NIS2, CRA, and SBOM: What Delphi 13 Can Truly Do for Your Compliance in 2026

A Correct Technical and Regulatory Guide for Delphi Developers

If you develop software in Italy, 2026 is a pivotal year. The European cybersecurity regulatory landscape is now fully operational: the NIS2 Directive, transposed via Legislative Decree 138/2024, imposes concrete obligations on companies operating in critical sectors. Alongside this sits the Cyber Resilience Act (CRA), an EU regulation introducing specific requirements for products with digital elements, including the mandatory production of a SBOM (Software Bill of Materials).

For those working with Delphi, understanding exactly what these regulations require—and what the available tools can actually offer—is essential for making informed decisions.

1. NIS2 and CRA: Two Distinct Regulations, Complementary Goals

A common mistake is confusing NIS2 and CRA. It is important to distinguish them:

NIS2 (EU Directive 2022/2555) targets operators of essential and important services. It mandates risk management, incident notification, cybersecurity governance, and supply chain security. It does not prescribe specific technologies or explicitly mention SBOM as a requirement.
Cyber Resilience Act (CRA, EU Regulation 2024/2847) targets manufacturers of products with digital elements. It is the CRA, not NIS2, that explicitly requires the production of an SBOM for software components. The CRA will be fully applicable in 2027, though vulnerability reporting obligations begin as early as September 2026.

In practice, a Delphi developer providing software to critical sectors may need to comply with both: NIS2 as a supplier in the supply chain of an essential entity, and CRA as a manufacturer of a digital product. Therefore, an SBOM is a strongly recommended best practice for NIS2 and a direct legal obligation under the CRA.

2. SBOM: State of the Art for the Delphi Ecosystem

Important Note: As of today (February 2026), RAD Studio 13 Florence does not include a native SBOM generation feature integrated directly into the IDE. Generating an SBOM in CycloneDX or SPDX format is available via third-party tools:

DerScanner SCA + SBOM: Offered by Embarcadero in a promotional bundle with RAD Studio 13 licenses. This is an external tool, not a built-in compiler or IDE feature.
Delphi Code Analyzer (delphiparser.com): A third-party commercial tool supporting Delphi code analysis (from Delphi 1 to 13) and SBOM generation in CycloneDX 1.5 format.

This means that to produce an audit-ready SBOM, you must plan to integrate additional tools into your build process rather than relying on an “out of the box” function in Delphi 13.

3. The 2026 NIS2 Roadmap: Immediate Actions

If your company falls within critical sectors (energy, healthcare, digital infrastructure, manufacturing, PA, etc.), the 2026 calendar allows for no delays:

By February 28, 2026: Window open for registration or annual updates on the National Cybersecurity Agency (ACN) portal.
From January 1, 2026: Obligation to notify CSIRT Italia of any “significant” incident, with a pre-notification within 24 hours.
By October 2026: For entities notified in 2025, the minimum technical measures required by law must be fully operational.
Sanctions: Up to €10 million or 2% of global turnover for essential entities; up to €7 million or 1.4% of turnover for important entities. NIS2 also stipulates direct liability for management bodies.

4. Why Delphi is an Ally for Compliance

Native Compilation and Attack Surface

Delphi applications are natively compiled into machine code, without dependencies on virtual machines or managed runtimes. This can simplify dependency management compared to ecosystems with vast package managers (npm, Maven, pip).

However, honesty is required: the complexity of a Delphi application’s supply chain depends on the third-party components used (VCL/FMX, GetIt packages, commercial libraries). A Delphi project with many external dependencies can have a risk profile comparable to a Java or .NET application. Furthermore, native compilation introduces specific risks (buffer overflows, memory corruption) that managed runtimes mitigate natively. It should also be noted that modern .NET supports native AOT (Ahead-of-Time) compilation, making the comparison less stark than it once was.

InterBase 15: Verified Security Features

InterBase 15, released in Autumn 2025, introduces concrete, documented security features:

AES-256 Encryption by default for data at-rest and in-transit. DES is no longer supported.
Mandatory TLS 1.2+ for client-server communications. TLS 1.0 and 1.1 have been eliminated.
OpenSSL 3.5 LTS as the cryptographic foundation.
Optional FIPS 140-3 (Server Edition on Windows and Linux only). While FIPS 140-3 is a US standard, in the European NIS2 context, primary references remain ISO/IEC 27001 and ENISA frameworks. FIPS support is nonetheless a strong indicator of cryptographic maturity.
SHA-256 password digest for password protection.
Change Views™ for tracking data modifications, essential for audit trails.
Separation of Duties (SYSDSO) with column-level encryption, implementing the principle of least privilege.

