What do you need to know about NIS2?

This guide splits the Directive into 12 parts in a fixed order: scope, sectors, management, measures, reporting, registration, enforcement, authorities, compliance, comparisons, countries and the Directive's own text.

The Directive has been in force since 16 January 2023, and its rules have applied through national law since 18 October 2024, the day after the transposition deadline of 17 October 2024 (Article 41(1)). An organisation therefore finds its duties in the national act of the Member State that has jurisdiction over it, while the Directive sets the floor that every national act must reach.

This page gives one line per part with the articles behind it: the size test with its "and" condition, the 10 minimum measures, the 24-hour, 72-hour and one-month reporting clock, and the fine maximums with their "whichever is higher" condition. It also sets out the dates from signature to the 2027 review and the status of the infringement procedures and the two pending proposals as of 23 October 2026. Short answers on the name, legal form and reach of NIS2 close the page.

What Is NIS2?

NIS2 is the second EU directive on the security of network and information systems: Directive (EU) 2022/2555, published in OJ L 333 of 27 December 2022 and in force since 16 January 2023, which sets a high common level of cybersecurity across the Union. The European Parliament and the Council signed it in Strasbourg on 14 December 2022 on the legal basis of Article 114 of the Treaty on the Functioning of the European Union (TFEU), and the act carries the label "Text with EEA relevance". Its title names the two acts it amends, Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and the act it repeals, Directive (EU) 2016/1148. The authentic text has the CELEX number 32022L2555 and is published on EUR-Lex.

The Directive consists of 144 recitals, 46 articles in 9 chapters and 3 annexes. Annex I lists the sectors of high criticality, Annex II the other critical sectors, and Annex III is the correlation table. Article 6 sets 41 definitions, from "network and information system" in point (1) and "security of network and information systems" in point (2) onwards. The term "significant incident" is not one of those 41 definitions: Article 23(1) and 23(3) define it.

A Directive That Binds Companies Through National Law

NIS2 is addressed to the Member States (Article 46), so an organisation is bound by the national law that transposes it, not by the Directive itself. For an entity in scope, NIS2 is mandatory through that national act: the duties to register, to manage risks and to report arise from the national provisions that implement Articles 3, 20, 21 and 23. These duties start on the day the national law applies, not on 17 October 2024, which was the Member States' deadline.

National laws may go further than the Directive. Article 5 makes NIS2 a minimum-harmonisation act, so Member States may adopt or maintain provisions that ensure a higher level of cybersecurity. Fines, authorities, registration portals and deadlines are therefore set nationally and differ between Member States. One act of the NIS2 family is directly applicable: Commission Implementing Regulation (EU) 2024/2690, which binds only the 11 entity types of Regulation (EU) 2024/2690, such as cloud computing service providers, managed service providers and trust service providers. Every other essential or important entity follows the list of measures in its national law.

What NIS2 Replaced and What It Changed

NIS2 repealed the first NIS Directive, Directive (EU) 2016/1148, with effect from 18 October 2024 (Article 44). NIS1 had applied since 10 May 2018. The Commission proposed its successor as COM(2020) 823 on 16 December 2020, and the Commission's Q&A on NIS2 dates the political agreement to 13 May 2022. The European Parliament adopted its first-reading position on 10 November 2022, and the Council adopted the act on 28 November 2022.

NIS2 changed six points of substance. The size-cap rule of Article 2(1) replaces the national identification of operators of essential services that NIS1 required by 9 November 2018 (NIS1 Article 5(1)). Two categories, essential and important entities, replace the NIS1 split into operators of essential services and digital service providers. Article 21(2) names 10 minimum measures, Article 23(4) sets a three-step reporting clock where NIS1 required notification "without undue delay", and Article 20 adds duties for management bodies. Article 34 sets fine maximums that each Member State must at least provide, where NIS1 left penalties entirely to national law (NIS1 Article 21). Each difference is set out in NIS2 vs NIS1.

Where NIS2 Stands on 2026-10-23

As of 23 October 2026, NIS2 has applied through national law since 18 October 2024, no amending act has been adopted, and on 8 July 2026 the European Commission decided to refer Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for failing to notify measures transposing NIS2. The five status points below are dated and name their source.

