regulation
NIS2
The EU cybersecurity directive for 18 sectors. It reaches you through your national law and comes with a board signature, 24-hour warnings and ten kinds of security work.
- what it is
- A directive. Your national act is what binds you.
- who it covers
- Medium and larger entities of listed types, in 18 sectors. Some types at any size.
- the size line
- 50 staff, or both turnover and balance sheet above €10 million.
- fine ceilings
- At least €10 million or 2% of turnover for essential entities. At least €7 million or 1.4% for important ones.
- who answers
- Management approves, oversees and can be held liable.
- status
- National laws arrive country by country. Check yours before you plan.
basis NIS2 Art. 2(1), 2(2), 20(1), 34(4), 34(5), 41(1); Recommendation 2003/361 Art. 2(2)
does it apply to you
Two questions decide it, and you can answer both in ten minutes: is your activity listed, and are you big enough?
are you in scope of NIS2?
- Is your activity one of the entity types in annex I or II?yesnoOff the list. A customer's contract or your state can still pull you in.
- Are you a trust service, DNS, top-level domain or public communications provider?noyesIn scope at any size.
- Do you have 50 or more staff, counting your group?noyesIn scope.
- Are turnover and balance sheet both above €10 million, counting your group?yesnoBelow the size test, unless your state names you individually.
- In scope. Read your national act for your label and dates.
basis NIS2 Art. 2(1), 2(2), Annex I, Annex II; Recommendation 2003/361 Art. 2(2), 6(2)
Read the entity types in the annexes, because the sector names are broader than what they cover. Transport names road authorities and intelligent transport operators, so a road haulier is off that list. Manufacturing covers only medical devices, electronics, electrical equipment, machinery, vehicles and other transport equipment.
Group figures are the usual surprise. Staff and money from linked and partner companies count toward your size, so 40 people inside a larger group are often over the line.
basis NIS2 Annex I, Annex II; Recommendation 2003/361 Art. 6(2)
essential or important
The label changes how you are supervised and how high the fine can go. The list of work stays the same. Essential entities can be supervised before anything goes wrong. Important entities are supervised after the fact, when there is an indication of a problem.
the size test, on one page
- out, unless named or of an any-size type
- important entity
- essential in annex I, important in annex II
basis NIS2 Art. 2(1), 3(1), 3(2); Recommendation 2003/361 Art. 2(1), 2(2)
Picture a 300-person private hospital group and a 300-person food producer. Health care is in annex I, so the hospital group is likely essential. Food is in annex II, so the producer is important. Both owe the same measures.
basis NIS2 Art. 3(1), 3(2), 32(2), 33(1)
what it actually asks for
Ten kinds of measure, and the text gives one line to each. Those lines cover risk analysis, incident handling, backups and crisis management, supply chain, secure development and vulnerabilities, checking your own effectiveness, hygiene and training, cryptography, HR and access and assets, and MFA. Each has a page on this site under the work.
The measures must be proportionate to your exposure, your size and the likelihood and severity of incidents. That word gives you room to decide, and it also obliges you to write down why you decided what you did.
If you are one of the digital types, such as cloud, data centre or managed services, a Commission regulation spells out the measures in detail and binds you directly. Everyone else can borrow it as the most concrete EU wording available, and should say so in their documents.
basis NIS2 Art. 21(1), 21(2); IR 2024/2690 Art. 1
your national law is the one that binds you
how NIS2 reaches a company
- 1the directivebinds member states, and sets ten kinds of measure
- 2your national actbinds you, with its own dates, authority and fines
- 3your boardapproves the measures and can be held liable
- 4your teambuilds them and keeps the proof
- 5your suppliersreceive terms, because your supply chain is part of your duty
basis NIS2 Art. 41(1), 20(1), 21(2)
Member states were due to write NIS2 into law by 17 October 2024, and many missed it. On 8 July 2026 the Commission announced it was referring Ireland, Spain, France and the Netherlands to the Court of Justice, as reported by the Brussels Times. Trackers disagree on how many laws are in force, so look at your own country’s official gazette.
Poland. The amended act has applied since 3 April 2026. Entities in scope on that date had until 3 October 2026 to apply for the register and have until 3 April 2027 for the duties themselves. First audits for essential entities, and most fines, wait until 3 April 2028. The head of the entity stays responsible after delegating, and management training is yearly and documented.
Germany. The BSI says on its NIS2 page that the statutory registration deadline has passed and that entities not yet registered should do so at once.
basis NIS2 Art. 41(1); KSC Art. 8c(3), 8e(1), 33, 35; BSIG section 33(6) as cited by the BSI
what may change
A proposal to amend NIS2 was published in January 2026 and sits at committee stage in Parliament, with first reading indicated for March 2027. It would add a small mid-cap tier, so that the essential label in annex I starts at a higher size. It is a proposal, so plan on the law in force.
basis COM(2026) 13, procedure 2026/0012(COD)
the work under NIS2
- incident reportingOne event can start three clocks at once, each to a different authority. The hours are easy to remember. The hard part is that someone must be allowed to say this counts before the investigation is finished.
- supplier riskYour suppliers' failures count as yours. Three rules ask for the same thing: know who they are, look at them in proportion, and put security in the contract.
- the board's partSecurity decisions now need a director's signature. A board does not have to understand firewall rules. It has to see risks, cost and choice, decide, and be able to show that it did.
- access controlWho can get in, who said so, and when someone last checked. Every rule asks the same thing in slightly different words, which makes this the most reusable work on the site.
- risk assessmentEvery rule says appropriate to the risk. Without a written assessment you cannot show that anything you did was appropriate, and you have no honest way to do less.
- backups and recoveryA backup counts once you have restored from it. One timed restore tells you more than a plan, and it leaves a record that shows the control runs.
- trainingThree rules ask for training, and the AI Act adds its own. One small programme with one attendance record answers them all. The failure that shows up is having no record.
- patching and checking it worksPatch on a schedule you wrote down, handle the reports that come in, and test once a year whether the rest of your controls run. Companies skip the last part because nothing breaks when they do.
check it yourself
- Directive (EU) 2022/2555 (NIS2) (EUR-Lex)
- Commission Recommendation 2003/361/EC (SME definition) (EUR-Lex)
- Commission Implementing Regulation (EU) 2024/2690 (EUR-Lex)
- Poland: Act of 23 January 2026 amending the national cybersecurity system act, Dz.U. 2026 poz. 252 (Dziennik Ustaw)
- European Parliament, Legislative Observatory: procedure 2026/0012(COD), proposed amendment of NIS2
- European Commission: COM(2026) 13, the proposal itself
- Brussels Times, 8 July 2026: four member states referred to the Court over NIS2
- BSI (Germany): NIS-2 regulated companies
- Ministry of Digital Affairs (Poland): the amended act comes into force
fyi Last checked 2 November 2026. This is not legal advice. It is a plain reading of the texts listed on this page, and national law can add to them. Before you rely on it in front of a regulator, an auditor or your board, have a lawyer confirm it for your company. What this means.
your next step
Run the finder with your sector and size, then read your national act before you plan anything.