EU cybersecurity regulation for digital products

Published on 1 November 2026

EU cybersecurity regulation for digital products is not one law but four, and each hits a different target: your product, your customer’s organisation, your product data or your liability. If you sell connected devices or software into the EU through a Dutch importer, distributor or your own EU company, this page shows which rule applies to you, from when, and where to start.

Part of our overview of EU product law for companies selling into the Netherlands.

Which EU rules apply to digital products, and who carries the duty?

Four EU rules matter most: the Cyber Resilience Act (CRA), NIS2, the Data Act and the new Product Liability Directive. They differ in what they regulate and in who must comply. Start with those two questions, not with the dates.

Purchasing wants a CRA statement, a customer sends a NIS2 questionnaire, someone asks whether the next release is “Data Act ready”. The questions look alike; the rules behind them do not:

The CRA regulates the product: products with digital elements, with duties for manufacturer, importer and distributor, and CE marking.
NIS2 regulates the organisation: essential and important entities established in the Netherlands. Suppliers get its requirements through the contract, unless they are an entity themselves.
The Data Act regulates data from connected products and related services. No CE marking, no incident reporting.
The Product Liability Directive regulates liability for defective products, and treats software as a product.

How do the CRA, NIS2, the Data Act and product liability compare?

The table puts the four rules side by side. Read across your row: the object tells you whether the rule hits your product or your customer; the addressee tells you whether the duty is yours or comes to you through a contract.

Rule	What it is about	Who must comply	Applies from	Read more
Cyber Resilience Act, Regulation (EU) 2024/2847	Cybersecurity of products with digital elements; CE marking	Manufacturer; importer and distributor from 11 December 2027	Reporting obligation of manufacturers: 11 September 2026. Product requirements and the other duties of manufacturers, importers and distributors: 11 December 2027	Cyber Resilience Act guide for manufacturers
NIS2 Directive (EU) 2022/2555, in the Netherlands the Cyberbeveiligingswet	Cybersecurity of organisations, including their supply chain	Essential and important entities established in the Netherlands; suppliers through the contract	15 August 2026 (Dutch law and decree in force)	NIS2 in the Netherlands and the Cyberbeveiligingswet and NIS2 terms from Dutch customers for suppliers
Data Act, Regulation (EU) 2023/2854	Access to and sharing of data from connected products and related services	Manufacturers of connected products, providers of related services, data holders	12 September 2025; design obligation for products placed on the market after 12 September 2026	the EU Data Act for connected products
Product Liability Directive (EU) 2024/2853	Civil liability for defective products, software included	Manufacturer and others in the chain	Products placed on the market or put into service from 9 December 2026	the new EU Product Liability Directive

What does the Cyber Resilience Act require from a non-EU manufacturer?

As a manufacturer you already have one CRA duty: since 11 September 2026 you must report actively exploited vulnerabilities and severe incidents. The product requirements, CE marking and the duties of importers and distributors follow on 11 December 2027.

You are the manufacturer if you develop or manufacture the product, or have it developed or manufactured, and market it under your own name or trademark (Article 3 point 13). An importer is a company established in the EU that places your product, bearing your name or trademark, on the EU market (Article 3 point 16).

Reporting (Article 14). The obligation to report actively exploited vulnerabilities and severe incidents applies from 11 September 2026 (Article 71(2)). It also covers products you placed on the market before that date (Article 69(3)). Without a main establishment in the EU you still report; Article 14(7) sets the route and Article 14 the deadlines.
Product requirements and other duties. The product requirements, conformity assessment, CE marking and the obligations of importers and distributors apply from 11 December 2027 (Article 71(2)). Your importer and distributor have no CRA duties yet.
Products already on the market. A product placed on the market before 11 December 2027 only falls under the requirements if, from that date, it is subject to a substantial modification (Article 69(2)).
Authorised representative. The CRA allows you to appoint one by written mandate (Article 18). It does not require it.

In the Netherlands, the bill implementing the CRA (Uitvoeringswet verordening cyberweerbaarheid, parliamentary papers 36 875) has passed the House of Representatives and is before the Senate. It is not yet law. Scope and conformity route: Cyber Resilience Act guide for manufacturers.

Does NIS2 apply to you, or only to your Dutch customer?

Usually only to your customer. The Cyberbeveiligingswet places the duty on essential and important entities established in the Netherlands. You receive their requirements through the contract, unless your own company is an entity.

