NIS2 Directive Explained: What It Is, Who Must Comply and What It Requires (2026)

The NIS2 Directive (Directive (EU) 2022/2555) is the most significant cybersecurity legislation the European Union has ever enacted. It replaces the original NIS Directive from 2016, dramatically expanding its scope, tightening requirements, and introducing personal liability for management. If your organization operates in the EU, you need to understand what NIS2 means for your business.

NIS2 at a glance

What it is	Directive (EU) 2022/2555, an EU directive: it applies through each member state's national law.
Key dates	In force 16 January 2023; national laws due by 17 October 2024; lists of entities due by 17 April 2025.
Who is in scope	Medium-sized and large organizations in the 18 sectors of Annexes I and II, plus some entities of any size (Article 2).
Two categories	Essential entities (supervised proactively) and important entities (supervised after the fact) (Article 3).
What it requires	Ten minimum cybersecurity risk-management measures (Article 21) and reporting of significant incidents (Article 23).
Reporting deadlines	Early warning within 24 hours, incident notification within 72 hours, final report within one month.
Fines	Maximum of at least €10M or 2% of worldwide turnover (essential) and €7M or 1.4% (important), whichever is higher (Article 34).
Management	Management bodies approve and oversee the measures, can be held liable, and must follow training (Article 20).

What changed from NIS1 to NIS2?

The original NIS Directive (2016) was the EU's first attempt at harmonizing cybersecurity across member states. Its implementation was inconsistent: each member state identified "operators of essential services" in its own way, so similar companies were treated very differently across the EU.

NIS2 fixes these problems. It covers 18 sectors (11 "high criticality" sectors in Annex I and 7 "other critical" sectors in Annex II) and replaces case-by-case identification with a uniform size rule: in covered sectors, medium-sized and large organizations are generally in scope. It also tightens incident reporting, adds supply chain security requirements and introduces accountability for management bodies.

Who does NIS2 apply to?

NIS2 divides covered organizations into two categories with different supervision regimes. Which one you fall into depends on both your sector and your size, not on your sector alone:

Essential entities face proactive (ex-ante) supervision: authorities can inspect and audit them at any time, not only after an incident. As a rule, these are large organizations in the Annex I sectors: energy (electricity, oil, gas, hydrogen, district heating), transport (air, rail, water, road), banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure (including cloud providers, data centres, CDNs and trust services), ICT service management (B2B), public administration and space. Some entities are essential regardless of size: qualified trust service providers, TLD registries and DNS service providers. Medium-sized providers of public electronic communications networks or services are essential too, as are central government bodies.

Important entities face reactive (ex-post) supervision: authorities act after an incident or evidence of non-compliance. They are medium-sized organizations in the Annex I sectors above, plus medium-sized and large organizations in the Annex II sectors: postal and courier services, waste management, chemicals, food, manufacturing (medical devices, computers and electronics, electrical equipment, machinery, vehicles), digital providers (online marketplaces, search engines, social networks) and research organizations.

"Medium-sized" follows the EU SME definition (Commission Recommendation 2003/361/EC): an organization is at least medium-sized if it has 50 or more staff, or both an annual turnover and a balance sheet above €10 million. It counts as large from 250 staff, or with turnover above €50 million and a balance sheet above €43 million. Some entities are covered regardless of size, including providers of public electronic communications networks or services, trust service providers, TLD registries and DNS service providers. Member states can also bring smaller entities into scope, for example if they are the sole provider of an essential service. Cloud computing providers are covered only from medium size upward.

Not sure if NIS2 applies to you? Use our free NIS2 Readiness Check — it starts with a screening step that checks your sector, size, and EU operations.

The 10 minimum security measures (Article 21)

Article 21 requires "appropriate and proportionate" technical, operational and organisational measures, based on an all-hazards approach, that include at least the ten areas below (Article 21(2)). The letters are the points of that paragraph; the explanations describe what the area usually means in practice.

