Do I have to report the same incident under the CRA, NIS2 and GDPR?

The regimes do not overlap because they are badly drafted. They overlap because each asks a different question about the same event.

CRA Article 14 asks about the product. A manufacturer notifies any actively exploited vulnerability contained in its product with digital elements, and any severe incident having an impact on the security of the product. Article 14(5) defines severe as negatively affecting, or being capable of negatively affecting, the ability of the product to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions, or leading to the introduction or execution of malicious code in the product or in a user's network and information systems.^[1]

NIS2 Article 23 asks about your service. An essential or important entity notifies any incident having a significant impact on the provision of its services. Article 23(3) treats an incident as significant where it has caused or is capable of causing severe operational disruption of the services or financial loss for the entity, or where it has affected or is capable of affecting others by causing considerable material or non-material damage.^[8]

GDPR Article 33 asks about personal data. The controller notifies a personal data breach to the competent supervisory authority unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.^[9]

A single exploited vulnerability in a product you manufacture and also operate, which exposes customer records, satisfies all three descriptions at once. It is one event and three regulatory subjects: you as manufacturer, you as operator, you as controller.

The CRA and NIS2 run a deliberately parallel three-stage rhythm. GDPR does not.

CRA Article 14(2), for an actively exploited vulnerability:^[1]

1. Early warning within 24 hours of becoming aware.
2. Vulnerability notification within 72 hours.
3. Final report no later than 14 days after a corrective or mitigating measure is available.

CRA Article 14(4), for a severe incident: 24 hours, then 72 hours, then a final report within one month after the 72-hour notification.^[1]

NIS2 Article 23(4), for a significant incident: an early warning within 24 hours, an incident notification within 72 hours, an intermediate report on request, and a final report no later than one month after the 72-hour notification. Where the incident is still ongoing at that point, a progress report is due instead and the final report follows within one month of the incident being handled.^[8]

GDPR Article 33(1): notification to the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware. There is no 24-hour stage and no scheduled final report. A notification made later than 72 hours has to be accompanied by reasons for the delay.^[9]

The trap is the CRA vulnerability track. Its 14-day final report is the only one of the five clocks anchored to a remedy being available rather than to a prior filing, so it cannot be diarised at the point of notification the way the others can.

The filings do not converge on one desk.

Under the CRA, notification goes simultaneously to the CSIRT designated as coordinator and to ENISA, through one submission on the single reporting platform. Article 14(7) picks the CSIRT by the manufacturer's main establishment in the Union.^[1] The routing rules and platform mechanics work through that determination.

Under NIS2, notification goes to the entity's CSIRT or, where applicable, its competent authority, determined by the Member State's own transposition. Where an entity notifies the competent authority, that authority forwards the notification to the CSIRT.^[8]

Under GDPR, notification goes to the supervisory authority competent under Article 55, which for cross-border processing runs through the lead supervisory authority mechanism.^[9]

The CSIRT that receives your CRA notification and the CSIRT that receives your NIS2 notification can be different bodies in different Member States, because the CRA routes by main establishment while NIS2 routes by where you are established as an entity providing services. Assuming they are the same body is a common and expensive shortcut.

Each regime carries a separate duty toward the people affected, and these are the ones most often forgotten in the first 72 hours.

CRA Article 14(8) requires the manufacturer, after becoming aware of an actively exploited vulnerability or a severe incident, to inform impacted users and where appropriate all users, and where necessary of the mitigation and corrective measures they can deploy. Where appropriate this should be in a structured, machine-readable format that is easily automatically processable.^[1] That clause is the practical case for issuing a CSAF advisory.^[11]

NIS2 Article 23(1) requires entities, where appropriate, to notify recipients of their services of significant incidents likely to adversely affect the provision of those services. Article 23(2) adds a duty to communicate available measures or remedies to recipients potentially affected by a significant cyber threat.^[8]

GDPR Article 34 requires communication to the data subject without undue delay where the breach is likely to result in a high risk to their rights and freedoms.^[10]

There is also an involuntary route. CRA Article 17(2) allows the coordinating CSIRT, after consulting the manufacturer and where appropriate with ENISA, to inform the public about a severe incident or to require the manufacturer to do so, where public awareness is necessary to prevent or mitigate it or disclosure is otherwise in the public interest.^[3] Article 14(8) carries a similar fallback where a manufacturer fails to inform users in a timely manner.^[1]

No, and the CRA says so about GDPR in terms. Recital 32 states that the Regulation should be without prejudice to Regulation (EU) 2016/679.^[7]

On NIS2 the relationship is one of layering rather than substitution. The CRA regulates products placed on the market. NIS2 regulates the cybersecurity risk management and reporting of essential and important entities. The CRA recognises that NIS2 sets risk-management measures for those entities which can require products meeting stricter requirements than the CRA lays down, and that Member States may impose additional requirements for the use of ICT products by those entities under the NIS2 minimum harmonisation principle.^[6] That is the language of two regimes operating together, not one displacing the other.

What the CRA does simplify is reporting within its own scope. Article 16(1) establishes the single reporting platform expressly to simplify manufacturers' reporting obligations, and Article 14(1) achieves simultaneous notification of the coordinating CSIRT and ENISA in one submission.^[2] That single filing covers the CRA. It does nothing for NIS2 or GDPR.

Information does move between authorities. Article 17(1) allows ENISA to submit notified information to EU-CyCLONe where relevant for coordinated management of large-scale incidents and crises.^[3] That is coordination between authorities, and it is not a substitute for the notifying entity's own obligations.

The decisions worth making before an incident, because none of them can be made well inside 24 hours:

• Decide which regimes you are subject to, in which capacity. Manufacturer, essential or important entity, controller, or several at once. Record the reasoning.
• Identify each recipient in advance. Your CRA coordinating CSIRT under Article 14(7), your NIS2 CSIRT or competent authority under national transposition, and your GDPR supervisory authority.^[1][8][9]
• Build one intake that answers all three trigger tests from the same facts. The assessments differ, and the underlying evidence is largely the same.
• Treat 24 hours as the binding constraint. Where the CRA or NIS2 applies, the first filing is due a full 48 hours before the GDPR deadline.
• Diarise the divergence. Two of the final reports run one month from the 72-hour notification. The CRA vulnerability final report runs 14 days from a fix being available and cannot be scheduled up front.

One clarification worth holding onto. CRA Article 14 reporting applies from 11 September 2026, and Article 69(3) extends it to products placed on the market before 11 December 2027.^[5][4] NIS2 and GDPR obligations are already in force, so an incident today can already carry two of the three.