NIS2 is the EU directive that sets cybersecurity risk measures and incident reporting for essential and important entities. For a product manager it matters in two ways: if your company is in scope, and if your customers are, because they will push supplier duties and reporting expectations onto your product.
What is NIS2 in plain terms?
The European Commission describes NIS2 as a unified legal framework for cybersecurity in 18 critical sectors across the EU. Directive 2022/2555 replaced the earlier NIS directive, entered into force in January 2023 and had to be transposed by Member States by 17 October 2024. As a rule, medium sized and large entities in the listed sectors must take risk management measures and notify authorities of significant incidents. On 20 January 2026 the Commission proposed targeted amendments to ease some compliance, so check the current text before you plan.
Who is in scope, and why should a PM care if you are not?
Because it is a directive, each Member State writes its own national law, so details vary. Even if your company is not covered, your customers may be. Their duties under Article 21 include supply chain security, covering the relationship with direct suppliers and service providers, and security in acquisition, development and maintenance, including vulnerability handling and disclosure. Expect their questionnaires to ask how you handle both.
Which product features and processes does it touch?
Article 21 lists minimum measures, including risk analysis policies, incident handling, business continuity such as backup management and disaster recovery, supply chain security, vulnerability handling and disclosure, and policies on assessing the effectiveness of measures. For a product team the visible parts are the ones a customer can see: a published way to report vulnerabilities, advisories you send, status communication, backup and recovery commitments, and the ability to hand over logs after an incident.
Constructed example: a workflow software vendor sells to a hospital group that falls under NIS2 in its country. The hospital asks for the vendor's incident notification process and how fast they will be told about a breach that affects them. The vendor has an internal policy but no customer commitment. The PM turns that into a clear support document and a contract term, and the sales cycle moves again.
What are the reporting timelines?
Article 23 requires notifying the relevant CSIRT or authority of significant incidents without undue delay. In practice that is an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report no later than one month after the notification. An incident is significant if it caused or can cause severe operational disruption or financial loss, or considerable damage to others. If your product is a part of a customer's service, your notice to them has to be quick enough for them to meet their own deadlines.
What does management accountability mean for roadmaps?
Article 20 requires management bodies to approve the risk management measures, oversee them and accept that they can be held liable for infringements, and to follow training. That means security work needs a place in roadmap review, not only in a security backlog.
What are the penalties?
Under Article 34, Member States must provide fines with a maximum of at least 10 million euros or 2 percent of worldwide annual turnover for essential entities and at least 7 million euros or 1.4 percent for important entities, whichever is higher. National laws may go higher.
What to do
- Find out whether your company or key customers are essential or important entities in the countries you sell to.
- Publish a vulnerability disclosure route and a customer notice process.
- Define your customer incident notice time in a contract template, shorter than the customer's own 24 hour mark.
- Document backup and recovery commitments in plain language.
- Add supplier change notices to the roadmap for features that bring in new subprocessors.
- Put security review on the agenda of roadmap meetings.
Quick check
What are the NIS2 reporting stages?
An early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month after the notification.
Does NIS2 apply directly to companies?
It is a directive, so each Member State transposes it into national law. Check the national law in each country where you operate or sell.
Sources
Last reviewed: 18 October 2026.
