A documented comparison of the former and proposed operating facts, used to trigger a fresh scope analysis.

Entity-service-product split

Separate the provider's legal-entity status, its ongoing service, and its product placed on the market.

A formal record of software components and their supply-chain relationships; the CRA defines it in Article 3(39).

Software bill of materials: a formal record of software components and supply-chain relationships.

What is Annex activity?

An entity type, service, or activity listed in NIS2 Annex I or Annex II and used in the Directive's scope assessment.

What is Conditional go?

A governance decision permitting progress only if specified factual, legal, technical, and contractual conditions are completed before release.

What is Controller-processor allocation?

The GDPR assessment of which party determines the purposes and means of processing and which processes personal data on documented instructions.

Reassess scope when the business changes — Next steps: Contracts, governance and advice

1. Treat change as a new scope question

Change is the trigger

Reassess scope when facts change: service, customer, location, corporate size, data flow, access, product functionality, or outsourcing. A launch-era conclusion may no longer describe the business.

Capture operational reality

Record the old and new facts, effective date, entities, countries, systems, and owner. Product labels are not decisive; assess architecture, commitments, and genuine dependency.

2. Build a fact delta before naming a regime

Use a fact delta

Compare Before, After, and Legal consequence to test. The exercise converts a commercial change into auditable legal facts rather than relying on product-marketing terminology.

Keep three layers separate

Map the provider entity, the ongoing service, and the digital product separately. This avoids treating NIS2 entity scope and Cyber Resilience Act product scope as the same question.

3. Re-test the NIS2 perimeter and classification

Test NIS2 from the activity

Ask whether the changed activity fits Annex I or II, occurs in the Union, and meets the ordinary size gateway or an Article 2 regardless-of-size route.

Scope is not the final answer

Then test essential versus important status and Article 4 overlap. A sector-specific Union act can displace relevant NIS2 provisions only on the Directive's equivalence conditions.

4. Resolve DORA and GDPR consequences without collapsing them

DORA changes the customer contract

A provider may need to support a financial customer's DORA compliance even if the provider is not itself a DORA financial entity. Covered financial entities remain responsible for classification.

Preserve Article 30's structure

Article 30(1): written allocation. Article 30(2): baseline ICT-contract terms. Article 30(3): additional terms for critical or important functions.

5. Reassess the product when the service feature changes

Separate present duty from readiness

On September 17, 2026, CRA Article 14 reporting has applied since September 11, 2026. The Regulation's general application date is December 11, 2027.

Preserve future conformity evidence

Capture architecture, components, updates, support-period reasoning, and vulnerability handling now. Annex I Part II includes an SBOM requirement; Annex VII specifies technical-documentation content.

6. Board gate: make a conditional decision

Use this 10-minute decision prompt before approving the business change:

What fact changed? State it without commercial shorthand.
Which legal entity performs it? Include group and subcontracting facts.
Which perimeter might expand? NIS2 entity scope, DORA customer-contract obligations, GDPR roles, CRA manufacturer/product obligations, or more than one.
What cannot wait? For example, an Article 14 CRA reporting process where applicable.
What evidence could reverse the advice? Examples include actual customer dependency, function classification, service location, entity size, or whether the functionality is genuinely provided on an ongoing basis.

Recommend a conditional go only where named owners close the factual gaps before release. This is governance practice, not a substitute for a statutory determination.

Key scope prompts

Flip each card and use the prompt in your next change review.

Fact delta: A documented comparison of the former and proposed operating facts, used to trigger a fresh scope analysis.
Entity-service-product split: Separate the provider's legal-entity status, its ongoing service, and its product placed on the market.
Critical or important function: Under DORA, a function whose disruption or failed performance would materially impair the financial entity or its continuing compliance.
SBOM: A formal record of software components and their supply-chain relationships; the CRA defines it in Article 3(39).

Scenario: Harborlight's remote-monitoring pivot

Harborlight Systems, an EU medium-sized software company, sells network appliances. It plans to add 24/7 remote administration, privileged access, and incident triage for EU customers. A credit institution says the service supports a "non-critical dashboard," but its operating model shows the dashboard triggers payment-platform recovery actions. Harborlight also intends to issue remote security updates for the appliance.

Best next decision: approve a conditional launch only after a documented scope reassessment. Test whether the ongoing service fits a NIS2 Annex activity, obtain the financial entity's evidence-based DORA function classification, rebuild the Article 30 contract analysis, and establish the CRA Article 14 reporting pathway if Harborlight is the relevant manufacturer. The "dashboard" label conflicts with the operational facts. NIS2's activity and size analysis, DORA's customer-function analysis, and CRA product obligations are separate tests.

This decision could change if verified facts show that Harborlight provides no ongoing managed or security service, has no privileged operational role, the financial entity demonstrates that disruption would not materially impair a critical or important function, or Harborlight is not the relevant CRA manufacturer.

What is the best next decision for Harborlight's board?

Treat the service as out of scope because the contract calls it a non-critical dashboard.
Approve a conditional launch subject to a documented NIS2, DORA, GDPR, and CRA fact-based reassessment.
Apply only the Cyber Resilience Act because the plan includes remote security updates.

Show Answer

Answer: B) Approve a conditional launch subject to a documented NIS2, DORA, GDPR, and CRA fact-based reassessment.

Option 2 is best because the new continuous service, privileged access, financial-sector dependency, and product-update model each create distinct scope questions. The contract label is not conclusive. DORA Article 30 analysis depends on the financial entity's evidence-based function classification, while NIS2 and CRA require separate assessments.

Key Terms

SBOM: Software bill of materials: a formal record of software components and supply-chain relationships.
Annex activity: An entity type, service, or activity listed in NIS2 Annex I or Annex II and used in the Directive's scope assessment.
Conditional go: A governance decision permitting progress only if specified factual, legal, technical, and contractual conditions are completed before release.
Controller-processor allocation: The GDPR assessment of which party determines the purposes and means of processing and which processes personal data on documented instructions.