The EU NIS2 Directive: scope, duties and where implementation stands

What it is

The Network and Information Security Directive 2 (NIS2) replaced the original 2016 NIS Directive. It entered into force in January 2023, and member states had to transpose it into national law by 17 October 2024, when the old directive was repealed. As a directive, it sets goals and minimum rules; each country writes its own law, names its authorities and sets some details. Organisations therefore comply with national legislation, for example in Germany, Ireland or Belgium, rather than with the directive directly.

Why it matters

The first NIS Directive covered a limited set of operators and was applied inconsistently. NIS2 greatly expands scope, harmonises obligations and adds real enforcement. Tens of thousands of organisations across the EU are now covered, including many medium-sized companies that had never faced cybersecurity regulation. Non-EU companies that provide services in the EU, such as cloud and data centre providers, can also be in scope. For IT and network engineers, NIS2 is a major reason for new budgets, audits and reporting procedures.

Key ideas

• Scope. Eighteen sectors, adding to the original list areas such as public electronic communications, digital services, waste water and waste management, manufacturing of critical products, postal and courier services, public administration and space. As a general rule, medium and large entities in these sectors are covered, with some exceptions regardless of size (such as DNS service providers and top-level domain registries).
• Risk management measures (Article 21). An all-hazards approach covering at least: risk analysis and policies; incident handling; business continuity and crisis management; supply chain security; secure acquisition, development and maintenance, including vulnerability handling; assessing effectiveness; cyber hygiene and training; cryptography; HR security and access control; and multi-factor authentication or continuous authentication where appropriate.
• Incident reporting (Article 23). For significant incidents: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month, to the national CSIRT or competent authority.
• Management accountability. Management bodies must approve the measures, oversee them and undergo training. They can be held liable for failures.
• Enforcement. Fines up to at least 10 million euros or 2 per cent of worldwide turnover for essential entities, and 7 million euros or 1.4 per cent for important entities.

What changed recently

Implementation was slow. Few member states met the October 2024 deadline, and the Commission opened infringement procedures. By late May 2026, reporting indicated that only four member states had not yet transposed NIS2; Luxembourg’s law, for example, entered into force in May 2026. A Commission implementing regulation adopted in October 2024 sets detailed technical requirements and significance thresholds for digital infrastructure and digital service providers, such as cloud, data centre, DNS and managed service providers. On 20 January 2026 the Commission proposed targeted amendments to NIS2 to increase legal clarity, align it with a revised Cybersecurity Act and simplify compliance, with the stated aim of easing burdens for many thousands of companies, including small enterprises. These amendments still have to pass the EU legislative process.

How practitioners apply it

1. Confirm scope and registration under each relevant national law, including subsidiaries in different countries.
2. Gap-assess against Article 21, often using ISO/IEC 27001 or NIST CSF 2.0 as the working framework. ENISA has published technical implementation guidance that maps requirements to evidence.
3. Build the reporting process: severity criteria, who decides, templates and a tested path to the national CSIRT that can meet the 24-hour early warning, aligned with incident response planning.
4. Strengthen supply chain security: supplier inventories, contract clauses and assessment of critical ICT providers.
5. Brief and train the board, and record its approvals.
6. Implement technical basics that auditors check first: MFA, logging, backups, patching and network segmentation (see IT risks and law).

Tip: If you operate in several EU countries, national laws differ in registration rules, reporting portals and some thresholds. Keep a country-by-country register rather than assuming one approach fits all.

Organisations outside the EU, including in the Gulf and South Asia, often feel NIS2 indirectly. An EU customer in scope must manage supply chain risk, so it passes security clauses, questionnaires and incident notification duties down to its IT and managed service suppliers. Being able to show an ISO/IEC 27001 certificate, a documented incident process and MFA across administrative access makes these conversations much easier.

Limitations and open questions

• Fragmentation. Transposition differences undermine the goal of harmonisation, especially for multinational groups.
• Overlaps with sector rules such as DORA for financial services, the Cyber Resilience Act and the Critical Entities Resilience Directive create duplicated reporting.
• Supervisory capacity. National authorities must supervise far more entities than before, with limited staff.
• Pending amendments mean some details, especially for smaller entities, may change again.