One event can raise more than one legal question. A group may be both a CRA maker and an entity covered by a State’s NIS2 law. One attack may then need a product check and a separate entity check.
Do not merge the tests because both use security terms or fast reports. Link the proof. Let each law reach its own result.
Start with one event anchor
Give the event a stable ID, checked timeline, and one proof index. Save source logs, hacked assets, product links, service harm, States, and choice owners. One shared record keeps teams from gathering the same facts twice.
Keep legal views in separate parts. A hacked signing service may matter to both tracks. It may not have the same legal effect in each.
Run the CRA product test
Name the legal maker and digital product. Does the proof show a flaw under active attack in that product? If not, does it show a severe event that harms product security? Record versions, tasks at risk, awareness proof, and the Article 14 track.
Do not base the product result on the NIS2 label or a service outage by itself. State how the event reaches the product.
Run the NIS2 entity test
Name each entity that may be in scope. Find the State law that puts NIS2 in place and the right authority or CSIRT. Name the covered services and the test for a large event. Check the harm to the service and its network under the rules for that entity.
Do not use the CRA result as a short cut. An event may affect a NIS2 entity but fail the CRA trigger. It may also reach a CRA product but fail the NIS2 test for that entity.
Coordinate clocks and messages
Make a report table. For each law, name the entity, test, choice time, reader, due time, approver, state, and proof of filing. Share technical facts. Shape each report for its own legal goal and reader.
Before filing, compare names, dates, scope, and fixes in both drafts. If words differ, state why. A product version and a harmed service are not the same unit of scope.
Preserve jurisdictional uncertainty
NIS2 works through each State’s law. Send disputes about the entity, place, or reader to a lawyer who knows that State. Keep each guess and choice date clear. A future EU plan does not replace the current filing route.
The result is one event file with two clear choices. A cross-check shows which facts were shared, which differed, and how each outside duty was met.
Continue this workflow with the product-security boundary and the CRA and GDPR triage.