The EU's landmark cybersecurity directive is now in force. This guide covers what NIS2 is, who it applies to, what it requires, what happens if you don't comply — and what to do next.
NIS2 (Directive EU 2022/2555) is the European Union's primary cybersecurity legislation. It entered into force in January 2023, replacing the original NIS Directive of 2016, and member states were required to transpose it into national law by 17 October 2024.
The original NIS Directive was the EU's first attempt at harmonised cybersecurity rules. By 2020 it was clear it was insufficient: coverage was too narrow, enforcement was inconsistent across member states, and the threat landscape had evolved dramatically. NIS2 is the response — broader in scope, stricter in requirements, and far tougher in enforcement.
NIS2 covers 18 critical sectors, applies to over 160,000 organisations across the EU, and introduces direct personal liability for senior management. It is no longer a technical compliance exercise — it is a board-level governance obligation.
Mandatory risk management measures, supply chain security, encryption, access controls, and business continuity — standardised across all member states.
A structured three-stage incident reporting process with tight deadlines — 24 hours, 72 hours, one month — replacing the previous ad hoc approach.
Management bodies must approve, oversee, and be trained on cybersecurity. Executives can face personal liability and temporary bans from leadership roles.
Fines of up to €10 million or 2% of global annual turnover for essential entities — comparable to GDPR and in some cases more severe in impact.
NIS2 applies to medium and large organisations operating in 18 defined sectors within the EU. Size thresholds apply: generally 50+ employees or €10M+ annual turnover. But exceptions exist — small companies can be designated in scope if they are critical sole providers.
NIS2 divides in-scope organisations into two tiers. The classification determines your supervision regime, reporting deadlines, and maximum fines. The European Commission estimates that roughly 33% of in-scope entities are Essential, and 67% are Important.
| Criterion | Essential Entity (EE) | Important Entity (IE) |
|---|---|---|
| Sectors | Annex I (energy, health, transport, digital infrastructure, banking, water, public administration, space) | Annex II (food, chemicals, manufacturing, postal, waste, digital services, research) |
| Size | Large (250+ employees or €50M+ turnover) or designated regardless of size | Medium (50+ employees or €10M+ turnover) |
| Supervision | Proactive — authorities can audit at any time without a triggering incident | Reactive — checked after incidents or complaints |
| Max fine | €10M or 2% of global turnover (whichever is higher) | €7M or 1.4% of global turnover (whichever is higher) |
| Management liability | Yes — including temporary ban from management roles | Yes — personal liability for oversight failures |
| Incident reporting | 24h early warning / 72h notification / 1 month final report | 24h early warning / 72h notification / 1 month final report |
Article 21 of NIS2 defines ten minimum cybersecurity measures that all in-scope entities must implement. These fall into four overarching areas: risk management, corporate accountability, reporting obligations, and business continuity.
NIS2 makes in-scope entities responsible for the security of their entire supply chain. Even if a breach originates with a third-party vendor, the in-scope entity bears legal responsibility. This requires robust vendor assessments, contractual cybersecurity clauses, and supplier incident notification agreements that allow you to meet your own 24-hour reporting window.
Article 23 of NIS2 introduces the most structured incident reporting framework in EU cybersecurity regulation. It is a strict three-stage process with hard deadlines measured from the moment you become aware of a significant incident.
An initial notification to the national CSIRT or competent authority. Must indicate whether the incident is suspected to be malicious or has potential cross-border impact. This is a flag — not a full analysis.
An update with initial severity assessment, impact on services, indicators of compromise (IoCs), and preliminary cause. The technical investigation may still be ongoing at this point.
Root cause analysis, mitigation measures applied, cross-border impacts, and lessons learned. If the incident is still ongoing after one month, a progress report is submitted instead.
An incident is significant if it causes or is capable of causing severe operational disruption, financial loss to the entity, or considerable material or non-material damage to others. This includes: supply chain disruptions cascading to downstream organisations, data breaches affecting clients, and service outages impacting critical societal functions. A 2025 ECSO survey found that 41% of reportable incidents under NIS2 involved cascading effects on third parties.
NIS2 introduces the most severe cybersecurity penalties in European history. Financial fines are only part of the picture — personal liability for executives and operational sanctions make non-compliance a board-level risk.
Regulators are focusing on four failure patterns: risk not managed continuously (annual checkbox exercises are insufficient); late or incomplete incident reporting (especially missing the 24-hour window); weak supply chain security (vendors as breach entry points); and lack of documented senior oversight and accountability.
The October 2024 transposition deadline was missed by most member states. The Commission opened infringement proceedings against 23 member states in November 2024. Implementation is now progressing — but at different speeds, with local variations that matter for cross-border operators.
| Country | Status | Key notes |
|---|---|---|
| Belgium | Transposed ✓ | In force since October 2024. Registration deadline passed March 2025. Coordinated vulnerability disclosure policy required. |
| Italy | Transposed ✓ | In force October 2024. Scope extended to include legal services for large grocery retailers and cultural sector. National Cybersecurity Agency oversees enforcement. |
| Hungary | Transposed ✓ | Act LXIX of 2024 in force January 2025. First compliance audit deadline extended to June 30, 2026. |
| Greece | Transposed ✓ | Transposed November 2024. Annual or post-major-change risk reviews mandatory. Audits planned from Q4 2025. |
| Germany | Transposed ✓ | NIS2UmsuCG enacted December 2025. Affects ~30,000 companies. BSI registration deadline: April 2026. |
| Bulgaria | In progress | Transposition ongoing. Companies operating in Bulgaria should monitor national legislation and prepare now. |
| France | In progress | Legislative process ongoing. Expected transposition during 2026. Commission has sent reasoned opinion. |
| Spain | In progress | Bill pending publication as of early 2026. Commission has referred to CJEU. |
A typical NIS2 compliance process — including scoping, gap analysis, policy development, technical implementation, and audit readiness — takes 9 to 12 months. Starting now is not optional.
Identify whether your organisation falls under NIS2, which entity tier applies (Essential or Important), and in which member states you must register. Use our Compliance Engine for an instant scope determination, or contact SerafinIT for a formal scoping assessment.
Map your current cybersecurity posture against all 10 Article 21 measures. Identify what is missing, what is partially in place, and what needs to be built from scratch. This becomes the foundation of your compliance programme.
Brief senior management on their personal obligations under Article 20. Document board-level approval of the cybersecurity strategy. Arrange mandatory cybersecurity training. Create an audit trail of governance oversight.
Implement all Article 21 measures: risk management framework, incident response procedures, business continuity plan, supply chain security clauses, access controls, MFA, encryption policies, and vulnerability management.
Automate detection-to-notification workflows. Pre-populate incident report templates. Establish clear internal escalation paths so you can meet the 24-hour early warning deadline even while the investigation is ongoing.
Register with the competent national authority in each member state where you operate. Maintain continuous, auditable evidence of compliance: policies, risk assessments, training logs, supplier due diligence, and incident records.
SerafinIT provides NIS2 gap analysis, remediation roadmaps, and board briefings — tailored to your sector and jurisdiction.