NIS2 compliance: what the directive requires, who is in scope, and where to start

NIS2 compliance means meeting the duties Directive (EU) 2022/2555 sets, through national law, for medium-sized and larger entities in 18 sectors: registration, management body approval and training, ten minimum risk-management measures, and incident reporting within 24 hours. The directive has applied since 18 October 2024. Essential entities face maximum fines of at least €10 million or 2% of worldwide turnover.

This guide covers what NIS2 is, who is in scope, what you must do, supervision and fines, national laws, sector guides, the 2026 proposals, a 90-day plan, what the law leaves open, and a checklist.

Obligation	NIS2	Who	Deadline or cadence	Detail
Check scope and category	Art. 2, 3	Annex I and II types, medium-sized or larger, plus size-independent cases	When size, group or services change	Scope check
Register	Art. 3(4), 27	All in scope; listed digital providers also for ENISA’s registry	Changes within two weeks (registry: three months)	Finding your authority
Approve, oversee, train	Art. 20	Management body	No frequency set	Board duties
Ten minimum measures	Art. 21	All in scope	Continuous; fix gaps without undue delay	The ten measures
Supply chain security	Art. 21(2)(d), 21(3)	All in scope	Per direct supplier	Supplier risk
Report significant incidents	Art. 23	All in scope	24 hours, 72 hours, one month	Reporting timeline
Certified ICT products	Art. 24	Where national law or a delegated act requires	As required	Certification
Supervision	Art. 32, 33	Essential: proactive. Important: after the fact	On request	Essential vs important
Fines	Art. 34	All in scope	Maximum of at least €10M or 2% (important: €7M or 1.4%)	Fines
Domain registration data	Art. 28	TLD registries, domain registration services	Access requests answered within 72 hours	Article 28

What is NIS2, and when did it start to apply?

NIS2 is Directive (EU) 2022/2555 of 14 December 2022 “on measures for a high common level of cybersecurity across the Union”. It replaced NIS1, Directive (EU) 2016/1148.

Date	What happened
16 January 2023	NIS2 entered into force
17 October 2024	Deadline for Member States to adopt and publish national laws (Art. 41)
18 October 2024	National laws apply; NIS1 repealed (Art. 41, 44)
17 April 2025	Member States’ lists of essential and important entities due (Art. 3(3))

A directive binds Member States, not companies: your obligations come from national law. Many countries were late. On 7 May 2025 the Commission sent reasoned opinions to 19 Member States. On 8 July 2026 it referred four that had still not notified full transposition to the Court of Justice: Ireland, Spain, France and the Netherlands. Check that your country’s law is in force before relying on its detail.

The biggest change from NIS1 is scope. NIS1 left each country to identify its operators of essential services; NIS2 applies by sector and size. It also adds minimum measures, management duties, a 24-hour first report and minimum fine ceilings. The comparison is in NIS1 vs NIS2.

Who has to comply with NIS2?

Under Article 2(1), the entity must be of a type listed in Annex I or II, be at least medium-sized under Recommendation 2003/361/EC, and provide services or carry out activities in the EU.

Medium-sized starts at 50 staff, or at turnover and balance sheet total both above €10 million. Staff count in annual work units, and linked and partner enterprise data is added, so a small subsidiary of a large group can be in scope. The NIS2 scope checker gives a first answer. Near the 50-person line, read NIS2 for SMEs, which also explains why out-of-scope suppliers are asked anyway.

Which sectors does NIS2 cover?

• Annex I, 11 sectors of high criticality: energy (electricity, district heating and cooling, oil, gas, hydrogen), transport (air, rail, water, road), banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business to business), public administration, and space.
• Annex II, 7 other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing (medical devices and in vitro diagnostics, and NACE divisions C26 to C30), digital providers (online marketplaces, search engines, social networking platforms), and research.

The legal definition of each entity type decides, not your industry label.

Who is covered regardless of size?

Article 2(2) to (4) brings in public electronic communications providers; trust service providers, TLD name registries and DNS service providers; domain name registration services; critical entities under the CER Directive, (EU) 2022/2557; central government bodies, and regional ones after a risk-based assessment; and entities a Member State identifies, for example as the sole national provider of an essential service.

