Four Frameworks, One Vendor: The Regulatory Exposure Problem NIS2, DORA, CRA, and the Revised CSA Create

European enterprises are now subject to four converging cybersecurity frameworks: NIS2, DORA, the Cyber Resilience Act, and the proposed revised Cybersecurity Act. Each evaluates different dimensions of the same vendor relationship. A supplier that satisfies one framework can be disqualified under another. Most compliance teams are still running these as separate programs, which means the cross-framework exposure stays invisible until it surfaces as a regulatory finding or a forced technology replacement.

Key Takeaways

• The revised Cybersecurity Act (CSA2), proposed January 2026, introduces "non-technical risk" as a formal criterion for assessing ICT suppliers - country of origin, government influence exposure, and geopolitical alignment now factor into procurement decisions across 18 critical sectors
• The Commission can retroactively designate a supplier as high-risk and require phase-out of already-deployed components within 36 months, a first in EU cybersecurity law
• CRA reporting obligations begin 11 September 2026; NIS2 audits are underway across member states; DORA has been in force since January 2025 - compliance timelines are converging, not sequenced
• Fines for revised CSA supply chain violations could reach 7% of global turnover, the highest penalty ceiling in the current EU cybersecurity stack
• A single regulatory exposure matrix across all four frameworks converts fragmented compliance programs into one strategic vendor governance conversation

Scroll to see more

Scroll to see more

Four frameworks, four different questions about the same vendor

Each framework evaluates a different risk dimension. NIS2 asks whether your organization manages cybersecurity risk across its supply chain, with incident reporting obligations and management accountability. DORA asks whether financial entities can maintain operational resilience through ICT disruptions, with prescriptive requirements for critical third-party provider oversight and resilience testing. The Cyber Resilience Act asks whether the products you deploy were designed and maintained with security built in, with vulnerability reporting and conformity assessment obligations. The revised Cybersecurity Act asks a question none of the others touch: whether the supplier's jurisdiction, ownership structure, and government exposure create non-technical risks that compromise the security of EU critical infrastructure.

Scroll to see more

Scroll to see more

These are not overlapping requirements with minor variations. They are structurally different assessment dimensions applied to the same supplier relationship. A cloud provider can satisfy NIS2 supply chain due diligence requirements, meet DORA's critical third-party standards, and ship CRA-compliant products, yet still be designated as a high-risk supplier under the revised CSA because of where it is headquartered or who controls it.

The lex specialis principle adds complexity rather than clarity. DORA prevails over NIS2 where they directly overlap for financial entities, but the revised CSA introduces a horizontal layer that cuts across both. An organization subject to DORA still faces NIS2 obligations in areas DORA does not cover - specifically personnel security measures and MFA/encryption policy documentation, as detailed in our analysis of Sweden's Cybersecurity Act implementation. The CRA then adds product-level obligations that neither NIS2 nor DORA address: a vendor's organizational compliance does not guarantee that its products meet CRA essential cybersecurity requirements.

What the revised Cybersecurity Act changes

On 20 January 2026, the European Commission proposed a comprehensive overhaul of the original 2019 Cybersecurity Act. The revision introduces a trusted ICT supply chain security framework that formalizes non-technical risk assessment, a first in EU law.

Non-technical risk means the Commission can now evaluate whether a supplier is established in, or controlled by entities from, a third country that poses cybersecurity concerns. The designation criteria include whether that jurisdiction requires vendors to disclose software or hardware vulnerabilities to local authorities before they are exploited, whether it lacks independent judicial remedies for cybersecurity concerns, and whether it harbors threat actors conducting malicious cyber operations.

The consequences for designated high-risk suppliers are material. They face exclusion from procurement procedures for key ICT components, exclusion from EU funding programs, and prohibition from obtaining EU cybersecurity certification. Operators of electronic communications networks would be required to ensure they do not rely on high-risk suppliers for critical assets.

The most significant provision is retroactive reclassification. The Commission can designate a supplier as high-risk after its products are already deployed, triggering a mandatory phase-out period that should not exceed 36 months. For telecom operators still using equipment from suppliers like Huawei and ZTE, this provision has immediate practical implications. But the mechanism applies across all 18 sectors covered by NIS2, including energy, transport, healthcare, banking, and digital infrastructure.

Fines for supply chain violations under the revised CSA could reach 7% of worldwide turnover, depending on the nature of the breach. That exceeds the penalty ceilings under NIS2 (EUR 10 million or 2% of turnover for essential operators) and DORA (EUR 5 million or 2% of turnover).

