SkarpChapter 3 of 3
Resolve a boundary between cyber regimes
Develop regulatory scope and digital products while working to advise during incidents.
1. Separate the regulated object from the incident
Three legal objects
Classify the entity, the personal-data processing, and the product with digital elements separately. One technical event may engage all three.
A reporting route is an outcome, not the starting point. Avoid assuming that an ICT-related incident, product vulnerability, and personal-data breach are the same legal event.
2. Build a scope matrix before deciding precedence
The incident matrix
For each regime, record: legal person, role, asset, territorial link, and current evidence. Scope follows facts, not the incident-response team structure.
Shared branding or infrastructure does not itself make one group company the other's manufacturer. Preserve uncertain facts as explicit assumptions.
3. Resolve the Digital Operational Resilience Act and NIS two boundary
Financial entities
First ask whether the financial entity is also identified as essential or important under national rules transposing NIS two Article 3. If so, the Digital Operational Resilience Act is the sector-specific framework for corresponding NIS two matters.
Digital Operational Resilience Act scope alone does not establish NIS two status. The boundary is entity-specific, and each affiliate requires its own assessment under applicable national law.
4. Keep the General Data Protection Regulation on a parallel track
A separate threshold
A product or operational incident is not automatically a personal-data breach. Test whether the security event caused loss, alteration, unauthorised disclosure, or access to personal data.
Keep separate evidence for data categories, affected individuals, access, and likely consequences. Do not let a cyber label decide the privacy analysis.
5. Apply the Cyber Resilience Act to the product and its manufacturer
Current timing
On September 17, 2026, Cyber Resilience Act Article 14 reporting duties have applied for six days. The Regulation's general application date remains December 11, 2027.
Active exploitation requires reliable evidence that a malicious actor exploited the vulnerability without the system owner's permission. Malicious-code execution is not the legal test.
6. Test the supplier-contract assumption
Thought exercise: label the contract fact
A managed-service supplier says: "We are only a vendor, so the incident is ours to report."
Classify that statement as scope, contract allocation, or unsupported conclusion.
The best answer is unsupported conclusion. Under paragraph one of Article 30 of the Digital Operational Resilience Act, rights and obligations must be clearly allocated in writing. Paragraph two specifies contractual elements for ICT services. Paragraph three adds requirements where the ICT service supports a critical or important function. These provisions are distinct; none alone decides statutory reporting responsibility for every incident.
7. Scenario: the token, the payment institution, and the affiliate
Conflicting facts
VelaPay operates payment services. Its affiliate places a firmware token on the market. Logs show unauthorised commands and account identifiers, but neither service impact nor record extraction is confirmed.
Reasoned decision
Run Digital Operational Resilience Act, General Data Protection Regulation, and Cyber Resilience Act analyses in parallel. Also verify VelaPay's status under national rules transposing NIS two Article 3 before concluding that the Digital Operational Resilience Act replaces corresponding NIS two rules.
Reverse the product conclusion if testing was authorised, malicious exploitation is not supported, or a different legal person actually placed the token on the market.
Scenario quiz: choose the best next decision
Decide before the evidence window closes
VelaPay's incident lead proposes one consolidated "NIS two report" for the payment institution and the token affiliate. The team has reliable evidence of unauthorised exploitation of the token vulnerability, while the privacy investigation, the assessment of any impact on VelaPay's data or services, and VelaPay's status under national rules transposing NIS two Article 3 remain incomplete.
What is the best next decision?
- Open separate Digital Operational Resilience Act, General Data Protection Regulation, and Cyber Resilience Act assessments, and verify under applicable national law whether VelaPay is identified as an essential or important entity before deciding how the Digital Operational Resilience Act and corresponding NIS two rules interact.
- File only under NIS two because it is the broadest cyber regime and wait for the privacy, operational-impact, and product investigations to finish.
- Treat the affiliate's marketed token as part of the payment institution and make the payment institution solely responsible under the Cyber Resilience Act.
Show Answer
Answer: A) Open separate Digital Operational Resilience Act, General Data Protection Regulation, and Cyber Resilience Act assessments, and verify under applicable national law whether VelaPay is identified as an essential or important entity before deciding how the Digital Operational Resilience Act and corresponding NIS two rules interact.
The payment institution and product manufacturer may be different legal persons with different obligations. VelaPay's inclusion within the Digital Operational Resilience Act does not alone establish the NIS two boundary. It is also necessary to determine whether VelaPay is identified as an essential or important entity under applicable national rules transposing NIS two Article 3. If it is, the Digital Operational Resilience Act is the sector-specific framework for corresponding NIS two matters. The Cyber Resilience Act requires a product-focused assessment for the manufacturer, while the incomplete evidence does not justify stopping the separate General Data Protection Regulation or Digital Operational Resilience Act assessments. The conclusion could change if the entity roles, national classification, manufacturer identity, or evidence of malicious exploitation changes.
Key Terms
- Manufacturer
- The economic operator whose legal role must be determined under the Cyber Resilience Act, including by reference to who places the product on the market under its name.
- Financial entity
- An entity listed within the scope of Article 2 of the Digital Operational Resilience Act.
- Personal data breach
- A security breach resulting in accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
- Product with digital elements
- The product-focused object of analysis under the Cyber Resilience Act; assess it separately from the entity operating a service.
- Actively exploited vulnerability
- A vulnerability for which reliable evidence shows that a malicious actor exploited it in a system without the system owner's permission.