NIS2, explained without the legalese.

NIS2 is Directive (EU) 2022/2555. It replaced the original 2016 NIS directive, entered into force on 16 January 2023, and member states had to write it into national law by 17 October 2024 and apply it from 18 October 2024.

One thing matters more than anything else on this page: NIS2 is a directive, not a regulation. It does not bind your company directly. Your obligations come from your own country’s transposing law, and those laws diverge in real ways: different names for the categories, different reporting routes, different deadlines. Always work from your national act, not from the directive alone.

Transposition has been slow. In July 2026 the Commission referred four member states to the Court of Justice for still not having transposed it.

Two questions decide it: your sector and your size.

Sector. Annex I lists 11 "high criticality" sectors: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management (managed service and managed security providers), public administration, and space. Annex II adds 7 "other critical" sectors: postal and courier services, waste management, chemicals, food, manufacturing (medical devices, electronics, electrical equipment, machinery, motor vehicles, other transport equipment), digital providers (online marketplaces, search engines, social platforms), and research.

Size. Broadly you are in scope from medium-sized upward: at least 50 staff, or turnover above EUR 10 million and a balance sheet above EUR 10 million. You count as large at 250 staff or more, or turnover above EUR 50 million and a balance sheet above EUR 43 million. Partner and linked companies count toward your size, so a small subsidiary of a large group is often in scope.

Essential or important. Annex I entities above the size threshold are "essential". Everything else in scope is "important". The difference shows up in how you are supervised and in how large the fines can get.

Size does not always save you. Some entities are in scope whatever their size: DNS and TLD providers, trust service providers, providers of public electronic communications, public administration, and any company that is the sole provider in its country of a service that society or the economy depends on.

Governance. Your management body has to approve the risk-management measures, oversee them, and can be held liable for failures. Management must take training, and you have to offer training to staff regularly.

Risk management. Article 21 sets ten minimum measures: risk-analysis and information-system security policies; incident handling; business continuity and crisis management; supply-chain security; secure acquisition, development and maintenance, including vulnerability handling; procedures to assess whether your measures actually work; basic cyber hygiene and training; cryptography and encryption; human-resources security, access control and asset management; and multi-factor authentication and secured communications.

Incident reporting. This is the tightest clock: an early warning within 24 hours of becoming aware of a significant incident, a fuller notification within 72 hours, and a final report within one month. An incident is significant if it has caused, or could cause, severe operational disruption or financial loss, or considerable damage to others. Reporting does not by itself increase your liability.

Registration. Member states keep a list of the entities in scope, and most run a self-registration portal. Registration is usually what starts every other clock, which makes it the first thing to do rather than the last.

Essential entities face fines up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher. Important entities face up to EUR 7 million or 1.4%. Those ceilings attach specifically to failures on risk management (Article 21) and reporting (Article 23).

Management can be held personally liable. You may also have read that directors can be banned from managing the company. That is real, but much narrower than the marketing usually suggests: it applies to essential entities only, and only as a last resort, after other enforcement has failed and a remediation deadline has been missed. If you are an important entity, it does not apply to you at all.