Public administration in national security, public security, defence or law enforcement is excluded (Article 2(7)). Where another EU act imposes at least equivalent risk-management or incident-reporting requirements, the relevant NIS2 provisions do not apply (Article 4(1)); recital 28 names DORA for financial entities.

Essential or important?

Essential entities are mainly Annex I entities above the medium-sized ceilings: 250 or more staff, or turnover above €50 million and balance sheet above €43 million. Also essential (Article 3(1)): qualified trust service providers, TLD registries and DNS service providers of any size, medium-sized public telecoms providers, central government, CER critical entities, and entities a Member State identifies as essential. Every other in-scope Annex I or II entity is important. The obligations are the same; supervision and maximum fines differ.

Which country’s law applies?

As a rule, the Member State where the entity is established (Article 26). Public telecoms providers answer to each Member State they serve. Cloud, data centre, CDN, DNS, TLD, managed service, managed security service and online platform providers answer to their main establishment, where cybersecurity risk-management decisions are predominantly taken. See NIS2 jurisdiction.

Do you have to register?

Yes, in practice. Article 3(4) requires entities to give their authority their name, address and contact details including IP ranges, their sector and subsector, and the Member States they serve. Changes are due within two weeks. Member States may run this as self-registration. Listed digital providers also submit data for ENISA’s registry (Article 27). Do not wait for the authority to contact you.

What does NIS2 require you to do?

Article 20: management body duties and training

The management body approves the Article 21 measures, oversees their implementation and can be held liable for the entity’s infringements of Article 21. Its members must follow training, and Member States encourage entities to offer similar training to employees regularly. NIS2 sets no syllabus, hours or frequency; national law may. See NIS2 training requirements.

Article 21: the ten minimum measures

Article 21(1) requires appropriate and proportionate technical, operational and organisational measures, taking into account the state of the art, relevant European and international standards where applicable, and the cost of implementation. Proportionality weighs your exposure, size, and the likelihood and severity of incidents.

The measures follow an all-hazards approach that also protects the physical environment of your systems, so fire and power failure count as well as attackers (see the all-hazards approach). Article 21(2) requires at least:

• (a) policies on risk analysis and information system security;
• (b) incident handling;
• (c) business continuity, such as backup management and disaster recovery, and crisis management;
• (d) supply chain security;
• (e) security in acquisition, development and maintenance, including vulnerability handling and disclosure (see coordinated vulnerability disclosure);
• (f) policies and procedures to assess the effectiveness of the measures;
• (g) basic cyber hygiene practices and cybersecurity training;
• (h) cryptography and, where appropriate, encryption (see NIS2 encryption requirements);
• (i) human resources security, access control policies and asset management;
• (j) multi-factor or continuous authentication, secured voice, video and text communications and secured emergency communication systems, where appropriate.

Gaps you find need corrective measures without undue delay (Article 21(4)). For DNS, TLD, cloud, data centre, CDN, managed and managed security service providers, online platforms and trust service providers, Implementing Regulation (EU) 2024/2690 sets detailed technical requirements.

Article 21(3): the supply chain

Measure (d) covers the security aspects of your relationships with direct suppliers and service providers. Article 21(3) requires you to take into account each direct supplier’s specific vulnerabilities, the quality of its products and cybersecurity practices, including secure development, and the results of EU coordinated risk assessments under Article 22. In practice, one generic questionnaire sent to every vendor does not show that. This is also how NIS2 reaches small suppliers that are out of scope: through their customers’ contracts.

Article 23: incident reporting

A significant incident has caused, or can cause, severe operational disruption or financial loss for the entity, or considerable material or non-material damage to others (Article 23(3)). How to decide fast is in what makes an incident significant. Reports go to your CSIRT or competent authority:

1. Early warning, within 24 hours of becoming aware: whether the incident looks unlawful or malicious, and whether it could have cross-border impact, where applicable.
2. Incident notification, within 72 hours of becoming aware: an initial assessment of severity and impact, and indicators of compromise where available. Trust service providers send it within 24 hours.
3. Intermediate report, if the CSIRT or authority asks.
4. Final report, no later than one month after the notification. If the incident is still ongoing, a progress report then, and a final report within one month of handling it.