1. Risk analysis and information system security policies (a) — You must have a documented risk management framework covering all network and information systems. This includes regular risk assessments, defined risk treatment approaches, and policies approved by management.

2. Incident handling (b) — A process to detect, analyse, contain and respond to incidents. It is what makes the strict reporting deadlines of Article 23 achievable (see incident reporting below).

3. Business continuity and crisis management (c) — Backup management, disaster recovery procedures, and crisis management processes must be in place and tested. This goes beyond IT — it covers the entire organization's ability to continue operating during a cybersecurity incident.

4. Supply chain security (d) — You must address security risks in your relationships with direct suppliers and service providers, taking into account each supplier's vulnerabilities and the quality of its products and security practices (Article 21(3)). In practice this includes contractual security requirements, supplier assessments, and ongoing monitoring. Supply chain attacks have become a primary concern, and NIS2 reflects this.

5. Security in network and information systems acquisition, development, and maintenance (e) — Including vulnerability handling and disclosure.

6. Policies and procedures to assess the effectiveness of the measures (f) — You need mechanisms to evaluate whether your security controls are actually working.

7. Basic cyber hygiene practices and cybersecurity training (g) — Security awareness and good everyday practice for staff. Separately, Article 20(2) requires management body members to follow training, and encourages entities to offer similar training to employees regularly.

8. Policies on cryptography and, where appropriate, encryption (h) — For example, rules for when data at rest and in transit is encrypted and how keys are managed.

9. Human resources security, access control policies, and asset management (i) — In practice: least-privilege access, regular access reviews, and an up-to-date asset inventory.

10. Multi-factor authentication and secured communications (j) — Multi-factor or continuous authentication, secured voice, video and text communications, and secured emergency communication systems within the entity, where appropriate.

For digital infrastructure and digital service providers (DNS, TLD registries, cloud, data centres, CDNs, managed and managed security service providers, online marketplaces, search engines, social networks and trust services), Commission Implementing Regulation (EU) 2024/2690 spells out the technical requirements for these measures in detail. Other entities follow their national law, which may add its own detail.

Incident reporting (Article 23)

An incident is significant if it has caused, or can cause, severe operational disruption of your services or financial loss for you, or considerable material or non-material damage to others (Article 23(3)). Significant incidents go to your national CSIRT or competent authority in stages, counted from when you become aware of the incident:

Report	Deadline	Content
Early warning	Within 24 hours	Whether a malicious act is suspected and whether there could be cross-border impact
Incident notification	Within 72 hours (24 hours for trust service providers)	Initial assessment: severity, impact, indicators of compromise where available
Intermediate report	On request of the CSIRT or authority	Relevant status updates
Final report	Within one month of the incident notification	Detailed description, root cause or threat type, mitigation, cross-border impact
Progress report	Instead of the final report if the incident is still ongoing; final report within one month of handling it	Current status

Where appropriate, you must also tell the recipients of your services, without undue delay, about significant incidents likely to affect them (Article 23(1)). The CSIRT or authority should answer your early warning within 24 hours where possible, with initial feedback and, on request, guidance (Article 23(5)). For a step-by-step walkthrough with what to put in each report, see our NIS2 incident reporting guide.

Management liability — the game changer

Under NIS2 Article 20, management bodies must approve cybersecurity risk management measures and oversee their implementation. They can be held liable for infringements of these obligations, under the rules of national law. For essential entities, competent authorities can even impose temporary bans from exercising managerial functions.

This transforms cybersecurity from an IT concern to a board-level obligation. Management body members who delegate cybersecurity without oversight are personally at risk. The directive also requires that management undergo cybersecurity training — a clear signal that "I didn't understand the risks" is not an acceptable defense.

Penalties

For breaches of Article 21 or 23, each member state must allow fines with a maximum of at least €10 million or 2% of total worldwide annual turnover for essential entities (whichever is higher), and of at least €7 million or 1.4% for important entities (Article 34(4)–(5)). National law can set higher maximums, so check your country's law. Beyond fines, authorities can issue binding instructions, order audits, and for essential entities, suspend certifications.

