NIS2 and Other Laws and Standards: DORA, ISO 27001, CER, CRA, GDPR and More Compared

NIS2 is addressed to the Member States (Article 46), so organisations are bound by the national laws that transpose it, which have applied since 18 October 2024 (Article 41(1)). The Directive replaced NIS1, Directive (EU) 2016/1148, and how the law itself is built is explained under NIS2 Directive on the home page.

This page compares NIS2 with eight instruments, sets out the precedence rules of NIS2 Articles 4, 2(3) and 35, puts five incident clocks side by side and dates each status as of 23 October 2026.

Which EU Cybersecurity Laws Sit Next to NIS2?

The EU cybersecurity laws next to NIS2 are DORA (Regulation (EU) 2022/2554) for financial entities, the CER Directive (Directive (EU) 2022/2557) for the resilience of critical entities, the Cyber Resilience Act (Regulation (EU) 2024/2847) for products with digital elements and the GDPR (Regulation (EU) 2016/679) for personal data. Each act regulates a different object, as the five entries below show.

• DORA: the digital operational resilience of 20 financial entity types (Article 2(1)(a) to (t)) plus ICT third-party service providers (point (u)).
• CER Directive: the resilience of critical entities in the 11 sectors of its Annex, such as energy, transport and health.
• Cyber Resilience Act: cybersecurity rules for products with digital elements, binding manufacturers rather than users.
• GDPR: the processing of personal data, including the notification of personal data breaches (Article 33).
• NIS1: the predecessor of NIS2, repealed by NIS2 Article 44.

One hospital operator can be an essential entity under NIS2, a critical entity under the CER Directive and a GDPR controller at the same time.

Binding Acts and Voluntary Standards

A directive binds an entity only through the national law that transposes it, while a regulation such as DORA, the CRA or the GDPR applies directly, and ISO/IEC 27001, NIST CSF 2.0 and IEC 62443 bind no one. An organisation therefore reads its NIS2 duties in the national act, but its DORA, CRA and GDPR duties in the regulation itself.

Standards still count as evidence: NIS2 Article 21(1) requires the measures to take into account relevant European and international standards, and Article 25 asks Member States to encourage them. Recital 3 of Implementing Regulation (EU) 2024/2690 names ISO/IEC 27001, ISO/IEC 27002, ETSI EN 319401 and CEN/TS 18026:2024 among the standards its Annex is based on. Version 1.2 of the ENISA mapping table relates that Annex to ISO/IEC 27001:2022 and NIST CSF 2.0, and ENISA states that the mapping "should not be interpreted as a measure of equivalency". The standards help evidence the cybersecurity risk-management measures of Article 21.

How NIS2 Compares with Each Law and Standard

NIS2 is compared here with eight instruments, four EU acts in force (DORA, the CER Directive, the Cyber Resilience Act and the GDPR), one repealed directive (NIS1) and three voluntary standards (ISO/IEC 27001, NIST CSF 2.0 and IEC 62443), each on its own page. The table below gives each instrument's legal effect and its link to NIS2.

Which Rule Applies When Two Instruments Overlap?

Where two instruments overlap, NIS2 either steps back for a sector-specific Union legal act that is at least equivalent (Article 4) or runs in parallel with the other act, which then applies without prejudice to NIS2 or the other way round. The outcome follows from the text of the acts, not from a choice of the organisation: NIS2 Article 4 covers sector acts, Article 2(3) critical entities and Articles 2(12), 2(14) and 35 personal data.

Sector Acts That Replace Parts of NIS2

Under NIS2 Article 4(1), a sector-specific Union legal act displaces the relevant NIS2 provisions, including Chapter VII on supervision and enforcement, where its requirements are at least equivalent in effect. Article 4(2) tests the measures against Article 21(1) and (2) and the reporting rules against Article 23(1) to (6), and NIS2 continues to apply to entities the sector act does not cover.

DORA Article 1(2) names DORA as that act for financial entities identified as essential or important entities. Commission Guidelines 2023/C 328/02 (OJ C 328, 18.9.2023, p. 2) discuss only DORA and list credit institutions, trading venues and central counterparties as the overlapping entity types. The displacement is partial: NIS2 Articles 20, 21 and 23 and Chapter VII give way, while Articles 7, 9 and 16 still apply. NIS2 Article 2(10) leaves out the entities that DORA exempts under its Article 2(4), and DORA Article 19(1) lets Member States require copies of DORA reports for the NIS2 authorities or CSIRTs.

Acts That Run in Parallel with NIS2

The CER Directive, the GDPR and the Cyber Resilience Act apply alongside NIS2, and each has its own rule for the overlap. CER Article 1(2) keeps the CER Directive out of matters that NIS2 covers, and under NIS2 Article 23(10) CSIRTs or authorities pass incident and near-miss information on critical entities to the CER authorities. NIS2 classifies a critical entity under the CER Directive as essential regardless of size (Articles 2(3) and 3(1)(f)), so its cybersecurity duties are those of the essential entities under NIS2.

