Software bill of materials: a machine-readable inventory of software components and dependencies used for vulnerability management.

A business change that may alter the regulatory scope conclusion, such as a new service function, customer use, territory, or data flow.

What is Product with digital elements?

Under the CRA, a software or hardware product and its remote data-processing solutions, including separately placed components.

What is Critical or important function?

A DORA classification of a financial entity function that affects the contractual obligations required for supporting ICT services.

Reassess scope when the business changes · New case 5 — Next steps: Contracts, governance and advice

1. Treat a business change as a scope trigger

Scope is not static

Reassess scope when the offering, customer, territory, or operational role changes. An original launch analysis may no longer describe the business.

Board-ready trigger

Record: `Change -> affected activity/product -> plausible regime -> fact owner -> decision date`. Start with facts, not regulatory labels.

2. Fact-delta exercise

Mark the decisive delta

A product team says: "The hardware is unchanged." Ask whether that is legally decisive.

Write down one changed fact under each heading:

Product: Is new software or a remote service indispensable to a function?
Entity activity: Has the business begun providing a listed digital service?
Customer function: Does a financial entity rely on it for a critical or important function?
Data: Does the update collect identifiers, telemetry, location, or user-account data?

The answer "no hardware change" is only one fact. It does not close the analysis.

3. New case: the Horizon Relay pivot

The changed offering

Horizon moves from local-device software to a gateway-plus-cloud subscription. Engineering says the cloud is needed for alerts and remote security configuration.

The conflicting account

Product calls the cloud optional. Engineering says core functions fail without it. Customer procurement may use it in resilience controls.

Keep three questions apart

Assess the supplied product or service, the customer's regulated function, and personal-data processing separately. They may produce different conclusions.

4. Test NIS2 at entity level

Entity question first

NIS2 turns on Horizon's own activity, listed entity type, Union operation, size, and exceptions. A regulated customer does not automatically bring a supplier into NIS2.

Evidence to obtain

Test the actual service: architecture, service description, contracts, pricing, and whether computing resources are supplied on demand.

Jurisdiction is separate

For listed digital providers, NIS2 Article 26 uses a main-establishment test focused first on where cybersecurity risk-management decisions are predominantly taken.

5. Keep DORA's contract analysis distinct

Do not misstate DORA scope

A supplier contract does not, by itself, make Horizon a DORA financial entity. It can, however, require Horizon to accept DORA-driven contractual terms.

Classify the customer function

Ask whether the service supports a critical or important function. This is a customer-side operational reliance assessment, not a product marketing claim.

Article 30 has three layers

30(1): written allocation. 30(2): baseline ICT-service clauses. 30(3): additional clauses for critical or important functions.

6. Reframe the Cyber Resilience Act analysis

Assess the package

If the remote service is necessary for a product function, it can be part of the CRA product analysis. The gateway alone is not necessarily the legal unit.

Date discipline

As of September 18, 2026, CRA general application is December 11, 2027. Do not describe all core product duties as already generally applicable.

Build the evidence file

Capture intended purpose, foreseeable use, support assumptions, SBOM, vulnerability process, and user-facing security information in the technical documentation.

7. Deliver one reasoned decision, with a reversal test

Best next decision

Pause unsupported "optional" and "DORA-ready" claims. Run a short scope refresh with named owners and evidence requests.

Provisional outcome

Treat CRA scoping as a design-control matter; negotiate proportionate DORA terms; investigate NIS2 rather than prematurely concluding it applies.

What could reverse advice?

A genuinely separable cloud service may narrow CRA analysis. A critical-function designation, cloud-provider evidence, or identifiable telemetry can expand the analysis.

Scenario quiz: choose the best next decision

Horizon wants to sign the payment institution this week. Sales proposes accepting only a generic security addendum because Horizon is "not a financial entity." Product proposes declaring the cloud optional because the gateway still transmits raw data locally. Engineering evidence is incomplete.

What is the best next decision?

Sign using the generic addendum because DORA never affects ICT suppliers.
Pause unqualified claims, obtain the functional-dependency and customer-criticality evidence, then determine the DORA contractual tier and refresh NIS2, CRA, and GDPR scope.
Treat the gateway as outside the CRA because it has a local mode, and close the analysis.

Show Answer

Answer: B) Pause unqualified claims, obtain the functional-dependency and customer-criticality evidence, then determine the DORA contractual tier and refresh NIS2, CRA, and GDPR scope.

Option 2 is correct because the changed cloud offering and customer reliance create unresolved scope facts. DORA can drive contract terms even though Horizon is not automatically a DORA financial entity. A local mode does not settle whether remote processing is part of a CRA product function, and incomplete evidence prevents a defensible NIS2, CRA, GDPR, or criticality conclusion.

Key Terms

SBOM: Software bill of materials: a machine-readable inventory of software components and dependencies used for vulnerability management.
Fact delta: A business change that may alter the regulatory scope conclusion, such as a new service function, customer use, territory, or data flow.
Main establishment: For specified NIS2 digital providers, the Member State where cybersecurity risk-management decisions are predominantly taken, subject to the Article 26 fallback rules.
Product with digital elements: Under the CRA, a software or hardware product and its remote data-processing solutions, including separately placed components.
Critical or important function: A DORA classification of a financial entity function that affects the contractual obligations required for supporting ICT services.