Connected products, listed sectors, long supplier chains.

Typical profile

Sector

Manufacturing (medical devices, electronics, machinery, vehicles)

Employees

250 or more

AI

Uses AI tools

Flags

Products with digital elements

• Manufacturing (Annex II) makes a medium or large entity an important entity, not essential.
• CRA obligations attach to the product, whatever your size.
• Predictive maintenance and quality inspection are common AI deployments.

Obligations to prove

66

NIS2 important entity on this profile.

• Regulation (EU) 2016/679 — data protection

  Applies to every organisation established in the EU that processes personal data.

  3
• Directive (EU) 2022/2555 — cybersecurity

  You declared yourself a NIS2 important entity.

  8
• Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements

  The Implementing Regulation's 47 technical requirement sections elaborate NIS2 Art 21(2).

  48
• Regulation (EU) 2024/1689 — artificial intelligence

  You build or use AI systems — Art 4 AI literacy already applies; other tiers depend on classification.

  5
• Regulation (EU) 2024/2847 — Cyber Resilience Act

  You manufacture products with digital elements — Art 14 reporting applies from 11 Sep 2026.

  2

First statutory clock if something goes wrong: NIS2 early warning, 24 hours (NIS2 Art 23(4)(a)).

Computed by the platform's scope finder. A starting point, not a legal determination.