Editorial policy: NIS2 Guide

The site explains the NIS2 Directive, its national laws and entity classification for compliance managers, management bodies and counsel. How the law itself is built is explained under NIS2 Directive on the home page.

Independence and No Paid Placement

No company pays nis2guide.net for placement, mention, ranking or coverage, and no provider, vendor or consultancy is named, ranked or recommended anywhere on the site. The editorial team alone decides topics and wording. Prices appear only as dated public-record figures, such as the cost estimates of the Commission's 2020 impact assessment (SWD(2020) 345) or of Bundestag Drucksache 21/1501, and never as a current price or a quote.

The site carries no advertising. It is funded through the provider match described in the next section, and that funding never decides coverage, wording or sources.

How Provider Requests Are Disclosed

The provider match passes a reader's request to independent NIS2 consultants, auditors, training providers, ISMS and GRC software vendors and managed security service providers who work on the topic, and the reader decides whether to engage any of them.

The form invitation reads "Describe what you need and we pass your request to independent NIS2 providers who work on this." The disclosure line under it reads "Requests go to independent providers. No company pays for placement; see our editorial policy." A request goes only where the reader sends it, with no promised response time or number of offers.

Provider forms never call a provider qualified, certified (except in a scheme name), vetted, approved, verified, recommended, preferred, a partner or the best, and never promise legal advice or a compliance result. What an entity has to put in place is set out under NIS2 compliance requirements.

Which Sources the Content Rests On

Every legal value on nis2guide.net comes from a primary source: EUR-Lex and the Official Journal for EU law, the national gazette for a national law, and the competent authority or CSIRT for registration, reporting and guidance. Articles are cited as the act numbers them ("Article 23(4)(b)", "§ 32 BSIG"). The Directive is addressed to the Member States (Article 46) and is never called a regulation; Implementing Regulation (EU) 2024/2690 is directly applicable only to the 11 entity types listed in its Article 1.

The source types below decide where a value comes from and how its link is treated.

A newer official text replaces an earlier value. Secondary summaries, such as the Commission's per-country NIS2 pages of July 2025, never supply a current national status.

How Dated Status and Updates Are Handled

Every statement that can change carries its date: transposition status, infringement steps, portal dates and pending proposals are written "as of" the day they were last checked, and each page shows when it was last reviewed. National status differs by country because the Directive applies through national law from 18 October 2024 (Article 41(1)).

A page is reviewed when a national law is amended, the Commission adopts an implementing act, an EU amending act is adopted, ENISA publishes guidance or an infringement procedure moves a step. The dated transposition status of each Member State is kept in the NIS2 transposition tracker.

A proposal stays "proposed" or "pending" until adopted, always with its stage and date. As of 23 October 2026, COM(2026) 13 of 20 January 2026 is pending (European Parliament: "Awaiting committee decision"), and the Digital Omnibus COM(2025) 837 is pending after Coreper agreed the Council mandate on 21 October 2026. Neither is called "NIS3".

How Corrections Are Made

Errors are corrected on the page they appear on, and the "Last reviewed" line under the byline moves to the date of the correction. A correction covers a wrong legal value, date or article reference, or a status overtaken by a newer official text.

Readers report an error to editorial@nis2guide.net or through the contact form. A useful report names the page, quotes the sentence and, where possible, links the official source. The address and the form are on the contact page.

Every report is checked against the primary source, not against another secondary page, and the official text decides.

Explanation of the Law, Not Legal Advice

nis2guide.net explains what NIS2 and the national laws require and how classification works, but it does not give legal advice and never tells a named organisation that it is or is not in scope.

An organisation's obligations follow from its national law, so a final assessment belongs to its own counsel or the competent authority. The scope check gives an indicative result, not a decision: the NIS2 scope check shows the legal basis answer by answer.

Which Outbound Links Are Followed

Outbound links are followed only when they point to an official or primary source: EUR-Lex and EU institutions, ENISA, national gazettes, competent authorities and CSIRTs, standards bodies (ISO, IEC, CEN) and peer-reviewed publishers. The three source types below carry nofollow.

• Law firms
• Vendors and consultancies
• News sites

No outbound link points to a page that competes for the same topic.

How This Policy Relates to the Other Trust Pages

This editorial policy sets the rules; four other pages explain how facts are checked, who publishes the site, how to reach the team and how form data is handled. The four pages are listed below.

• methodology and fact-checking: how each value is checked
• about NIS2 Guide: who publishes the site and why
• contact NIS2 Guide: corrections and questions
• privacy: form data and newsletters

Who Writes and Publishes the Content

The NIS2 Guide Editorial Team writes every page, and nis2guide.net is the publisher. No individual author or outside expert is named, and no expert review is claimed.

Form Data, Analytics and Newsletters

nis2guide.net uses no analytics or advertising vendors. Form data is kept for 24 months and newsletter addresses until the reader unsubscribes; the privacy notice sets out the detail.