Where the frameworks diverge on supply chain

Scroll to see more

Scroll to see more

The table below maps how each framework handles the same vendor governance question. The divergences are where cross-framework exposure emerges.

The structural gap: NIS2 and DORA assess what a vendor does (security measures, resilience practices). The CRA assesses what a vendor makes (product security). The revised CSA assesses who a vendor is and where it comes from. A vendor can score well on all three operational dimensions and still fail the jurisdictional test, or vice versa.

The geopolitical variable compliance programs miss

The regulatory convergence described above is happening against a backdrop of US-EU trade tensions that create a second layer of vendor exposure no cybersecurity framework currently captures.

On 11 March 2026, the US Trade Representative initiated Section 301 investigations into 16 economies, including the EU, targeting structural excess manufacturing capacity. Separately, the US administration has explicitly characterized EU digital regulation, including the Digital Markets Act and Digital Services Act, as discriminatory against American technology companies. The USTR has signaled that digital regulation could become the basis for its own Section 301 investigation, citing the potential for tariffs or fees on services.

This creates a bidirectional risk that most compliance teams are not structured to see. On one side, the revised CSA's non-technical risk criteria establish a mechanism that could functionally restrict US-origin suppliers from EU critical infrastructure if the Commission determines that US jurisdiction poses cybersecurity concerns. On the other side, US retaliatory measures - whether tariffs, service fees, or regulatory restrictions - could affect EU vendors operating in the US market. Organizations evaluating how vendor trust and political risk affect procurement will recognize this dynamic from the AI platform context.

The structural point extends beyond any single administration or trade dispute. The EU is building permanent mechanisms for technology sovereignty through the CSA2, the Cloud and AI Development Act, and the Digital Omnibus package. The US has demonstrated, across administrations, a willingness to use trade enforcement tools against digital regulation it considers discriminatory. This dynamic will persist regardless of election outcomes on either side of the Atlantic.

No cybersecurity questionnaire currently in use captures jurisdictional or trade-policy exposure. The vendor that passes your NIS2 supply chain assessment and DORA critical third-party review may carry geopolitical risk that only becomes visible when a Commission implementing act or a Section 301 determination changes the regulatory ground underneath a technology relationship you assumed was stable.

How to build the exposure matrix

The gap between running four separate compliance programs and running one integrated vendor governance program is a single tool: a regulatory exposure matrix that maps critical vendors against all applicable frameworks plus jurisdictional risk.

Structure. List critical vendors down the left column. Run NIS2, DORA, CRA, and the revised CSA across the top as separate columns. Add a final column for trade and jurisdictional exposure. For each intersection, document assessment status (compliant, gap identified, not assessed), criteria used, gaps identified, and remediation owner.

Where to start. Prioritize vendors that operate in the infrastructure layer: cloud providers, identity and access management platforms, network equipment suppliers, managed security services, and any vendor whose product is embedded in systems you cannot easily replace. These are the relationships where a forced phase-out under the revised CSA would be most disruptive and most expensive. For organizations deploying AI agents alongside these infrastructure vendors, the AI data governance framework adds another dimension to the assessment.

What to look for. The matrix will surface three categories of findings most organizations miss when running frameworks in isolation. First, vendors with conflicting status across frameworks - satisfying one set of requirements while carrying unaddressed exposure under another. Second, vendors with concentration risk that spans multiple frameworks, where a single provider's failure or restriction would trigger obligations under NIS2, DORA, and potentially the revised CSA simultaneously. Third, vendors with jurisdictional exposure that existing cybersecurity assessments do not capture, including suppliers headquartered in or controlled from jurisdictions that could be designated under the revised CSA's non-technical risk criteria, or suppliers whose market access could be affected by trade enforcement actions in either direction.

Expected outcome. Most organizations will find three to five vendors that create exposure across multiple frameworks they had not previously connected. This takes approximately one focused week with existing procurement, security, and compliance data. It transforms four separate compliance programs into a single strategic vendor governance conversation that the board, the CISO, the procurement function, and legal can all act on. For a detailed look at how Sweden has implemented NIS2 into national law and what that means for affected organizations, see our comprehensive guide to Sweden's Cybersecurity Act 2025.

The full Intelligence Brief - covering the complete four-framework comparison matrix, exposure matrix template with worked examples, remediation prioritization by maturity level, and the regulatory timeline with key compliance milestones - is available below.