If you ship software, or run something other people depend on

The Cyber Resilience Act and NIS2 are usually discussed together and they are almost opposites. The CRA is a product regulation: it reaches anybody who places a product with digital elements on the EU market, it has no SME exemption, and its first hard duty is a twenty four hour reporting clock. NIS2 is a sectoral regulation of operators, it has a size floor that excludes most small businesses, and Ireland has still not transposed it.

The practical consequence is that the smaller supplier is more likely to be caught by the one nobody is talking about. These articles work out which of the two, if either, reaches a given business, and say plainly when the answer is neither.