NIS2 Directive: scope, requirements and fines explained

NIS2 is Directive (EU) 2022/2555, the EU law on cybersecurity for essential and important entities. It applies to medium-sized and larger organisations in 18 sectors, plus some entities of any size. They manage cyber risk with at least ten measures, report significant incidents within 24 hours, 72 hours and one month, and face fines with a maximum of at least EUR 10 million or 2% of worldwide turnover, whichever is higher.

This guide is for IT managers, CISOs and compliance officers who need to know whether NIS2 reaches their organisation and what it asks in practice. It follows the text of the directive as published in the Official Journal. NIS2 is a directive, so it works through national law: the last section explains what that means for an organisation operating in more than one Member State.

What NIS2 is, in short

The directive was adopted on 14 December 2022 and published in the Official Journal on 27 December 2022. It replaced the first NIS Directive, Directive (EU) 2016/1148, which Article 44 repealed with effect from 18 October 2024. Under Article 41, Member States were due to adopt and publish their national measures by 17 October 2024 and apply them from 18 October 2024.

Compared with the first NIS Directive, four things change:

• A wider scope: 18 sectors across two annexes, with a size rule that brings in a large part of the mid-market.
• Explicit measures: Article 21 lists the minimum cybersecurity risk-management measures every entity in scope adopts.
• Fixed reporting times: Article 23 sets three steps for significant incidents, with hours and days written into the text.
• Accountability at the top: under Article 20, management bodies approve the measures, oversee them and can be held liable.

NIS2 is a minimum harmonisation directive. Article 5 lets Member States adopt or keep rules that ensure a higher level of cybersecurity, which is why national laws differ in detail.

Who is in scope

Article 2 combines two tests: the type of entity and its size. The directive applies to public or private entities of a type listed in Annex I or Annex II that qualify as medium-sized enterprises under Commission Recommendation 2003/361/EC, or exceed the medium-sized ceilings, and that provide services or carry out activities in the Union.

In practice, under Article 2 of the Annex to the Recommendation, an enterprise is no longer small when it has 50 staff or more, or when both its annual turnover and its annual balance sheet total exceed EUR 10 million.

The sectors in Annexes I and II

Annex I lists eleven sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business-to-business, including managed service and managed security service providers), public administration and space.

Annex II lists seven other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research. Manufacturing is narrower than it sounds: it covers medical devices and in vitro diagnostic devices, computer, electronic and optical products, electrical equipment, machinery and equipment, motor vehicles, and other transport equipment.

Entities in scope regardless of size

Some entities fall under NIS2 whatever their size (Article 2(2) to (4)):

• providers of public electronic communications networks or publicly available electronic communications services;
• trust service providers;
• top-level domain name registries, DNS service providers and entities providing domain name registration services;
• central government public administration entities, and regional ones where a Member State decides so after a risk assessment;
• entities identified as critical entities under Directive (EU) 2022/2557;
• entities a Member State identifies because they are the sole national provider of an essential service, or because a disruption would have a significant impact on public safety, security or health, or create a significant systemic risk.

Member States may also extend the directive to local public administration and to education institutions (Article 2(5)).

Essential or important

Article 3 sorts entities in scope into two categories. Essential entities include Annex I entities that exceed the medium-sized ceilings (250 staff or more, or turnover above EUR 50 million together with a balance sheet above EUR 43 million), qualified trust service providers, TLD name registries and DNS service providers, medium-sized telecoms providers, central government entities and critical entities. Every other entity in scope is an important entity.

The obligations of Articles 21 and 23 are the same for both. What changes is supervision and the ceiling of fines. Essential entities are subject to proactive supervision under Article 32, including on-site inspections, regular and targeted security audits and security scans. Important entities are supervised ex post under Article 33, when the authority receives evidence or information of non-compliance.

Member States had to establish a list of essential and important entities by 17 April 2025 and review it at least every two years (Article 3(3)). Entities send at least their name, contact details, IP ranges, sector and the Member States where they provide services, and notify changes within two weeks.