1. Transposition: Member States had to adopt and publish their transposing laws by 17 October 2024 (Article 41(1)). Each national law, its authority and its status as of 23 October 2026 sits in the NIS2 transposition tracker.
2. Infringements: the Commission sent letters of formal notice to 23 Member States on 28 November 2024 (INF/24/5988) and reasoned opinions to 19 Member States on 7 May 2025. With the four referrals it requested a lump sum and daily penalties (IP/26/1499).
3. Targeted amendment: the Commission proposed COM(2026) 13 (procedure 2026/0012(COD)) on 20 January 2026. The proposal is pending, with the European Parliament procedure at "Awaiting committee decision" as of 23 October 2026 (OEIL). The Commission estimated in January 2026 (IP/26/105) that it would ease compliance for 28,700 companies, including 6,200 micro and small enterprises; the pending changes are tracked under NIS2 amendments and review.
4. Digital Omnibus: the Commission proposed COM(2025) 837 (procedure 2025/0360(COD)) on 19 November 2025. It is pending as of 23 October 2026, and Coreper agreed the Council mandate for negotiations on 21 October 2026.
5. Next fixed dates: Member States notify the next entity numbers to the Commission by 17 April 2027 (Article 3(5)), and the Commission reviews the Directive by 17 October 2027 (Article 40); every date sits in the NIS2 timeline.

The Twelve Parts of NIS2, One Page Each

This guide splits NIS2 into twelve parts, and each part has one reference page: scope, sectors, management, measures, reporting, registration, enforcement, authorities, compliance, comparisons, countries and the Directive itself. The same order runs through the site navigation. The legal text and its structure are on the Directive page, while the explanations are on the eleven other part pages listed in Table 1.

Which Organisations Fall Under the Directive

NIS2 covers public and private entities of a type listed in Annex I or Annex II that are at least medium-sized and provide services or carry out activities in the Union, plus a short list of entity types covered at any size. Type and size are tested together: a large company of an unlisted type is outside NIS2 altogether. The indicative answer for one organisation, with the legal basis for each step, comes from the scope check at the top of this page.

The Default Size Test: Medium-Sized or Larger

Article 2(1) applies NIS2 to entities that qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC, or exceed those ceilings. An entity is at least medium-sized when it employs 50 or more persons, or when its annual turnover exceeds EUR 10 million and its annual balance sheet total also exceeds EUR 10 million. The "and" between the two financial values matters: a company with 30 staff, EUR 12 million turnover and a balance sheet of EUR 8 million stays below the ceilings, because only one financial value is exceeded.

Group figures count as well. Under Article 3 and Article 6(2) of the Annex to the Recommendation, the figures of partner enterprises (holdings of 25 % or more) are added pro rata, and the figures of linked enterprises (majority control) are added at 100 %. A status change takes effect only after two consecutive accounting periods (Annex Article 4(2)). The public-ownership rule of Article 3(4) of that Annex does not apply for NIS2 (Article 2(1), second subparagraph), so public ownership alone never makes an entity large.

Organisations Covered at Any Size

Articles 2(2) to 2(4) bring a group of entity types under NIS2 regardless of size, and five of them are essential at any size: qualified trust service providers, top-level domain name registries, DNS service providers, central government public administration and critical entities under the CER Directive. The first three follow from Article 3(1)(b), central government from Article 3(1)(d) and critical entities identified under Directive (EU) 2022/2557 from Articles 2(3) and 3(1)(f).

Domain name registration service providers form a sixth case: they are in scope regardless of size (Article 2(4)) but are not classified as essential or important by Article 3. Two limits and one option complete the scope rules. Public administration entities that work in national security, public security, defence or law enforcement are excluded (Article 2(7)), while judiciaries, parliaments and central banks are not public administration entities (Article 6(35)). Member States may also extend their law to local public administration and to education institutions (Article 2(5)).

Two Categories, the Same Duties

NIS2 sorts entities into essential and important entities, and both carry the same obligations under Articles 20, 21 and 23; the difference lies in supervision and in the maximum fine. Essential entities are the Annex I entities that exceed the medium-sized ceilings, which means 250 or more persons, or annual turnover above EUR 50 million and a balance sheet total above EUR 43 million (Article 3(1)(a)), plus the any-size types of the previous section. Member States may also designate entities as essential (Article 3(1)(e)).

Important entities are every other entity in scope: medium-sized Annex I entities and all Annex II entities, unless a Member State designates them as essential (Articles 3(1)(e) and 3(2)). Small and micro providers of public electronic communications networks or services are important entities (Article 3(1)(c) and 3(2)). Annex position alone therefore never decides the category: a large Annex II manufacturer is an important entity, and a medium-sized Annex I hospital is important too. Lighter obligations do not follow from the important category; a lighter supervisory regime does.

