Lorcan Moylan Burke

Conceptually, you think of IoT devices, but the CRA has a far broader scope of application. In this article we examine one of the tricky nuances – distinguishing between a digital product and SaaS under the CRA. The EU’s Cyber Resilience Act (CRA) looks to reshape product cybersecurity by imposing uniform baseline requirements on “products with digital elements” placed on the EU market.

[co-author: Henry Kilding, Alanna Grogan] The NIS2 Directive continues to evolve – and organisations must keep pace. On 20 January 2026, the Commission unveiled a set of targeted amendments to the NIS2 Directive (“the Proposal“), signalling the next phase of its push to modernise and streamline the EU’s cybersecurity legal framework.

INTRODUCTION The requirement of NIS2 that in-scope entities adopt measures to ensure the security of its immediate supply chain is one of the lesser discussed aspects of the Directive.