The Dutch NIS2 law, the Cyberbeveiligingswet, and its implementing decree, the Cyberbeveiligingsbesluit, have been in force since 15 August 2026. They require Dutch entities to secure their networks and systems, supply chain included. That is why your customer sends you a questionnaire, an audit clause or a security schedule. The legal duty stays with the customer.

Check one thing for your own group. If you have a company established in the Netherlands that is medium-sized or larger and works in a sector listed in Annex 2 to the Cyberbeveiligingswet, which follows Annex II to the NIS2 Directive, such as the manufacture of computer, electronic and optical products, the manufacture of electrical equipment or the manufacture of machinery and equipment, that company can itself be an important entity. Then NIS2 is no longer only a contract question for it.

Scope: NIS2 in the Netherlands and the Cyberbeveiligingswet. Contracts: NIS2 terms from Dutch customers for suppliers.

What does the Data Act change for your connected products?

The Data Act gives users access to data from connected products and related services. It applies since 12 September 2025. Products you place on the market after 12 September 2026 must be designed so that this data is accessible by default.

There is no CE marking, no conformity assessment and no incident reporting. What it asks of you is a design choice plus contract and information duties:

Design (Article 3(1)). Connected products and related services placed on the market after 12 September 2026 must make product data and related service data accessible to the user by default. Products placed on the market before that date are not caught by this design obligation.
Access on request. Since 12 September 2025, users can ask the data holder for the data that is readily available.
Legal representative (Article 37(11)). If you offer connected products or related services in the EU but are not established there, you must designate a legal representative in one of the Member States. This is not the same as an authorised representative under product legislation.

In the Netherlands, the Uitvoeringswet dataverordening has applied since 21 November 2025; the Authority for Consumers and Markets (ACM) is competent for entities established there. Designate your legal representative in the Netherlands and you deal with the ACM. More: the EU Data Act for connected products.

Why does the new Product Liability Directive matter for software?

Because software now counts as a product. For products placed on the market or put into service from 9 December 2026, a manufacturer can be liable for damage caused by defective software, and cannot argue that the defect arose later if it lies in a missing security update within its control.

Directive (EU) 2024/2853 defines “product” to include software (Article 4(1)). A manufacturer who argues that the defect arose after the product left its hands loses that argument when the defect lies in, among other things, a missing software update or security update that was within its control (Article 11(2)). Your update policy becomes a liability question.

The new rules apply to products placed on the market or put into service from 9 December 2026 (Article 2(1)). In the Netherlands, the implementing bill (parliamentary papers 36 906) is before the Senate; it is still a bill. Read more about the new EU Product Liability Directive.

Where does the AI Act fit in?

The AI Act sets requirements for providers and deployers of AI systems. For products that contain AI, it can apply alongside the CRA. Our page on developments in AI regulation covers it.

Unsure which of these rules reaches your product or your contract? Send me what you sell and to whom, and I will tell you where your duties lie. Contact Martin Krüger, product law partner in the Netherlands.

Where do you start when several rules hit you at once?

Start with what you sell and to whom, not with the laws. Then make one list showing, per rule, whether it applies to your product, to your organisation, or only through your contract.

When a customer, your purchasing department and your board all ask about NIS2, the CRA and the Data Act in the same month, I do not start with the legislation. I start with two questions: what do you sell, a product with software, a connected device or a service, and to whom, a customer that itself falls under the Cyberbeveiligingswet? Then we build one overview with, per rule, whether it applies to your product, to your organisation, or only through your contract. In practice, half of the questions often turn out to be about the contract and not about a legal duty of your own.

From there, a practical order of work:

Map your products and customers. Which products have digital elements or collect data, and which Dutch customers are essential or important entities? That tells you which rows of the table apply.
Run it as one project. One owner, one set of documents: product file, vulnerability handling process, standard contract schedule. These overlap across the CRA, NIS2 contracts and product liability, and customers ask about them in one questionnaire anyway.
Settle what is due before 2027. Reporting of actively exploited vulnerabilities and severe incidents (applies now, also to products placed on the market before 11 September 2026), data access by default for products placed on the market after 12 September 2026, and an update policy that holds up under the liability rules applying from 9 December 2026.

I advise manufacturers to arrange three things now. First, a working process to report actively exploited vulnerabilities and severe incidents, because that obligation already applies. Second, data access built into the products you place on the market after the Data Act date. Third, a hard look at your update policy with the new product liability rules in mind. The CRA product requirements come later; use that time for product design.

