Five Frameworks, One Vendor: How NIS2, DORA, CRA, the Revised CSA, and the EU AI Act Create Cross-Framework Exposure

European enterprises are now subject to five converging EU frameworks: NIS2, DORA, the Cyber Resilience Act, the proposed revised Cybersecurity Act, and the AI Act. Each evaluates different dimensions of the same vendor relationship. A supplier that satisfies one framework can be disqualified under another. Most compliance teams are still running these as separate programs, which means the cross-framework exposure stays invisible until it surfaces as a regulatory finding or a forced technology replacement.

Key Takeaways

• The revised Cybersecurity Act (CSA2), proposed January 2026, introduces "non-technical risk" as a formal criterion for assessing ICT suppliers, country of origin, government influence exposure, and geopolitical alignment now factor into procurement decisions across 18 critical sectors
• The Commission can retroactively designate a supplier as high-risk and require phase-out of already-deployed components within 36 months, a first in EU cybersecurity law
• The EU AI Act adds a fifth lens: any vendor selling, integrating, or operating AI systems faces classification (prohibited / high-risk / limited / minimal) and provider-deployer-importer obligations that overlap NIS2 and CRA but apply distinct AI-specific tests; the November 2025 Digital Omnibus proposes deferring high-risk obligations from August 2026 to December 2027, forcing vendors to plan two parallel timelines
• CRA reporting obligations begin 11 September 2026; NIS2 audits are underway across member states; DORA has been in force since January 2025, compliance timelines are converging, not sequenced
• Fines for revised CSA supply chain violations could reach 7% of global turnover; AI Act fines for prohibited practices reach the same ceiling — these are the highest penalty ceilings in the current EU regulatory stack
• A single regulatory exposure matrix across all five frameworks converts fragmented compliance programs into one strategic vendor governance conversation

Scroll right to see more

Scroll right to see more

Five frameworks, five different questions about the same vendor

Each framework evaluates a different risk dimension. NIS2 asks whether your organization manages cybersecurity risk across its supply chain, with incident reporting obligations and management accountability. DORA asks whether financial entities can maintain operational resilience through ICT disruptions, with prescriptive requirements for critical third-party provider oversight and resilience testing. The Cyber Resilience Act asks whether the products you deploy were designed and maintained with security built in, with vulnerability reporting and conformity assessment obligations. The revised Cybersecurity Act asks a question none of the others touch: whether the supplier's jurisdiction, ownership structure, and government exposure create non-technical risks that compromise the security of EU critical infrastructure. The EU AI Act adds the fifth question: how the vendor's AI systems are classified (prohibited, high-risk, limited-risk, or minimal-risk), what role the vendor plays (provider, deployer, importer, distributor), and which obligations attach to that combination — including transparency, conformity assessment, post-market monitoring, and the GPAI rules that took effect 2 August 2025.

Scroll right to see more

Scroll right to see more

These are not overlapping requirements with minor variations. They are structurally different assessment dimensions applied to the same supplier relationship. A cloud provider can satisfy NIS2 supply chain due diligence requirements, meet DORA's critical third-party standards, ship CRA-compliant products, and comply with AI Act provider obligations on its hosted models, yet still be designated as a high-risk supplier under the revised CSA because of where it is headquartered or who controls it.

The lex specialis principle adds complexity rather than clarity. DORA prevails over NIS2 where they directly overlap for financial entities, but the revised CSA introduces a horizontal layer that cuts across both. An organization subject to DORA still faces NIS2 obligations in areas DORA does not cover, specifically personnel security measures and MFA/encryption policy documentation, as detailed in our analysis of Sweden's Cybersecurity Act implementation. The CRA then adds product-level obligations that neither NIS2 nor DORA address: a vendor's organizational compliance does not guarantee that its products meet CRA essential cybersecurity requirements.

What the revised Cybersecurity Act changes

On 20 January 2026, the European Commission proposed a comprehensive overhaul of the original 2019 Cybersecurity Act. The revision introduces a trusted ICT supply chain security framework that formalizes non-technical risk assessment, a first in EU law.

