What do CSA2, NIS2, and CRA require from companies now? Cybersecurity regulation is evolving in leaps. Finland’s Cybersecurity Act, which transposes the EU Network and Information Security Directive (NIS2) into Finnish legislation, only became applicable in April 2025. Companies had barely managed to update their risk management to the level required by law when the European Commission was already proposing amendments to the Directive.
In recent months, the Commission has presented two proposals to amend the Directive. In November, the Commission published the Digital Omnibus package, and in January 2026, a new cybersecurity package.
The Cybersecurity Act covers 18 critical sectors, including energy, transport, healthcare, and digital infrastructure, and its key obligations are clear: systematic risk management, including supply chain management, and an obligation to report significant incidents to authorities. The Cybersecurity Act is also particularly noteworthy from a liability
