Austria, the NISG 2026 law takes effect on October 1, 2026. Meanwhile, Germany faces significant readiness gaps, with approximately 12,000 of an estimated 30,000 affected institutions missing implementation deadlines. Experts continue to warn of detection ~~bottlenecks.~~ bottlenecks; Shane Barney of Keeper Security notes that alert systems are “only as effective as the data it receives,” citing ~~a study where~~ that only 22% of French organizations could identify unauthorized access within minutes.

Versions

Select a version to see what changed compared to the one before it.