NIS2 is the EU directive on cybersecurity for entities in listed sectors. A startup is directly in scope if it is a medium or large entity in a covered sector, and indirectly affected when a covered customer pushes security requirements into its contract. Founders should check both routes.
How does scope work?
Directive (EU) 2022/2555 applies a size-cap rule: entities that are at least medium-sized under the Commission's SME recommendation, and that operate in the sectors the directive lists, fall in scope. The European Commission's page describes 18 critical sectors, including energy, transport, healthcare, finance, digital infrastructure, public administration and the space sector, plus newer ones such as postal services and waste management.
Some entities are covered whatever their size in particular cases, so a small provider of certain digital services may still be caught. Because each EU member state transposes the directive into national law, check the law of every country where you operate.
What if we are small?
You may still feel NIS2 through customers. A hospital group or energy supplier in scope has to manage supply chain risk, and the directive lists supply chain security among the required risk measures. Expect questionnaires, contract clauses on incident notice and requests for evidence about how you build and patch software.
A constructed example: a ten person company sells scheduling software to regional hospitals. It is not itself a covered entity, but a hospital's procurement team now asks for its vulnerability handling policy and a 24 hour contact for security incidents.
What does the directive require?
Article 21 lists the risk management measures. Among them: risk analysis and information system security policies, incident handling, business continuity, supply chain security, security in acquisition, development and maintenance including vulnerability handling and disclosure, ways to assess whether measures work, basic cyber hygiene and training, cryptography, access control and asset management, and multi-factor authentication where appropriate.
What are the incident clocks?
Article 23 sets a staged report for significant incidents: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month of the notification. If you are in scope, someone must be able to make that first call at 2 a.m.
Who is accountable?
Management bodies must approve and oversee the risk measures and can be held liable. Fines for essential entities can reach at least 10 million euros or 2 percent of worldwide annual turnover, whichever is higher. Important entities face at least 7 million euros or 1.4 percent. Each member state sets the exact rules, so read the national text.
What to do
- Check sector and size against the directive and the national law of each country where you sell.
- If unclear, ask counsel for a written scope view.
- Name an incident owner and a backup, and write the 24 hour, 72 hour and one month steps.
- Write a short vulnerability handling and disclosure policy.
- Keep a list of your own critical suppliers and dependencies.
- Prepare a standard answer pack for customers who ask about NIS2.
- Brief the board or founders and record that they approved the measures.
Quick check
Does NIS2 apply to non-EU startups?
It can, when you provide services in the EU in a covered sector, and some digital providers must appoint an EU representative. Check the directive text and the national law with counsel.
Is NIS2 a certification?
No. It is a legal framework with risk management and reporting duties. Nobody can certify you as NIS2 compliant by default, although standards such as ISO 27001 can support your evidence.
Sources
Last reviewed: 18 October 2026.
