NIS2, the CRA, the Machinery Regulation, and IEC 62443
Last updated: October 20, 2026
Four different frameworks, binding different things for different reasons. This page is a hub: a short table, then one short link out to each fuller guide. It restates no date or quote already covered there, it just points to them. For a fuller regional treatment specific to Belgium and the Netherlands, see the regional report.
| Framework | Binds | Kind |
|---|---|---|
| NIS2 | Your organization, if in scope | Directive, transposed differently per country |
| Cyber Resilience Act | Your product, if it has digital elements | Regulation, binds directly EU-wide |
| Machinery Regulation | Your product, as a safety matter | Regulation, binds directly EU-wide |
| IEC 62443 | Whoever a customer or contract requires it of | Voluntary standard, not a law |
NIS2
Already in force in the Netherlands (15 August 2026), Belgium (18 October 2024), and Luxembourg (10 May 2026). See NIS2 supply chain and remote access, explained and NIS2 for small and micro manufacturers.
Cyber Resilience Act
Applies to products with digital elements. Source: Regulation (EU) 2024/2847, Art. 2(1), checked 19 October 2026 Article 14 reporting obligations apply from 11 September 2026, full application from 11 December 2027. See The Cyber Resilience Act for machine builders.
Machinery Regulation
Applies from 14 January 2027. See The Machinery Regulation's cybersecurity requirements.
IEC 62443
A voluntary standard, not a law. See IEC 62443, explained and IEC 62443 and remote access for machine builders.
It takes about 2 minutes and covers NIS2, the Cyber Resilience Act, and the Machinery Regulation for machine builders, factory operators, and system integrators in the Netherlands, Belgium, and Luxembourg.
This is a general guide based on published sources, not legal advice. Confirm your specific obligations with a qualified advisor.