Group companies and size

A common mistake is to measure size on one legal entity alone. Article 6 of the Annex to the Recommendation adds the data of linked enterprises and a proportional share of partner enterprises. A subsidiary with 40 employees, controlled by a group that exceeds the ceilings, can therefore count as medium-sized or large.

Financial entities and DORA

Article 4 says that where a sector-specific EU act sets cybersecurity risk-management and incident reporting requirements at least equivalent to those of NIS2, the matching NIS2 provisions do not apply. Recital 28 names Regulation (EU) 2022/2554, DORA, as that act for financial entities: banks and other financial entities covered by DORA follow it for ICT risk management, incident reporting and supervision. We explain that framework on our DORA compliance page.

Which country's law applies

Under Article 26, an entity falls under the jurisdiction of the Member State where it is established. There are three exceptions. Telecoms providers fall under the Member State where they provide their services. Public administration entities fall under the Member State that established them. DNS service providers, TLD name registries, domain name registration services, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, online marketplaces, online search engines and social networking platforms fall under the Member State of their main establishment in the Union, the one where cybersecurity risk-management decisions are predominantly taken.

Governance: the management body is accountable (Article 20)

Article 20 makes cybersecurity a board matter. The management bodies of essential and important entities approve the risk-management measures, oversee their implementation and can be held liable for infringements of Article 21. Their members are required to follow training, and Member States encourage entities to offer similar training to employees on a regular basis.

For essential entities, Article 32(6) adds that the natural persons who represent or control the entity can be held liable for breach of their duty to ensure compliance. Article 32(5) goes further: where earlier enforcement steps have not worked, authorities can request a temporary prohibition for the person discharging managerial responsibilities at chief executive or legal representative level.

The ten measures of Article 21

Article 21(1) asks for appropriate and proportionate technical, operational and organisational measures, taking into account the state of the art, relevant European and international standards and the cost of implementation. Proportionality looks at the entity's exposure to risk, its size, and the likelihood and severity of incidents. Article 21(2) says the measures follow an all-hazards approach and include at least:

1. Policies on risk analysis and information system security. Know which systems you depend on, what happens if they stop, and write down how you govern them.
2. Incident handling. Who detects, who decides, who reports, and how fast. Without detection there is nothing to report on time.
3. Business continuity, such as backup management and disaster recovery, and crisis management. The question to answer is how long it takes to restart after ransomware. Our guide to the business continuity plan covers the method.
4. Supply chain security, including the security aspects of relationships with direct suppliers and service providers. Article 21(3) adds that entities consider the vulnerabilities of each direct supplier and the quality of its products and secure development practices.
5. Security in acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure.
6. Policies and procedures to assess effectiveness of the measures: audits, tests and indicators. Compliance is something you check, not a folder of documents.
7. Basic cyber hygiene practices and cybersecurity training.
8. Policies and procedures on cryptography and, where appropriate, encryption.
9. Human resources security, access control policies and asset management.
10. Multi-factor or continuous authentication, secured voice, video and text communications, and secured emergency communication systems, where appropriate.

An entity that finds it does not comply takes corrective measures without undue delay (Article 21(4)).

For some digital entities the measures are already detailed in EU law. Commission Implementing Regulation (EU) 2024/2690 sets the technical and methodological requirements for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, online marketplaces, search engines, social networking platforms and trust service providers. It also specifies when an incident is significant for them. For other sectors, national authorities may publish their own guidance.

Article 25 encourages the use of European and international standards. Many organisations use an ISO/IEC 27001 management system to structure these measures, and our ISO 27001 page explains how. The directive does not treat an ISO/IEC 27001 certificate as proof of compliance, though: governance, registration and incident reporting stay as separate duties.