Non-technical risk means the Commission can now evaluate whether a supplier is established in, or controlled by entities from, a third country that poses cybersecurity concerns. The designation criteria include whether that jurisdiction requires vendors to disclose software or hardware vulnerabilities to local authorities before they are exploited, whether it lacks independent judicial remedies for cybersecurity concerns, and whether it harbors threat actors conducting malicious cyber operations.

The consequences for designated high-risk suppliers are material. They face exclusion from procurement procedures for key ICT components, exclusion from EU funding programs, and prohibition from obtaining EU cybersecurity certification. Operators of electronic communications networks would be required to ensure they do not rely on high-risk suppliers for critical assets.

The most significant provision is retroactive reclassification. The Commission can designate a supplier as high-risk after its products are already deployed, triggering a mandatory phase-out period that should not exceed 36 months. For telecom operators still using equipment from suppliers like Huawei and ZTE, this provision has immediate practical implications. But the mechanism applies across all 18 sectors covered by NIS2, including energy, transport, healthcare, banking, and digital infrastructure.

Fines for supply chain violations under the revised CSA could reach 7% of worldwide turnover, depending on the nature of the breach. That exceeds the penalty ceilings under NIS2 (EUR 10 million or 2% of turnover for essential operators) and DORA (EUR 5 million or 2% of turnover).

What the EU AI Act adds — and what the Digital Omnibus changed

The AI Act (Regulation (EU) 2024/1689) is the fifth framework most vendor-risk programs still treat as a separate workstream. It is not. Any supplier that provides, integrates, deploys, or distributes AI systems in the EU is now in scope under one of four risk classifications, with obligations that overlap NIS2 (cybersecurity risk management), CRA (product conformity), and the revised CSA (jurisdictional supplier risk for general-purpose AI with systemic risk).

The AI Act's structure is risk-tiered:

• Prohibited practices (subliminal manipulation, social scoring, untargeted facial-recognition scraping) — fines up to EUR 35 million or 7% of global turnover, whichever is higher
• High-risk AI systems (Annex III categories: critical infrastructure, employment, essential services, law enforcement, migration, justice, education) — conformity assessment, risk management system, data governance, human oversight, post-market monitoring; fines up to EUR 15 million or 3% of turnover
• Limited-risk (chatbots, generative content) — transparency obligations
• Minimal-risk — voluntary codes of conduct
• General-purpose AI (GPAI) — separate provider obligations on technical documentation, training data summaries, copyright compliance; additional obligations for GPAI with systemic risk

The 2 August 2025 milestone took effect on schedule: GPAI provider obligations and the AI literacy duty are now law. The 2 August 2026 milestone — high-risk AI obligations — is what the Digital Omnibus package proposed on 19 November 2025 to defer.

The Digital Omnibus, presented as a simplification package across multiple digital regulations, includes a draft amendment that would push the AI Act's high-risk applicability date from 2 August 2026 to 2 December 2027. As of the most recent reporting, the proposal is in trilogue negotiation; outcomes are not yet final. For vendors and procurement teams, the practical consequence is uncomfortable: until trilogue concludes, you must plan for both timelines. A high-risk AI system being deployed in mid-2026 cannot assume the deferral will pass; nor can a 2027 roadmap assume the original deadline will hold.

For the broader regulatory framework comparison, see the EU AI Act in the context of converging cyber and AI regulation. For how political risk affects AI vendor procurement specifically, see AI vendor trust and political risk in due diligence.

Where the frameworks diverge on supply chain

Scroll right to see more

Scroll right to see more

The table below maps how each framework handles the same vendor governance question. The divergences are where cross-framework exposure emerges.

The structural gap: NIS2 and DORA assess what a vendor does (security measures, resilience practices). The CRA assesses what a vendor makes (product security). The revised CSA assesses who a vendor is and where it comes from. The AI Act assesses what the vendor's AI system can do and what role the vendor plays in its lifecycle. A vendor can score well on the four operational and product dimensions and still fail the jurisdictional or AI classification test.

