NIS2 Directive
The EU's revised cybersecurity directive — Directive (EU) 2022/2555 — expands mandatory security and incident-reporting obligations to roughly 18 sectors, with real management-body liability and fines that scale with global turnover.
NIS2 replaces the original 2016 NIS Directive and widens its scope from a handful of "operators of essential services" to two formal tiers — essential entities and important entities — spanning energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, space, postal and courier services, waste management, chemicals, food, manufacturing, and digital providers.
Unlike most EU directives, NIS2 is not self-executing — it required each member state to transpose it into national law, with a transposition deadline of 17 October 2024. Many member states missed that deadline, so the practical compliance date in a given country depends on when that country's own transposing law actually took effect; organizations operating across multiple EU states should confirm each jurisdiction's local statute rather than assume EU-wide simultaneity.
Who is impacted
Medium and large entities (broadly, 50+ employees or €10M+ annual turnover/balance sheet) in the sectors listed above, plus some smaller entities the national authority designates regardless of size (e.g. sole providers of a critical service). Non-EU companies offering services into the EU in an in-scope sector can also fall in scope.
Requirements
Article 21 requires a documented risk-management approach covering incident handling, business continuity, supply-chain security, and access control. Article 23 sets a strict incident-reporting clock: a 24-hour early warning, a 72-hour full incident notification, and a final report within one month. Management bodies can be held personally accountable for non-compliance, and national authorities can impose fines up to €10M or 2% of global annual turnover (essential entities) or €7M or 1.4% (important entities), whichever is higher.
Key deadlines
Directive enters into force
Member-state transposition deadline
Executive guides & research
NIS2: The Complete Executive Guide
Everything a CISO, compliance director, or board member needs to know about the EU's revised Network and Information Security Directive — scope, governance, reporting obligations, and a real implementation roadmap.
Templates & checklists
Glossary
Essential Entity (NIS2)
The higher-scrutiny NIS2 category — larger organizations in the most critical sectors (energy, transport, banking, health, digital infrastructure, public administration, space) subject to proactive supervision by national authorities.
Important Entity (NIS2)
The second NIS2 category — medium-sized entities in scope sectors, subject to reactive (ex-post) supervision rather than the proactive oversight essential entities face.
Related
Stay ahead of NIS2 changes
Get Regulatory Alerts the moment something about NIS2 Directive changes — new deadlines, guidance updates, enforcement actions.