Where appropriate, you also tell the recipients of your services without undue delay (Article 23(1)). Ransomware that stops a core service is the textbook case: see NIS2 and ransomware. If personal data is involved, a separate GDPR notification may be due: see NIS2 and GDPR.

Articles 24 and 25: certification and standards

There is no NIS2 certificate for companies. Member States may require ICT products, services and processes certified under European schemes adopted under the Cybersecurity Act, to show compliance with particular Article 21 requirements. The Commission may do so for categories of entities by delegated act (Article 24). A “NIS2 certificate” sold as a product is the seller’s own attestation.

Article 25 has Member States encourage European and international standards, without imposing or favouring a particular technology. ISO/IEC 27001 is the usual choice. It covers most of Article 21, but not the reporting clock, registration or management liability: see ISO 27001 vs NIS2.

How is NIS2 supervised, and what are the fines?

Enforcement is national, by the competent authorities each Member State designates.

Essential entities (Article 32) can be supervised without any trigger: inspections, random checks, regular, targeted and ad hoc audits, security scans, and requests for information and evidence of implementation. Important entities (Article 33) are supervised after the fact, on evidence, indication or information of non-compliance, with targeted audits but no random checks, regular or ad hoc audits.

Against both, authorities can issue warnings, binding instructions and orders. For essential entities only, they can designate a monitoring officer and, as a last resort, temporarily suspend a certification or authorisation and ask a court or other body to bar a person at chief executive or legal representative level temporarily from managerial functions (Article 32(5)). The people who represent, decide for or control an entity can be held liable for failing to ensure compliance (Articles 32(6) and 33(5)).

For infringements of Article 21 or 23, Article 34 requires maximum fines of at least:

• essential entities: €10 million or 2% of total worldwide annual turnover of the undertaking, whichever is higher;
• important entities: €7 million or 1.4%, whichever is higher.

There is no higher NIS2 tier: €20 million or 4% is GDPR. A GDPR fine for the same conduct rules out a NIS2 fine (Article 35). Penalties for other breaches, such as failing to register, are set nationally (Article 36).

Which national NIS2 laws apply?

The binding text is your country’s law. Luxembourg’s Law of 5 May 2026 has applied since 10 May 2026 (NIS2 in Luxembourg); registration with the ILR was due by 10 July 2026, and incidents go through SERIMA. Belgium’s Law of 26 April 2024 has applied since 18 October 2024, with the CCB as authority; essential entities had to show a first step on a CyberFundamentals, ISO/IEC 27001 or inspection route by 18 April 2026 (NIS2 in Belgium). Germany’s implementation act of 2 December 2025 (BGBl. 2025 I Nr. 301) enacted a new BSIG, in force since 6 December 2025, and entities register through the BSI portal (NIS2 in Germany).

Which sector guides apply to you?

• Energy: electricity, gas, oil, hydrogen, heating
• Transport: air, rail, water and road
• Banking and financial market infrastructures: NIS2 and DORA
• Health: hospitals, labs and pharma
• Digital infrastructure: cloud, data centres, DNS, CDNs
• ICT service management: MSPs and MSSPs
• Manufacturing: NACE C26 to C30 and medical devices
• Food: wholesale, processing, production
• Telecoms: suppliers to operators
• Space: ground-based infrastructure and its suppliers

Is there NIS2-compliant hosting?

Two questions hide in that search. If you are the host: cloud computing and data centre service providers are Annex I digital infrastructure. From medium size they are in scope, supervised where their main establishment is, and bound by Implementing Regulation (EU) 2024/2690.

If you are a customer in scope: no hosting contract transfers your obligations, and NIS2 neither certifies hosts nor tells you which one to choose. A host you contract with is a direct service provider under Article 21(2)(d), and Article 21(3) requires you to take its specific vulnerabilities and security practices into account. In practice, that means an assessment and security terms in the contract. A host that is in scope itself, with audit reports to show, makes that assessment easier, not unnecessary.

What changes to NIS2 are proposed?

On 20 January 2026 the Commission proposed two linked texts. As of September 2026 both are proposals, not law, and may change before the European Parliament and the Council agree them.