Example: a connected device, a Dutch customer and a new product

Suppose you make connected industrial sensors in the United States and sell them through a Dutch distributor. A Dutch machinery manufacturer sends you a NIS2 security schedule with an audit right and broad liability. You plan to launch a new sensor in spring 2027.

How the rules sort themselves:

NIS2. The machinery manufacturer may be an important entity under the Cyberbeveiligingswet. The supply chain duty is its own; you receive requirements only through the schedule. Go through it point by point: what must your customer show under the law? What goes beyond that, such as broad liability, is negotiable.
CRA. You must already report actively exploited vulnerabilities and severe incidents, for old and new sensors. Sensors you place on the market from 11 December 2027 must meet the CRA product requirements and bear the CE marking, even if you launched the model in spring 2027; your Dutch distributor, which under the CRA acts as importer, has no CRA duties until then.
Data Act. Placed on the market after 12 September 2026, the new sensor must give users access to its data by default. As a non-EU company you designate a legal representative in a Member State.
Product liability. The new liability rules apply to products placed on the market from 9 December 2026, so to the new sensor, software included.

One project, one document set: the vulnerability process you build for the CRA is also the answer to the incident clause in the NIS2 schedule.

When do you need a Dutch lawyer?

Before you sign a customer schedule that widens your liability or audit exposure, when your role under the CRA is unclear, and before you launch a connected product.

Bring in a lawyer when a customer sends a schedule or questionnaire that extends your liability or audit rights, when you doubt whether your product falls under the CRA or who in your chain is the manufacturer, and before you launch a product with connected features. I would rather have one conversation beforehand than repair a contract afterwards.

What we do for manufacturers outside the EU:

review and negotiate NIS2 schedules and supply agreements with Dutch customers, importers and distributors;
determine your CRA role and divide the duties in your contracts with Dutch partners;
check product launches against the Data Act and the new liability rules.

Send me the schedule or a short description of your product launch, and I will tell you which duties are yours and what to do first. Contact Martin Krüger, product law partner in the Netherlands.

Frequently asked questions about EU cybersecurity regulation

What is the difference between the CRA and NIS2?

The CRA regulates products with digital elements and their manufacturers, importers and distributors. NIS2 regulates organisations, essential and important entities, which must secure their supply chain. Suppliers usually meet NIS2 through the customer’s contract.

Does this apply to me if I am based outside the Netherlands or the EU?

Yes, if you sell into the EU. The CRA reporting obligation applies to you as manufacturer, even without an EU establishment. If you are established outside the EU, the Data Act requires you to designate a legal representative in a Member State. NIS2 reaches you mainly through Dutch customers’ contracts.

Do importers and distributors already have CRA obligations?

No, not until 11 December 2027. The only CRA duty for companies in the supply chain that applies now is the manufacturer’s obligation to report actively exploited vulnerabilities and severe incidents, since 11 September 2026.

Does the Data Act require CE marking?

No. The Data Act has no CE marking, no conformity assessment and no incident reporting. It governs access to data from connected products, with a design obligation for products placed on the market after 12 September 2026.

When should I involve a Dutch lawyer?

When a Dutch customer’s schedule widens your liability or audit rights, when your CRA role is unclear, and before you launch a connected product.

Primary sources

Regulation (EU) 2024/2847 (Cyber Resilience Act), OJ L 2024/2847 of 20 November 2024: Article 3 points 13 and 16, Articles 14, 18, 69 and 71.
Regulation (EU) 2023/2854 (Data Act), OJ L 2023/2854 of 22 December 2023: Articles 3(1), 37(11) and 50.
Directive (EU) 2022/2555 (NIS 2 Directive), OJ L 333 of 27 December 2022; in the Netherlands the Cyberbeveiligingswet (Stb. 2026, 187), Annex 2, and the Cyberbeveiligingsbesluit (Stb. 2026, 189), in force since 15 August 2026.
Directive (EU) 2024/2853 (product liability), OJ L of 18 November 2024: Articles 2(1), 4(1) and 11(2).
Regulation (EU) 2024/1689 (AI Act).
The Netherlands: bill Uitvoeringswet verordening cyberweerbaarheid, parliamentary papers 36 875 (before the Senate); Uitvoeringswet dataverordening, in force since 21 November 2025; bill implementing Directive (EU) 2024/2853, parliamentary papers 36 906 (before the Senate).

Last checked on 1 November 2026 · next relevant date: 9 December 2026 (new product liability rules apply to products placed on the market or put into service from that date), then 11 December 2027 (CRA)