The Practical Advantage of the RAD Studio 13 Bundle

A concrete aspect deserving attention is the ecosystem of tools Embarcadero provides with a RAD Studio 13 license:

InterBase 15 Developer Edition is included, providing all the security features of the Server Edition for development and testing.
DerScanner SCA + SBOM is offered as a promotion for customers purchasing or upgrading to RAD Studio 13.
GetIt with Versioning: RAD Studio 13 introduces support for versioning GetIt packages, allowing you to “pin” specific dependency versions. This facilitates build reproducibility and third-party component traceability.

In practical terms, upgrading to RAD Studio 13 provides a modern encrypted database, an SBOM generation tool, and a versioned dependency management system in a single transaction. It’s not “automatic compliance,” but it significantly reduces the operational complexity required to achieve it.

5. Implementing Technical Measures in Delphi

To make Delphi software compliant with NIS2 requirements, developers should focus on three pillars:

Strong Authentication (MFA): NIS2 requires multi-factor authentication for critical access. In Delphi, you can integrate libraries like IPWorks Auth to implement OAuth, RADIUS, or Kerberos and manage X.509 certificates.
Protected Communication: It is vital to support TLS 1.2 or higher and the latest OpenSSL versions, retiring obsolete protocols. InterBase 15 implements these requirements natively.
Traceability and Audit: By leveraging InterBase Change Views™, developers can track who modified what, creating granular audit logs useful for managing significant incidents.

6. Supply Chain and Software Lifecycle

NIS2 places significant focus on supply chain security. Those providing Delphi software must be ready to provide evidence of their Secure Development Lifecycle (SDLC):

Digitally Signed Builds: Delphi allows for signing binaries using standard tools (signtool, codesign). Digital signing is a standard practice available with any toolchain, not an exclusive Delphi feature.
Vulnerability Management: You must constantly monitor third-party dependencies (VCL/FMX, GetIt) and apply timely patches. Tools like DerScanner or Delphi Code Analyzer can facilitate this.
SBOM as Best Practice: Even if not explicitly mandated by NIS2, producing an SBOM in CycloneDX or SPDX format is highly recommended for traceability and will be a CRA requirement.

7. Why Consider Upgrading to Delphi 13

Upgrading offers real advantages, though they must be evaluated honestly. Beyond technical improvements, the most relevant point for compliance is the availability of a pre-assembled ecosystem:

Updated Platform Support: Compatibility with the latest Windows (including Windows Server 2025), macOS, iOS, and Android.
64-bit IDE: The first version with a complete, production-ready 64-bit IDE.
Improved Language/Compiler: Ternary operator, NameOf, new compiler directives, and extended generic constraints.
AI Components: SmartCore AI Component Pack for integrating AI features.
Integrated Toolkit: By including InterBase 15, DerScanner, and GetIt versioning, RAD Studio 13 reduces the “assembly work” otherwise required by the developer.

An important clarification: Using an older version of Delphi is not, in itself, a violation of NIS2. The directive requires technical measures proportionate to the risk, not specific IDE versions. However, the integrated tools in Delphi 13 make the path to compliance objectively smoother.

Conclusion

2026 marks the shift from theory to practice for NIS2 compliance in Italy. For companies developing with Delphi, compliance requires a multi-front approach: secure development practices, vulnerability management, and adequate documentation.

RAD Studio 13 represents the most direct entry point available in the Delphi ecosystem today. While compliance remains an organizational process that goes far beyond the choice of IDE, starting with the right tools already at hand is a concrete advantage.

Cybersecurity is not a technical cost, but a fundamental organizational duty to protect business continuity in the Digital Single Market.

Regulatory References and Sources

NIS2 Directive: EU 2022/2555 — Italian Transposition: D.Lgs. 138/2024.
Cyber Resilience Act: EU Regulation 2024/2847.
ACN (National Cybersecurity Agency): acn.gov.it/portale/nis.
RAD Studio 13 Florence: embarcadero.com.
InterBase 15: embarcadero.com.

How We Can Help

We are ready to support you in the NIS2 and CRA compliance process, from risk assessment to SBOM production and the implementation of technical measures in your Delphi stack.