EU Cyber Law
The layered map of Europe's cybersecurity rules.
From NIS2 and the Cyber Resilience Act to national transposition — one place to see how the instruments fit together.
Why theseeus
A thread through the labyrinth
theseeus.eu takes its name from Theseus — the hero who entered the maze and found his way out.
European cybersecurity law can feel like that labyrinth: corridors of directives and regulations, overlapping layers, national twists. Our mission is to be the thread — a clear map of the initiatives that matter, from Brussels down to the Member States.
Start here
Three ways in
Start with the overview, drill into an EU instrument, or check your Member State.
Core rulebook · 11 in force · 3 proposals
Four instruments that shape the map
NIS2, the Cyber Resilience Act, DORA and CER — the core pair of directives and their product and finance counterparts.
- NIS2 NIS2 Directive Cybersecurity obligations for essential/important entities across 18 sectors.
- CRA Cyber Resilience Act Security by design for every product with digital elements; CE marking.
- DORA DORA ICT-risk regime for the financial sector; lex specialis to NIS2.
- CER CER Directive All-hazards physical resilience of critical entities; NIS2's physical twin.
Situation desk
Situation desk
Interactive tools for practitioners and policy users — find likely regimes, track deadlines, and explore how the instruments connect.
27 Member States · data 2026-07-16
NIS2 across the Union
Transposition is uneven — status counts from the national knowledge base.