Where the laws overlap
Products with digital elements often fall under several EU frameworks at once. This table maps the obligations they share, with the article that carries each, so you can design one control that satisfies several laws.
| Obligation | CRA | NIS2 | GDPR | AI Act | RED | Machinery |
|---|---|---|---|---|---|---|
| Risk assessment | Art. 13(2) / Annex I | Art. 21(2)(a) | Art. 35 (DPIA) | Art. 9 | - | Annex III Part B, general principles (1) |
| Incident reporting | Art. 14 | Art. 23 | Art. 33 and 34 | Art. 73 | - | - |
| Documentation | Art. 31 / Annex VII | - | Art. 30 | Art. 11 and 12 | Art. 21 | Annex IV |
| Vulnerability handling | Art. 13(6) / Annex I Part II | Art. 21(2)(e) | - | - | - | - |
| Access control and security measures | Annex I Part I (2)(d) | Art. 21(2)(i) and (j) | Art. 32 | Art. 15 | Art. 3(3) | - |
| Conformity and CE marking | Art. 28 to 30 and 32 | - | - | Art. 43 | Art. 17 | Art. 21 and 23 to 25 |
| Support period and security updates | Art. 13(8) / Annex I Part I (2)(c) | - | - | - | - | - |
How to read the table
- A cell names the provision that carries the shared obligation in that framework; a dash means the framework sets no such duty.
- The table is an orientation for designing controls that serve several laws at once. It does not say which framework applies to you: that follows from each framework's own scope rules.
- Article numbers refer to the texts as published in the Official Journal; consolidated versions can renumber annex points. Check the cited provision before relying on it.