Cybersecurity, product security, AI governance and data protection outside the financial sector

How NIS2, the Cyber Resilience Act, the EU AI Act and the GDPR interact outside the financial sector

Outside the financial sector the principal instruments are the Network and Information Security Directive (NIS2), the Cyber Resilience Act (CRA), the EU Artificial Intelligence Act and the General Data Protection Regulation (GDPR). DORA does not apply. NIS2 and the CRA operate side by side: NIS2 regulates the operators of essential and important services, while the CRA regulates the products with digital elements that those operators use and that manufacturers place on the market. The AI Act adds requirements for AI systems. GDPR continues to apply to all personal-data processing.

NIS2 applies to medium and large entities (generally 50 or more employees or turnover/balance-sheet thresholds) in specified sectors, split into essential entities (energy, transport, health, digital infrastructure, drinking water, wastewater, space, public administration) and important entities (postal services, waste management, chemicals, food, manufacturing of certain products, digital providers, research). It requires appropriate and proportionate technical, operational and organisational measures. These include risk-management policies, incident handling, business continuity and crisis management, supply-chain security, secure system development and maintenance, cyber hygiene and training, cryptography policies, access control and asset management, multi-factor authentication, and regular assessment of effectiveness. Significant incidents must be reported to national CSIRTs on a 24-hour early-warning, 72-hour notification and one-month final-report timeline. Management bodies must approve cybersecurity measures, oversee implementation and receive training; in serious cases of non-compliance they can face personal liability. Essential entities are subject to proactive supervision; important entities to reactive supervision. Fines differ accordingly.

The Cyber Resilience Act applies to manufacturers, importers and distributors of products with digital elements placed on the EU market, with very limited size exclusions. It requires security-by-design, vulnerability handling, security updates for a defined support period, a software bill of materials, and conformity assessment leading to CE marking. It is a regulation and is directly applicable.

NIS2 creates demand for secure products because essential and important entities must manage supply-chain cybersecurity risk and be able to demonstrate that their digital suppliers meet adequate standards. The CRA supplies the corresponding obligations on manufacturers: CE marking, software bills of materials and ongoing patching give NIS2 entities the evidence and the technical support they need for vendor due diligence. A hospital under NIS2 must protect its networks and report operational incidents; the manufacturer of a connected medical device used in that hospital must meet CRA requirements for the device itself. An energy operator under NIS2 must keep the grid resilient; the supplier of smart-grid hardware must meet CRA requirements for the equipment. Where an organisation both operates a NIS2 service and manufactures digital products, it must maintain a NIS2 framework for its internal operations and a separate CRA product-security process for what it places on the market. Incident reporting can run in parallel: an internal network breach is reported under NIS2, while an actively exploited vulnerability in a product is reported under the CRA.

The EU AI Act applies to providers and deployers of AI systems. High-risk systems (Annex III) require a risk-management system, data governance, technical documentation, transparency, human oversight, accuracy and robustness, and cybersecurity. Article 15 of the AI Act on cybersecurity can be satisfied by compliance with CRA cybersecurity standards. Thus a manufacturer that meets CRA requirements for an AI-enabled product can rely on that compliance for the cybersecurity element of the AI Act, while still having to address the AI Act's distinct requirements on data governance, bias, human oversight and fundamental rights. Deployers of high-risk AI systems must implement the deployer obligations, including human oversight and, where Article 27 applies, a fundamental-rights impact assessment. NIS2 entities that deploy high-risk AI can integrate the AI Act risk-management process into their existing NIS2 all-hazards risk framework rather than operating two unrelated systems. Data-integrity and access-control measures required by NIS2 support the data-governance obligations of the AI Act.

GDPR applies throughout. Personal data processed by NIS2 entities, contained in products regulated by the CRA, or used in AI systems must meet GDPR requirements on lawful basis, purpose limitation, minimisation, security (Article 32), accountability and data-subject rights. A significant incident under NIS2 that involves personal data will normally also trigger GDPR Articles 33 and 34 notification duties. AI systems that produce legal or similarly significant effects engage GDPR Article 22 alongside AI Act obligations. Data-protection impact assessments under GDPR Article 35 remain necessary where the processing is likely to result in high risk to individuals; they can be coordinated with, but are not replaced by, fundamental-rights impact assessments under the AI Act or the broader risk assessments required by NIS2. Contracts with processors must satisfy GDPR Article 28; where those processors also supply digital products, the CRA's transparency and vulnerability obligations provide additional contractual leverage.

In practice an organisation outside the financial sector that operates an essential or important service implements NIS2 as its operational cybersecurity and resilience framework. It uses the CRA as a procurement standard, requiring CE-marked products, software bills of materials and contractual patch support from vendors, and it meets CRA obligations itself for any products it places on the market. It applies the EU AI Act's risk-management, data-governance, human-oversight and conformity requirements to any high-risk AI systems it provides or deploys, integrating those requirements into the NIS2 framework where the systems form part of the regulated service. GDPR continues to govern all personal-data processing and supplies independent notification, rights and accountability obligations that run alongside the other instruments. The four instruments are complementary: NIS2 addresses the entity's operational resilience, the CRA addresses the security of the products it uses and sells, the AI Act addresses algorithmic risk and fundamental rights, and GDPR addresses the protection of personal data throughout.