NIS2 is the EU directive on network and information security. The European Commission says it covers 18 critical sectors and requires medium and large entities in them to manage cybersecurity risk and notify authorities of significant incidents. Member States had to transpose it by 17 October 2024.
Which sectors are covered
The Commission's page says NIS2 covers 18 sectors. It carries over energy, transport, healthcare, finance, water management and digital infrastructure from the earlier directive. It adds public electronic communications, digital services such as social platforms, waste and wastewater management, critical product manufacturing, postal and courier services, public administration and the space sector.
That page does not break the 18 into essential and important categories, so use national law or the directive text when you need that distinction.
What entities must do
From the Commission's summary, medium and large entities in these sectors must:
- Take cybersecurity risk management measures.
- Notify national authorities of significant incidents, meaning those that could cause major disruption or damage.
- Accept that top management is accountable for non-compliance, which moves cybersecurity onto board agendas.
Member States must also adopt national cybersecurity strategies that cover supply chain security, vulnerability management, and education and awareness. A CSIRT network shares threat information, and EU-CyCLONe supports coordinated management of large-scale incidents.
The Commission page we reviewed does not give the notification deadlines. Check the directive and your national law for those.
Timeline and current changes
Member States had until 17 October 2024 to transpose NIS2, and it replaced NIS1 from 18 October 2024. The page also mentions that in January 2026 the Commission proposed targeted amendments to simplify compliance, which would ease obligations for about 28,700 companies. The status of that proposal may have changed, so verify it.
Transposition differs by country, so a multinational should check each one. Our note on Austria's NIS2 law shows how one country handled it.
A practical starting list
- Work out whether you are medium or large and in a listed sector, using national guidance.
- Name an accountable executive.
- Map your suppliers, since supply chain security is one of the strategy themes.
- Document how you would decide that an incident is significant.
- Keep evidence of the measures you take.
What this means for an operator outside the EU
If you sell into the EU or run a facility there, ask your customers and your counsel whether you are in scope directly or through contracts. Even where you are not, your EU customers may pass obligations down in their supplier terms. Expect questions about incident notification, risk management and supply chain controls, and keep short written answers ready.
Quick check
Does NIS2 apply to non-EU companies?
The page we reviewed does not say. Check the directive and national law if you serve EU customers.
Is NIS2 a certification?
No. It is a directive implemented through national law, not a certificate.
Safeguard can support the supplier and evidence work through SBOM and dependency scanning and compliance evidence automation. It does not provide legal advice or make an entity compliant.
Sources
Last reviewed: 19 October 2026.