• COM(2026) 13, targeted NIS2 amendments. Annex I “small mid-caps” would be important entities as a main rule. Scope adjustments in sectors such as electricity and chemicals, ransomware data collection and simpler jurisdiction rules. New Article 24(4) and (5) would let Member States require a certificate of an entity’s cyber posture, which would rule out additional targeted audits for the requirements it covers. The Commission says about 28,700 companies would see simpler compliance.
• COM(2026) 11, Cybersecurity Act revision. EU schemes could certify an entity’s cyber posture, not only products. An ICT supply chain framework would stop electronic communications network operators relying on high-risk suppliers for critical assets.

Where do you start? A 90-day plan

This plan is practice, not law, for a medium-sized entity starting from scratch.

Days 1 to 30: establish the facts

1. Run the scope check for each legal entity, including group size and jurisdiction, and record the figures.
2. Find your national law, competent authority and CSIRT. Register, or check your registration, and set up a two-week change process.
3. Brief the management body, name a programme owner and schedule the members’ training.
4. Decide who judges significance, and prepare the reporting channel and an early warning template.

Days 31 to 60: find the gaps

5. Run a risk analysis on the services in scope, measure (a).
6. Assess your controls against the ten measures; list gaps with owners and dates.
7. Close fast hygiene gaps: MFA on administrative and remote access, critical patches, a recorded restore test.

Days 61 to 90: decide and prove

8. Build the register of direct suppliers and put security terms into critical contracts.
9. Have the management body approve the measures and the remediation plan, and minute it.
10. Rehearse the 24-hour and 72-hour clocks, and start collecting dated evidence per measure.

What NIS2 leaves open in practice

NIS2 sets outcomes and headings, not controls. “Appropriate and proportionate” has no number, and the ten measures fit on one page. Proving them does not.

Articles 32 and 33 let the authority ask for “evidence of implementation of cybersecurity policies”, for example MFA on every administrative account today, patch times against your own deadline, the last successful restore, each significance decision with its timestamp. That evidence sits in the identity provider, endpoint management, cloud accounts and the ticketing system.

Gathered by hand before an audit, it shows the day it was gathered; after an incident, the authority may ask what was true before it. Collected continuously from those systems, with a person reviewing exceptions and judgement calls such as significance, the evidence stays audit-ready. That is how CloudSoul works: an automated platform with human-in-the-loop expertise. The wider programme is on the NIS2 compliance page.

NIS2 compliance checklist

• Record a scope and category decision for each legal entity, with the figures behind it.
• Register with your competent authority and report changes within two weeks.
• Record management body approval of the Article 21 measures and each member’s training.
• Keep a risk register and a gap list against the ten measures, with owners and dates.
• Maintain a register of direct suppliers, with security terms in critical contracts.
• Test incident reporting against the 24-hour, 72-hour and one-month deadlines.
• Keep dated evidence for each measure, taken from the systems that hold it.
• Check your national law for additions, such as conformity schemes or training frequency.

Sources

• Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 4, 20 to 28, 32 to 36, 41 and 44, recital 28, Annexes I and II, EUR-Lex. Article text: Article 41, Article 44.
• Commission Implementing Regulation (EU) 2024/2690, EUR-Lex.
• Commission Recommendation 2003/361/EC on the definition of micro, small and medium-sized enterprises, EUR-Lex.
• European Commission, NIS2 transposition (reasoned opinions of 7 May 2025) and referral of Ireland, Spain, France and the Netherlands to the Court of Justice, 8 July 2026.
• Proposal COM(2026) 13 amending Directive (EU) 2022/2555, 20 January 2026, EUR-Lex; European Commission, Cybersecurity package: questions and answers, on COM(2026) 11 and 13.
• Luxembourg, Law of 5 May 2026 on measures to ensure a high level of cybersecurity, Legilux.
• Belgium, Law of 26 April 2024, eJustice; Centre for Cybersecurity Belgium, NIS2: 18 April 2026 deadline.
• Germany, Gesetz zur Umsetzung der NIS-2-Richtlinie of 2 December 2025, BGBl. 2025 I Nr. 301, recht.bund.de; BSI-Gesetz (BSIG), consolidated text, gesetze-im-internet.de; BSI, NIS-2-regulierte Unternehmen.

Frequently asked questions