Timeline and current status

NIS2 entered into force on 16 January 2023. EU member states were required to transpose it into national law by 17 October 2024 and to identify their essential and important entities by 17 April 2025. Most member states have now transposed it, but not all on time: on 8 July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for failing to notify full transposition, and asked for financial penalties. As of 4 November 2026, 24 of the 27 member states have a NIS2 law in force (the Netherlands' Cybersecurity Act since 15 August 2026); France, Ireland and Spain are still pending. Your obligations come from your country's national law, so check its status and any national details: see NIS2 transposition status by country and NIS2 registration by country.

Changes on the way. On 20 January 2026 the Commission proposed targeted amendments to NIS2 (COM(2026) 13) as part of a wider cybersecurity package. They include simplifying jurisdiction rules, harmonizing the Article 21 risk-management measures through implementing acts, and removing micro and small DNS service providers from scope. The proposal is still going through the EU legislative process and does not change your current obligations. Separately, the Commission's November 2025 Digital Omnibus proposal includes a single entry point for incident reporting under several EU laws, also not yet adopted.

How to start your NIS2 compliance journey

Step 1: Determine if NIS2 applies. Check your sector, size, and EU operations against the criteria above. Our NIS2 Readiness Check automates this screening.

Step 2: Conduct a gap assessment. Evaluate your current security posture against NIS2's 10 requirements. Identify what you already have in place and where the gaps are. Our readiness tool assesses you across all domains, or use the detailed NIS2 Compliance Starter Kit with 79 individual controls.

Step 3: Prioritize gaps. Not all gaps are equal. Focus first on incident response (the 24-hour timeline is unforgiving), governance (management liability is immediate), and supply chain security (your vendors may need time to come into compliance).

Step 4: Build your remediation roadmap. Create a 30/60/90-day plan with clear owners, budgets, and milestones. Present this to your management body — their formal approval is itself a NIS2 requirement.

Step 5: Implement and document. NIS2 compliance is not a one-time project. Implement your security measures, document everything, and establish ongoing monitoring and review processes. Use our Security Policy Generator to create the foundational documents you need.

The organizations that start now will be well-positioned as enforcement ramps up. Those that wait risk penalties, reputational damage, and the much higher cost of reactive compliance under pressure.

Frequently asked questions

Is NIS2 a regulation or a directive?

A directive. It does not apply directly: each member state transposes it into national law, and your obligations come from that law. Some countries add requirements or set stricter fines.

Does NIS2 apply to small companies?

Usually not. Small and micro organizations (fewer than 50 staff and turnover or balance sheet of no more than €10 million) are outside scope unless they fall under a size-independent rule in Article 2: for example DNS service providers, TLD registries, trust service providers, providers of public electronic communications, or an entity a member state designates because it is the sole provider of an essential service. Small companies are often affected indirectly, because in-scope customers must manage supply chain security and pass requirements on to suppliers.

What is the difference between essential and important entities?

Both must apply the same Article 21 measures and Article 23 reporting. The differences are supervision (proactive inspections and audits for essential entities, action after evidence of non-compliance for important ones) and the minimum level of the maximum fines (€10M or 2% versus €7M or 1.4%).

Do companies outside the EU have to comply?

Yes, if they provide services or carry out activities in the EU and fall within scope (Article 2(1)). Certain digital providers that are not established in the EU must designate a representative in a member state where they offer services (Article 26(3)).

How does NIS2 relate to DORA?

Under Article 4, where a sector-specific EU law requires cybersecurity risk-management measures or incident notification that are at least equivalent in effect, the corresponding NIS2 provisions, including supervision and enforcement, do not apply. DORA is such a law for financial entities. See our DORA compliance checklist.

NIS2 Directive Explained: What It Is, Who Must Comply and What It Requires