Free self-check

Are you in scope for NIS2 or the CRA?

Both frameworks affect far more companies than expected – NIS2 already applies in Germany, and the CRA reporting duties start in September 2026. Find out in a few minutes whether and how they affect you, and which obligations and deadlines follow.

  • No data transmitted. The check runs entirely in your browser – your answers never leave your device.
  • 5 minutes. 6–8 short questions per framework, understandable without prior knowledge.
  • Assessment, not a sales pitch. At the end you get your classification along with the obligations – the appointment is an offer, not a condition.

Self-check

The interactive check requires JavaScript. Here are the key criteria:

NIS2 (operators & organisations)

What matters is the sector (Annex 1 or 2 of the BSIG), company size (from 50 employees or more than €10 million turnover) and size-independent special cases such as trust services, DNS/telecoms providers and operators of critical installations.

CRA (manufacturers & products)

It covers products with digital elements placed on the EU market. Your role (manufacturer, importer, distributor) and the product class determine the conformity route and obligations.

Clarify your status in an initial consultation

Note: This self-check offers initial guidance based on simplified criteria and does not replace legal advice. A binding applicability analysis requires an individual review of your situation. No data is transmitted or stored.

Frequently asked questions

Briefly explained

For a binding analysis of your status and a prioritised roadmap, we clarify the details in the initial consultation.

Clarify your status

The German NIS2 implementation act (NIS2UmsuCG) entered into force on 6 December 2025 – with no general transition period. Entities in scope have had to meet the risk management, reporting and registration duties since then; breaches can attract fines of up to €10 million.

The reporting duties for actively exploited vulnerabilities and severe incidents apply from 11 September 2026 (early warning within 24 hours, notification within 72 hours, final report within 14 days). All remaining obligations, including CE marking, apply from 11 December 2027.

No. The check gives initial guidance based on simplified criteria and is not legal advice. A robust applicability analysis requires an individual review of your situation – which is exactly what the free initial consultation is for.