NIS2 applies without prejudice to the GDPR (Articles 2(12) and 2(14)). The NIS2 authority informs the data protection authority where an infringement of Article 21 or 23 can entail a personal data breach (Article 35(1)), and imposes no Article 34 fine for conduct already fined under GDPR Article 58(2)(i) (Article 35(2)). The Cyber Resilience Act is product law that facilitates the supply chain duty of NIS2 Article 21(2)(d) (CRA recitals 24 and 125), and CRA Article 3 borrows the NIS2 definitions of incident and near miss. Product rules in depth are covered on cyberresilienceactguide.net.

Notification Deadlines Across Five EU Acts

NIS2, DORA, the CER Directive, the Cyber Resilience Act and the GDPR each set their own incident clock, and only NIS2 and the CRA use the same 24-hour early warning followed by a 72-hour notification. The table below shows the deadlines as each act sets them on 23 October 2026; for NIS2, national laws may deviate.

One incident can trigger reports under two acts: an essential entity whose incident also exposes personal data sends its early warning to the CSIRT or competent authority under the national NIS2 law and its breach notification to the data protection authority under GDPR Article 33(1). The three NIS2 steps are explained under NIS2 incident reporting.

The Digital Omnibus, COM(2025) 837 of 19 November 2025, proposes a single-entry point for incident reporting and carries a pending change to the GDPR notification rule. As of 23 October 2026 the proposal is pending: the European Parliament is at the stage "Awaiting committee decision", and Coreper agreed the Council's negotiating mandate on 21 October 2026.

One Programme for Several Instruments

One security programme can serve several instruments at once, because DORA, the CER Directive and NIS2 all ask for risk management and incident reporting, and ISO/IEC 27001 or NIST CSF 2.0 can structure the evidence, but each act keeps its own scope, authority and deadlines.

The entity stays responsible under each act separately: an ISO/IEC 27001 certificate is not legal proof of compliance with Article 21, and each report goes to its own authority on its own clock. The full set of NIS2 duties is summarised under NIS2 compliance requirements.

Where the Compared Instruments Stand on 2026-10-23

As of 23 October 2026, NIS2 has applied through national law since 18 October 2024, DORA since 17 January 2025, the CER Directive's national measures since 18 October 2024, the GDPR since 25 May 2018, and the Cyber Resilience Act's reporting obligations since 11 September 2026, with full application from 11 December 2027; NIS1 was repealed with effect from 18 October 2024.

Member States had to identify their critical entities by 17 July 2026 (CER Article 6(1)), and the Commission reviews NIS2 by 17 October 2027, then every 36 months (NIS2 Article 40).

Two pending proposals would change NIS2. COM(2026) 13 of 20 January 2026 (procedure 2026/0012(COD)) would amend the Directive and is at the ITRE stage "Awaiting committee decision" as of 23 October 2026. The Digital Omnibus (2025/0360(COD)) remains pending as set out above, and each proposal is tracked under NIS2 amendments and review.

Related Rules This Comparison Leaves Out

Two groups of rules sit next to NIS2 without a comparison page here: the EU Cybersecurity Act with its certification schemes, and the national rules of the United Kingdom, Switzerland and Norway.

The Cybersecurity Act and EU Certification Schemes

The Cybersecurity Act, Regulation (EU) 2019/881, sets up the EU cybersecurity certification framework that NIS2 Article 24(1) uses: Member States may require entities to use certified ICT products, services and processes. A proposal to replace it (procedure 2026/0011(COD)) is pending as of 23 October 2026, with the European Parliament's ITRE committee at the stage "Awaiting committee decision".

No EU-wide NIS2 certificate for organisations exists. Article 24(1) concerns schemes adopted under Article 49 of Regulation (EU) 2019/881, ISO/IEC 27001 is not one of them, and the options are set out under NIS2 certification.

Rules Outside the EU: United Kingdom, Switzerland and Norway

Three neighbouring countries have their own rules, each covered on its country page.

• United Kingdom: the Network and Information Systems Regulations 2018 (SI 2018/506) have been in force since 10 May 2018; the Cyber Security and Resilience Bill is pending as of 23 October 2026; see NIS2 and the United Kingdom.
• Switzerland: not bound by NIS2; the Information Security Act (ISG, SR 128) has required cyberattacks to be reported to the BACS within 24 hours (Article 74e(1)) since 1 April 2025; see NIS2 and Switzerland.
• Norway: NIS2 is under scrutiny for incorporation into the EEA Agreement, with no Joint Committee Decision as of 23 October 2026; the NIS1-based Digital Security Act (digitalsikkerhetsloven, LOV-2023-12-20-108) has been in force since 1 October 2025; see NIS2 and Norway.