The geopolitical variable compliance programs miss

The regulatory convergence described above is happening against a backdrop of US-EU trade tensions that create a second layer of vendor exposure no cybersecurity framework currently captures.

On 11 March 2026, the US Trade Representative initiated Section 301 investigations into 16 economies, including the EU, targeting structural excess manufacturing capacity. Separately, the US administration has explicitly characterized EU digital regulation, including the Digital Markets Act and Digital Services Act, as discriminatory against American technology companies. The USTR has signaled that digital regulation could become the basis for its own Section 301 investigation, citing the potential for tariffs or fees on services.

This creates a bidirectional risk that most compliance teams are not structured to see. On one side, the revised CSA's non-technical risk criteria establish a mechanism that could functionally restrict US-origin suppliers from EU critical infrastructure if the Commission determines that US jurisdiction poses cybersecurity concerns. On the other side, US retaliatory measures, whether tariffs, service fees, or regulatory restrictions, could affect EU vendors operating in the US market. Organizations evaluating how vendor trust and political risk affect procurement will recognize this dynamic from the AI platform context.

The structural point extends beyond any single administration or trade dispute. The EU is building permanent mechanisms for technology sovereignty through the CSA2, the Cloud and AI Development Act, and the Digital Omnibus package. The US has demonstrated, across administrations, a willingness to use trade enforcement tools against digital regulation it considers discriminatory. This dynamic will persist regardless of election outcomes on either side of the Atlantic.

No cybersecurity questionnaire currently in use captures jurisdictional or trade-policy exposure. The vendor that passes your NIS2 supply chain assessment and DORA critical third-party review may carry geopolitical risk that only becomes visible when a Commission implementing act or a Section 301 determination changes the regulatory ground underneath a technology relationship you assumed was stable.

How to build the exposure matrix

The gap between running four separate compliance programs and running one integrated vendor governance program is a single tool: a regulatory exposure matrix that maps critical vendors against all applicable frameworks plus jurisdictional risk.

Structure. List critical vendors down the left column. Run NIS2, DORA, CRA, the revised CSA, and the AI Act across the top as separate columns. Add a final column for trade and jurisdictional exposure. For each intersection, document assessment status (compliant, gap identified, not assessed), criteria used, gaps identified, and remediation owner. For AI Act specifically, capture the system's risk classification, the vendor's role (provider / deployer / importer / distributor), and which timeline applies — the original 2 August 2026 deadline or the proposed 2 December 2027 deferral.

Where to start. Prioritize vendors that operate in the infrastructure layer: cloud providers, identity and access management platforms, network equipment suppliers, managed security services, and any vendor whose product is embedded in systems you cannot easily replace. These are the relationships where a forced phase-out under the revised CSA would be most disruptive and most expensive. For organizations deploying AI agents alongside these infrastructure vendors, the AI data governance framework adds another dimension to the assessment.

What to look for. The matrix will surface three categories of findings most organizations miss when running frameworks in isolation. First, vendors with conflicting status across frameworks, satisfying one set of requirements while carrying unaddressed exposure under another. Second, vendors with concentration risk that spans multiple frameworks, where a single provider's failure or restriction would trigger obligations under NIS2, DORA, and potentially the revised CSA simultaneously. Third, vendors with jurisdictional exposure that existing cybersecurity assessments do not capture, including suppliers headquartered in or controlled from jurisdictions that could be designated under the revised CSA's non-technical risk criteria, or suppliers whose market access could be affected by trade enforcement actions in either direction.

Expected outcome. Most organizations will find three to five vendors that create exposure across multiple frameworks they had not previously connected. This takes approximately one focused week with existing procurement, security, and compliance data. It transforms four separate compliance programs into a single strategic vendor governance conversation that the board, the CISO, the procurement function, and legal can all act on. For a detailed look at how Sweden has implemented NIS2 into national law and what that means for affected organizations, see our comprehensive guide to Sweden's Cybersecurity Act 2025.

The full Intelligence Brief covers the complete four-framework comparison matrix, exposure matrix template with worked examples, remediation prioritization by maturity level, and the regulatory timeline with key compliance milestones.