Eighteen Sectors in Two Annexes

NIS2 lists 18 sectors: 11 sectors of high criticality in Annex I and 7 other critical sectors in Annex II. Banking and financial market infrastructures are Annex I sectors, but DORA (Regulation (EU) 2022/2554) applies to financial entities as the sector-specific act under Article 4, which displaces the NIS2 rules on management, measures, reporting and supervision while Articles 7, 9 and 16 still apply. Table 2 gives the 18 sectors in the order of the annexes.

Sectors of Directive (EU) 2022/2555, Annexes I and II.

The three scope pages below explain the categories and the size test in detail.

• essential entities under NIS2: the Annex I route above the medium-sized ceilings, the any-size types and designation.
• important entities under NIS2: Annex II entities, medium-sized Annex I entities and ex post supervision.
• NIS2 size thresholds and the size-cap rule: headcount, turnover, balance sheet and the group figures.

What Entities Must Do

Every essential and important entity has four core duties under its national law: management approval and oversight, the minimum risk-management measures, incident reporting and registration. The Directive sets these four duties in Articles 20, 21, 23 and 3(4), and the national act repeats them with its own section numbers. The 11 types of Article 26(1)(b), which include domain name registration services, carry one additional registry duty under Article 27, and the 11 entity types of Regulation (EU) 2024/2690 follow detailed technical rules.

Board Approval, Oversight and Training

Under Article 20(1), the management body approves the cybersecurity risk-management measures, oversees their implementation and can be held liable for infringements. The approval covers the measures that Article 21 requires, so the board of an entity in scope signs off the measures and remains answerable for them.

Members of management bodies are required to follow training under Article 20(2), and entities are encouraged to offer similar training to their employees on a regular basis. The Directive sets no frequency, no duration and no exam for that training. Recital 128 adds that the Directive requires no civil or criminal liability of natural persons towards third parties, and Article 34 fines the entity, not its managers, so personal fines exist only where a national law creates them.

Ten Minimum Security Measures, Points (a) to (j)

Article 21(1) requires appropriate and proportionate technical, operational and organisational measures, and Article 21(2) names at least 10 of them, points (a) to (j), based on an all-hazards approach. Proportionality depends on four factors: the entity's degree of exposure to risks, its size, the likelihood of incidents and their severity, including their societal and economic impact. The 10 measures of Article 21(2) are listed below in the Directive's wording.

1. (a) Policies on risk analysis and information system security.
2. (b) Incident handling.
3. (c) Business continuity, such as backup management and disaster recovery, and crisis management.
4. (d) Supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers.
5. (e) Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure.
6. (f) Policies and procedures to assess the effectiveness of cybersecurity risk-management measures.
7. (g) Basic cyber hygiene practices and cybersecurity training.
8. (h) Policies and procedures regarding the use of cryptography and, where appropriate, encryption.
9. (i) Human resources security, access control policies and asset management.
10. (j) The use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate.

Supply chain security under point (d) covers the entity's direct suppliers or service providers; the suppliers themselves are not directly obliged by NIS2. An entity that finds it does not comply with these measures takes all necessary corrective measures without undue delay (Article 21(4)), and the Directive fixes no number of days for that correction.

Three Incident Reports on a Fixed Clock

An entity reports a significant incident in three stages: an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours and a final report not later than one month after the notification (Article 23(4)(a), (b) and (d)). Between the second and the third report, the CSIRT or the competent authority may request an intermediate report (Article 23(4)(c)). Only significant incidents must be reported (Article 23(1)). An incident is significant when it has caused or is capable of causing severe operational disruption of the services or financial loss for the entity, or considerable material or non-material damage to other persons (Article 23(3)(a) and (b)). Notifications of other incidents, cyber threats and near misses are voluntary (Article 30(1)(a)).

The reports go to the entity's CSIRT or, where applicable, its competent authority (Article 23(1)), never to ENISA, which receives only the summary reports of the single points of contact every three months (Article 23(9)). Trust service providers send the incident notification within 24 hours instead of 72 hours for significant incidents that affect their trust services (Article 23(4), second subparagraph).

