NIS2 is Directive (EU) 2022/2555, the European Union's law on the cybersecurity of network and information systems. It applies, as a rule, to medium-sized and large entities in 18 listed sectors. Whether you are in scope depends on your sector, size and the law of each Member State where you operate.
What is NIS2 in plain terms?
It replaced the first NIS Directive, which was repealed from 18 October 2024. Member States had until 17 October 2024 to transpose NIS2 into national law, so the rules you must follow are the national ones. The Commission's NIS2 page describes the aim as requiring in-scope entities to manage cyber risk and report significant incidents.
Which sectors are covered?
The Commission lists 18 critical sectors. Those carried over from the first directive include energy, transport, healthcare, finance, water and digital infrastructure. Newer additions include public electronic communications, social platforms and other digital services, waste and wastewater, manufacturing of critical products, postal and courier services, public administration and space.
What does size have to do with it?
The Commission says that, as a rule, medium-sized and large entities in these sectors must take risk management measures. The directive's recitals refer to entities that qualify as medium-sized enterprises under the EU's definition in Recommendation 2003/361/EC. We did not fetch that recommendation, so check the thresholds there. The directive may bring some entity types into scope regardless of size, so ask counsel to read the scope articles rather than relying on headcount alone.
What are essential and important entities?
The directive sorts entities into essential entities and important entities, reflecting how critical they are in their sector or service and their size. The distinction matters for supervision and fines. For breaches of the risk management and reporting articles, Article 34 sets maximum fines of at least EUR 10 million or 2 percent of worldwide annual turnover for essential entities, and at least EUR 7 million or 1.4 percent for important entities, whichever is higher.
What do in-scope entities have to do?
Three headline duties.
- Take measures. Article 21(2) lists them, from risk analysis and incident handling to supply chain security, vulnerability handling, cyber hygiene, cryptography, access control and multi-factor authentication.
- Report incidents. An early warning within 24 hours of becoming aware of a significant incident, a notification within 72 hours and a final report within one month of the notification.
- Answer at the top. The management body must approve the measures, oversee them and follow training, and can be held liable.
Does NIS2 reach small companies indirectly?
Yes, through contracts. Article 21 asks entities to consider the security of their direct suppliers, so a small software vendor to an in-scope customer will get questions on development practices, vulnerability handling and incident notification, even if it is not itself in scope.
What has changed recently?
On 20 January 2026 the Commission proposed targeted amendments to simplify compliance, which it said would ease compliance for 28,700 companies, including 6,200 micro and small enterprises. Proposals are not law, so follow the progress.
What to do
- Check your sectors against the Commission's list, entity by entity.
- Check size against the EU definition, and check whether any criteria apply regardless of size.
- Find the national law in each Member State where you operate and the registration steps.
- Classify yourself as essential or important with advice from counsel.
- If in scope, run a gap assessment against Article 21(2) and test an incident reporting path.
- If out of scope, expect supplier questions and prepare standard answers.
Quick check
Is NIS2 a regulation that applies directly?
It is a directive, so it applies through national laws made by each Member State. Check the law where you operate.
Does Safeguard certify NIS2 compliance?
No. There is no NIS2 certification from Safeguard, and no tool confers compliance. Safeguard can help with inventory and evidence.
Sources
Last reviewed: 18 October 2026.