Incident reporting (Article 23)

An incident is significant if it has caused, or can cause, severe operational disruption of the services or financial loss for the entity, or if it has affected, or can affect, other natural or legal persons by causing considerable material or non-material damage (Article 23(3)).

For a significant incident, the entity submits to its CSIRT or, where applicable, its competent authority:

• An early warning within 24 hours of becoming aware of it, indicating, where applicable, whether it is suspected of being caused by unlawful or malicious acts or could have a cross-border impact.
• An incident notification within 72 hours, with an initial assessment of severity and impact and, where available, indicators of compromise.
• An intermediate report, if the CSIRT or authority requests one.
• A final report within one month of the incident notification, with a detailed description, the likely root cause, the mitigation measures applied and ongoing, and any cross-border impact. If the incident is still ongoing at that point, a progress report goes in instead, and the final report follows within one month of handling the incident.

Trust service providers send the incident notification for incidents affecting their trust services within 24 hours instead of 72. The CSIRT or authority replies to the early warning, where possible within 24 hours, with initial feedback and, on request, guidance on mitigation. Where appropriate, entities also inform the recipients of their services without undue delay. Article 23(1) states that the mere act of notification does not increase the entity's liability.

The clock starts when the entity becomes aware of the incident, so these times are only realistic with monitoring that runs around the clock. That is the operational side of NIS2 our observability and SecOps work covers.

Supervision and fines (Articles 32 to 34)

Article 34 sets the minimum ceilings that national law provides for infringements of Article 21 or 23:

• Essential entities: a maximum of at least EUR 10 million or at least 2% of total worldwide annual turnover in the preceding financial year of the undertaking the entity belongs to, whichever is higher.
• Important entities: a maximum of at least EUR 7 million or at least 1.4% of that turnover, whichever is higher.

Two details are often missed. The turnover is that of the undertaking the entity belongs to, so a group's figures count. And the wording sets a floor for the maximum: a Member State can set higher ceilings. Fines come on top of the other enforcement measures, such as binding instructions, orders to remedy deficiencies and, for essential entities, the temporary suspension of a certification or authorisation. Member States may also provide for periodic penalty payments (Article 34(6)).

When an infringement also involves a personal data breach, Article 35 coordinates NIS2 with the GDPR: if the GDPR supervisory authority fines the same conduct, the NIS2 authority does not impose a second fine for it.

Transposition in the Member States

NIS2 reaches organisations through national law, and the national texts can go further than the directive. Two examples from our country guides:

• Cyprus asks for the early warning within 6 hours instead of 24. Details in NIS2 in Cyprus.
• Malta adds a security liaison officer, a qualified auditor approved by the authority and an eleventh measure on logging and traceability. Details in NIS2 in Malta.

Not every Member State transposed on time. The European Commission opened infringement procedures on 28 November 2024 and sent reasoned opinions on 7 May 2025. On 8 July 2026 it announced that it is referring Spain, France, Ireland and the Netherlands to the Court of Justice of the EU for failing to notify full transposition, and asking for financial sanctions.

The practical consequence for a group: the directive sets the frame, but the authority, the registration process, the reporting channel and sometimes the reporting times come from the law of each Member State where you are established. Article 3(4) asks entities to list the Member States where they provide services in scope, which is a good place to start the map.

Where to start

1. Check scope entity by entity. Sector, size with group data, essential or important, and which Member State has jurisdiction over each company.
2. Read the national law. Registration, authority, reporting channel and any extra duties beyond the directive.
3. Run a gap assessment on Article 21. Measure each of the ten areas against evidence an authority would ask for, not against policy titles.
4. Close the gaps that weigh most first. In our experience the serious ones are rarely in the documents: they are in detection and response, incident handling and tested backups.
5. Brief the management body. Article 20 makes it accountable, so it approves the plan and follows the training.

We run this path for mid-market organisations across Europe, from scoping and gap assessment to 24/7 managed detection and response. You can see how we work on our NIS2 compliance services page, or talk to our team about your case.