NIS2 compliance:
who is in, and what it takes.

NIS2 is the EU's second Network and Information Security Directive, Directive (EU) 2022/2555. It replaced the 2016 NIS Directive and greatly widened its scope. Because it is a directive, it does not apply directly: each member state had to transpose it into national law by 17 October 2024 and apply those measures from 18 October 2024. The obligations that bind a company are therefore in its national law, which can go further than the Directive.

NIS2 applies to entities that provide services or carry out activities in the EU, so a US or UK company with EU customers in a covered sector can be in scope. The UK is outside NIS2 and has its own NIS Regulations 2018.

The management body must approve the Article 21 measures, oversee their implementation and can be held liable for infringements. Its members must also follow cybersecurity training. In practice this means minuted approval of the security programme, regular reporting to the board, and training records for directors, not just for staff.

For breaches of Article 21 or 23, essential entities face a maximum fine of at least EUR 10 million or 2% of total worldwide annual turnover, and important entities at least EUR 7 million or 1.4%, whichever is higher in each case. Authorities can also issue binding instructions, order audits, require public disclosure of an infringement and, for essential entities whose enforcement measures have failed, seek a temporary suspension of certifications or a temporary ban on a chief executive or legal representative.

The deadline was 17 October 2024 and most member states missed it. On 7 May 2025 the European Commission sent reasoned opinions to 19 member states for failing to notify full transposition. On 8 July 2026 it referred four of them, Ireland, Spain, France and the Netherlands, to the Court of Justice of the EU for failing to notify transposition measures, and said most member states had complied.

What we could and could not confirm on 6 October 2026:

• Ireland, Spain, France, the Netherlands: not transposed as of the 8 July 2026 referral. France's cybersecurity agency ANSSI still refers to a draft law; we could not confirm whether any of the four has adopted its law since July.
• The other 23 member states: the Commission indicates they have notified transposition measures, but we have not verified each national law, its entry into force or its registration deadlines one by one.
• Where your entity sits: generally the member state where you are established; many digital infrastructure and digital providers fall under the member state of their main establishment in the EU, and those based outside the EU must designate a representative.

Check the Commission's NIS2 transposition page and your national authority before relying on any date. Where a national law is not yet in force, the Directive's requirements are still the best guide to what will be asked.

1. Confirm whether you are in scope, and whether as essential or important, in each member state you serve.
2. Register with the competent authority where your national law requires it.
3. Run a risk assessment and get the management body to approve the security measures.
4. Gap-assess against Article 21(2)(a) to (j), and the implementing regulation if you are a digital provider.
5. Put the 24-hour, 72-hour and one-month reporting into your incident plan, with named people and the CSIRT contact.
6. Tier your suppliers and add security terms to critical contracts.
7. Train the management body and staff, and keep the records.
8. Test effectiveness: internal audit, control monitoring, exercises.

If you already hold ISO 27001 or a SOC 2 report, much of Article 21 is covered by controls you run; the gaps are usually management accountability, the reporting timelines and registration. Financial entities should read our DORA guide: where DORA applies, its ICT risk and reporting rules take precedence over NIS2's.