CRA essentials: what being in scope actually demands
Knowing you're in scope is step zero. What in-scope asks of the product is where it gets concrete, and where most teams find the work they hadn't costed.
An RS Strategy publication
EU digital regulation, read before it lands on your desk.
Written for the people who have to act on these texts, not merely cite them.
On the clock
The dates that reach you first, not the headline ones.
Start from your question
Latest
NIS2, where it actually stands
Transposition is uneven. The date that binds you is not the EU deadline but your member state's.
The CRA is already on the clock
The date most plans aim at is the wrong one. The obligation that reaches you first lands fifteen months earlier.
Three ways to go further
Who this is for
- Security leads who have to operationalise these texts, not just log them.
- General counsel and DPOs tracking obligations that differ across borders.
- Product and compliance teams inside manufacturers now in CRA scope.
- Policy and public-affairs people reading Brussels before it becomes law.
If one of these is already on your desk, you know where to start.
Work with RS Strategy