Do cybersecurity rules apply to an importer?
Short answer
Depends on sector and size. The entity duties are read separately from the product duties.
Read against the registers 2026-08-26.
Who the role is
Whoever places a product from outside the union on the union market steps into the manufacturer's line of duties.
What the topic covers
All three regimes ask for measures, an incident report and a named accountable person. They differ in who is covered and how fast the report has to leave the building.
The rows behind the answer
European Union
- NIS2 — Directive (EU) 2022/2555: Covers named essential and important entities, with management accountability and staged incident reporting.
United States
- NYDFS Cybersecurity Regulation: Applies to entities licensed in New York: written programme, CISO reporting and 72 hour notification.
- GLBA Safeguards Rule: Requires a written information security programme for financial institutions, with a qualified individual in charge.
China
- Cybersecurity Law of the People's Republic of China: Sets graded protection duties, network operator obligations and incident response requirements.
- Data Security Law of the People's Republic of China: Classifies data by importance and attaches handling and reporting duties to each class.
Where companies usually start
- Map which entities in the group are in scope in each jurisdiction.
- Write one incident procedure with the shortest applicable clock at the top.
- Keep the evidence of measures in a form an auditor can read without a walkthrough.
This page reads published registers and describes common practice. It is not legal advice and it is not a compliance verdict.
Other questions for importer
- Do ai governance rules apply to an importer?
- Do personal data rules apply to an importer?
- Do cross-border data rules apply to an importer?
- Do health data rules apply to an importer?
- Do online platforms rules apply to an importer?
- Do consumer rights rules apply to an importer?
- Do product safety rules apply to an importer?
- Do climate disclosure rules apply to an importer?
- Do export controls rules apply to an importer?
ExploreWorldAI is operated by Valkiv Ventures AB (Reg. no. 556995-1311), Kungsgatan 8, 111 43 Stockholm, Sweden. EU-hosted, with data processing assessed against the GDPR. Contact: hello@exploreworldai.com.
Machine-readable summaries for AI agents: /llms.txt and /llms-full.txt.