Registering With the National Authority

Each entity submits its name, address and contact details including email, IP ranges and telephone numbers, its sector and subsector, and the Member States it serves to the competent authority or national channel (Article 3(4)), and reports changes within two weeks. Member States had to establish their lists of essential and important entities by 17 April 2025 and review them at least every two years (Article 3(3)). The list records who is covered; it does not decide scope, which follows from Articles 2 and 3.

The 11 types of Article 26(1)(b), such as DNS service providers, domain name registration services and cloud computing service providers, also submit the registry data of Article 27 to their competent authority. That data was due by 17 January 2025, and changes follow within three months (Article 27(3)). The single point of contact forwards the data to ENISA's registry, except the IP ranges (Article 27(4)), so entities never register with ENISA directly.

Detailed Rules for Eleven Digital Entity Types

For 11 digital entity types, Commission Implementing Regulation (EU) 2024/2690 sets the technical and methodological requirements of the Article 21 measures and the cases in which an incident is significant, and it has applied directly since 7 November 2024. The 11 entity types of Regulation (EU) 2024/2690 are DNS service providers, top-level domain name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking platforms and trust service providers (Article 1). The jurisdiction list of Article 26(1)(b) differs by one entry each way: it includes domain name registration services and leaves out trust service providers. Those 11 types fall under the Member State of their main establishment in the Union, and those not established in the Union designate a representative there (Article 26(3)).

The Regulation sets a financial threshold for a significant incident: a direct financial loss above EUR 500,000 or 5 % of total annual turnover, whichever is lower (Article 3(1)(a)). Its Annex requires the security policy to be reviewed at least annually (point 1.1.2) and the risk assessment and treatment plan at least annually (point 2.1.4). The four pages below take each duty further.

• NIS2 management liability: accountability of the management body under Article 20(1) and the national rules.
• what counts as a significant incident: Article 23(3) and the thresholds of Regulation (EU) 2024/2690.
• Implementing Regulation (EU) 2024/2690: the Annex requirements for the 11 entity types of the Regulation.
• NIS2 checklist mapped to the articles: readiness questions for each obligation.

Supervision, Penalties and Personal Accountability

National competent authorities supervise NIS2 entities, and the Directive sets the tools they must have, the maximum fines and the cases in which managers can be held to account. Articles 31 to 33 set the supervisory powers, Article 34 the fines and Article 32(5) the temporary ban on management functions.

Two Supervisory Regimes: Ex Ante and Ex Post

Essential entities are supervised ex ante and ex post (Article 32), important entities only ex post, when evidence, an indication or information suggests a breach (Article 33). For essential entities, the toolbox includes regular and targeted security audits carried out by an independent body or a competent authority, and ad hoc audits (Article 32(2)(b) and (c)). The audited entity pays for a targeted audit by an independent body, except in duly substantiated cases when the competent authority decides otherwise (Article 32(2), third subparagraph, and Article 33(2), third subparagraph).

For essential entities only, the authority may ask a body, court or tribunal to impose a temporary ban on exercising managerial functions at chief executive officer or legal representative level (Article 32(5)(b)). That step comes only after other enforcement measures have failed and a deadline has passed, it lasts until the entity remedies the breach, and it does not apply to public administration entities.

Maximum Administrative Fines

Member States must provide fines of a maximum of at least EUR 10,000,000 or 2 % of total worldwide annual turnover, whichever is higher, for essential entities (Article 34(4)), and at least EUR 7,000,000 or 1.4 %, whichever is higher, for important entities (Article 34(5)). The turnover is that of the undertaking in the preceding financial year. These maximums apply to infringements of Article 21 or Article 23, and a national law may set higher caps or add conditions, so the cap an entity faces is the one in its national act.

Penalties for failing to register come from national law, because Article 36 leaves their amount to the Member States. The fines page explains how national laws apply the Article 34 maximums.

• NIS2 fines and how Member States apply them: the Article 34 maximums and their national application.

Who Supervises and Coordinates: National Authorities and EU Bodies

Each Member State designates one or more competent authorities and a single point of contact (Article 8), crisis management authorities (Article 9) and one or more CSIRTs (Article 10), and three EU networks connect them. The competent authorities supervise and fine entities, the cyber crisis management authorities are responsible for large-scale cybersecurity incidents and crises (Article 9(1)), and the CSIRTs receive the incident reports of Article 23(1). Article 13 requires the competent authorities, the single point of contact and the CSIRTs to cooperate at national level.

