EU regulations · NIS2 Directive
Enforcement is live; first fines are on the booksNIS2 Directive
Compliance Made
Manageable
Turn NIS2 obligations into assigned controls, linked evidence, and board-visible progress. National enforcement is live, first fines have been issued, and the Commission is taking laggard member states to the CJEU.
What you need to know
- Medium and large entities in 18 sectors are in scope: 50 or more employees or over €10M turnover puts you in, and some digital and ICT service providers are covered regardless of size.
- The transposition deadline has passed, and the Article 21(2) measures and Article 23 reporting bite through enacted national law: first national fines have been issued, four member states were referred to the CJEU in July 2026, and your own jurisdiction's transposition sets the details.
- Fines reach at least €10M or 2% of worldwide turnover for essential entities, and management bodies can be held liable under Article 20 for failures on the Article 21 measures.
What is NIS2?
The NIS2 Directive (Directive (EU) 2022/2555) is the EU's updated cybersecurity legislation, replacing the original NIS Directive from 2016. It establishes a high common level of cybersecurity across the European Union, significantly expanding the scope from roughly 10,000 entities under NIS1 to over 160,000 under NIS2.
NIS2 introduces stricter requirements for risk management, incident reporting, supply chain security, and governance, including personal accountability for management bodies. Member States were required to transpose the directive into national law by October 2024.
Where things stand
The obligations are already live. What lies ahead is court enforcement against the laggard states and the first scheduled review.
Today
Spacing proportional to time from today
18 Oct 2024
now in effect
NIS2 applies; national enforcement live and first fines issued
15 Aug 2026
now in effect
Dutch transposition in force, closing one of the last gaps
17 Oct 2027
in 12 months
Article 40 Commission review; targeted amendments already in trilogue
Today
18 Oct 2024
now in effect
NIS2 applies; national enforcement live and first fines issued
15 Aug 2026
now in effect
Dutch transposition in force, closing one of the last gaps
17 Oct 2027
in 12 months
Article 40 Commission review; targeted amendments already in trilogue
Behind us: in force since January 2023; transposition deadline passed October 2024; reasoned opinions to 19 member states May 2025; Ireland, Spain, France, and the Netherlands referred to the CJEU July 2026.
Does NIS2 apply to you?
Pick your sector and size below for a first orientation. NIS2 uses a size-cap rule combined with sector classification for most entities. Certain digital and ICT service providers can also be in scope even when not established in the EU.
Quick scope check
Pick the row that fits you best. The verdict updates as you choose.
Select a sector and a size to see where you would likely land.
Likely an essential entity
Your sector sits in Annex I, the sectors of high criticality, and you exceed the medium-enterprise ceilings, which typically means essential-entity status under Article 3(1): proactive supervision and fines of up to €10M or 2% of worldwide turnover, whichever is higher. The size test settles most cases, but some providers, DNS services and TLD registries among them, are essential regardless of size.
Likely an important entity
Your profile typically means important-entity status under Article 3(2): medium-sized Annex I organisations and Annex II organisations above the size threshold both land here, with reactive, after-the-fact supervision and fines of up to €7M or 1.4% of worldwide turnover, whichever is higher.
Likely out of scope, with exceptions
Below both thresholds most organisations fall outside NIS2. But Article 2(2) lists entities that are in scope regardless of size, including DNS service providers, TLD name registries, and trust service providers, and member states can add more.
Covered, but DORA comes first
For banking and financial market entities, DORA is lex specialis under NIS2 Article 4: where DORA covers the same ICT risk-management and incident-reporting ground, those NIS2 provisions are disapplied. NIS2 duties that DORA does not cover can still apply alongside. Start with our DORA guide.
This check gives orientation only; your actual scope turns on the Article 2 definitions and your national transposition.
The Article 2 size-cap rule
Organizations in covered sectors are in scope if they meet either threshold: 50 or more employees, or over €10M annual turnover or balance sheet.
Annex I sectors
The sectors of high criticality, mostly essential entities. They face stricter supervision and a minimum maximum fine of at least €10M / 2%.
- Energy
- Transport
- Banking
- Financial market infrastructure
- Health
- Drinking water
- Waste water
- Digital infrastructure
- ICT service management (B2B)
- Public administration
- Space
Annex II sectors
The other critical sectors, mostly important entities. They face reactive supervision and a minimum maximum fine of at least €7M / 1.4%.