The three EU networks bring these national bodies together. The Cooperation Group consists of the Member States, the Commission and ENISA, is chaired by the Council Presidency and has 19 tasks (Article 14). The CSIRTs network joins the national CSIRTs and CERT-EU (Article 15), and EU-CyCLONe, the European cyber crisis liaison organisation network, joins the cyber crisis management authorities (Article 16).

ENISA, the EU Agency for Cybersecurity, maintains the Article 27 registry and develops and maintains the European vulnerability database (Article 12(2)). It has no supervisory or fining powers over entities under NIS2; national competent authorities supervise them. Which Member State supervises an entity follows from Article 26: the Member State of establishment as the general rule, every Member State of service for telecom providers, and the Member State of main establishment for the 11 types of Article 26(1)(b).

Key Dates from Signature to the 2027 Review

NIS2 runs on fixed dates: signature on 14 December 2022, entry into force on 16 January 2023, transposition by 17 October 2024 and application from 18 October 2024, with the Commission's review due on 17 October 2027. The date of 17 October 2024 bound the Member States; an entity's duties start when its national law applies. Table 3 lists the ten dates of the Directive and its implementing act.

NIS2 Next to Other Laws, Standards and Non-EU Rules

NIS2 sits next to sector rules, voluntary standards and the cybersecurity laws of non-EU countries, and Article 4 decides when a sector-specific EU act takes over parts of NIS2. DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025 and is that sector-specific act for financial entities. Critical entities under the CER Directive are essential entities under NIS2 regardless of size. An ISO/IEC 27001 certificate is not legal proof of compliance with Article 21.

Product security for hardware and software falls under the Cyber Resilience Act (Regulation (EU) 2024/2847), whose reporting obligations under Article 14 have applied since 11 September 2026; it is covered on cyberresilienceactguide.net.

The NIST Cybersecurity Framework 2.0 is a voluntary US framework, not a law, and NIS2 does not name it. NIS2 does not apply as UK law: the Network and Information Systems Regulations 2018 (SI 2018/506) apply there, and the Cyber Security and Resilience (Network and Information Systems) Bill is pending without Royal Assent as of 23 October 2026. The four comparison pages below cover these questions.

• NIS2 vs DORA: what DORA displaces for financial entities and what still applies.
• NIS2 vs ISO/IEC 27001: where the standard supports the Article 21 measures and where it stops.
• NIS2 vs the NIST Cybersecurity Framework 2.0: the closest US reference point, a voluntary framework.
• NIS2 and the United Kingdom: the NIS Regulations 2018 and the pending Bill.

NIS2 FAQ

Short answers to the six questions asked most often about the name, legal form and reach of NIS2.

What Does NIS2 Stand For?

NIS2 stands for the second Directive on network and information systems: the act's own short title is "NIS 2 Directive", and NIS1's title was about the security of network and information systems. Article 6(2) defines that security as the ability of network and information systems to resist, at a given level of confidence, any event that may compromise the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or of the services offered by, or accessible via, those systems.

This definition and the 40 others of Article 6 are listed in the NIS2 glossary.

What Is the Full Name of the NIS2 Directive?

The full name is "Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)". The German text calls it the "NIS-2-Richtlinie" and the French text the "directive SRI 2".

Is NIS2 a Regulation or a Directive?

NIS2 is a directive, not a regulation: it is addressed to the Member States (Article 46) and reaches organisations through national law. The regulation in the NIS2 family is Commission Implementing Regulation (EU) 2024/2690, which applies directly, but only to the 11 entity types of Regulation (EU) 2024/2690.

Is NIS2 the Same in Every Member State?

No: NIS2 sets minimum rules (Article 5), so national laws may go further, and the entity follows the law of the Member State that has jurisdiction over it (Article 26). Fines above the Article 34 floor, the competent authorities and the registration portals are set by each national law, which is why the transposition status and the authority are recorded country by country.

Is There an Official NIS2 Standard or Certificate?

No EU-wide NIS2 certificate for organisations exists; Article 24(1) only lets Member States require certified ICT products, services and processes. No official approval of tools or providers exists either, because Article 25(1) keeps NIS2 technology-neutral.

The certification schemes and their limits are compared under whether a NIS2 certification exists.

Does ENISA Supervise Companies?

No: ENISA has no supervisory or fining powers over entities under NIS2; national competent authorities supervise them (Articles 31 to 33). ENISA receives the Article 27 data from the single points of contact and their summary reports, never incident reports from entities.