- Postal and courier services
- Waste management
- Chemicals
- Food production & distribution
- Manufacturing (medical devices, electronics, machinery, motor vehicles)
- Digital providers (marketplaces, search engines, social networks)
- Research organisations
Article 26 jurisdiction for certain non-EU providers
Article 26(1)(b) applies to specific non-EU digital and ICT providers offering services in the EU: DNS service providers, TLD name registries, domain name registration service providers, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, and providers of online marketplaces, online search engines, and social networking services. These entities must designate a representative in one Member State where services are offered.
Which of the five reach you?
Answer for your company, and see the stack you actually manage. Most teams arrive here for one regulation and leave managing three.
You came for the NIS2. Tick what else is true and watch the stack grow.
A one-question check gives orientation only; actual scope turns on each regime's territorial, entity-size, and product tests.
What do you owe?
Article 21(2) of NIS2 prescribes 10 minimum cybersecurity risk-management measures that both Essential and Important entities must implement.
Risk analysis & security policies
Establish and maintain comprehensive risk analysis and information system security policies.
Incident handling
Prevention, detection, analysis, containment, response, and recovery from security incidents.
Business continuity
Backup management, disaster recovery, and crisis management procedures.
Supply chain security
Assess and manage security risks from direct suppliers and service providers.
Secure development & vulnerability handling
Security in network and information systems acquisition, development, and maintenance, including vulnerability handling and disclosure where appropriate.
Effectiveness assessment
Policies and procedures to regularly assess the effectiveness of cybersecurity measures.
Cyber hygiene & training
Basic cyber hygiene practices and cybersecurity training across staff. Article 20(2) makes specific cybersecurity training mandatory for management bodies on top.
Cryptography & encryption
Policies governing the use of cryptography and encryption where applicable.
Access control & HR security
Human resources security, access control policies, and comprehensive asset management.
Multi-factor authentication
MFA or continuous authentication, secured communications, and emergency systems.
What happens in an incident?
NIS2 introduces strict incident reporting obligations under Article 23. Organizations must report significant incidents in four stages.
| Step | Deadline | Content |
|---|---|---|
| Early warning | 24 h from becoming aware | Article 23(4)(a). Submit an early warning to the CSIRT or competent authority, indicating suspected unlawful or malicious cause and possible cross-border impact. |
| Incident notification | 72 h from becoming aware | Article 23(4)(b). Provide an initial assessment including severity, impact, and indicators of compromise; updates the early warning. |
| Intermediate report | On request while the incident is being handled | Article 23(4)(c). On request from the CSIRT or competent authority, provide relevant status updates. |
| Final report | 1 month after the 72-hour notification | Article 23(4)(d). Deliver root cause analysis, mitigation measures applied, and any cross-border impact. Article 23(4)(e) adds progress reports for ongoing incidents. |
What happens if you get it wrong?
Article 34 sets minimum maximum administrative fines: member states must allow at least the figures below, and national law may set higher caps.
Essential entities
Article 34(4)
Important entities
Article 34(5)
Pick a global annual turnover to draw both tiers to scale.
At €50M global turnover the fixed amounts set the ceiling: 2% is only €1M and 1.4% is €0.7M, so the maximums stay at €10M and €7M. The notch marks each percentage amount.
At €250M global turnover the fixed amounts set the ceiling: 2% is only €5M and 1.4% is €3.5M, so the maximums stay at €10M and €7M. The notch marks each percentage amount.
At €2B global turnover the percentages set the ceiling: 2% is €40M and 1.4% is €28M. The notch marks the fixed €10M and €7M amounts they overtake.
At €10B global turnover the percentages set the ceiling: 2% is €200M and 1.4% is €140M. The notch marks the fixed €10M and €7M amounts they overtake.
The higher of the fixed amount and the percentage applies. Article 34 sets minimum maximums for infringements of the Article 21 measures and Article 23 reporting duties: member states must allow at least these fines and may go higher. Essential entities face proactive supervision under Article 32; important entities are supervised reactively under Article 33, after the fact.
Fines are not the only lever. Under Article 20, management bodies must approve and oversee the Article 21 cybersecurity risk-management measures and can be held liable for failures. For essential entities, authorities can also request a temporary ban on CEO or legal-representative duties under Article 32(5).
How regimes stack on one AI system
NIS2 regulates the infrastructure AI systems run on. Here is how one system accumulates duties across regimes.
Worked example · SYS-04 · credit-scoring model at an EU-serving bank
Credit scoring is Annex III point 5(b): the model is a high-risk AI system.
- Articles 9 to 17 high-risk stack
- Conformity assessment
- EU database registration
Personal data runs through training, inputs, and outputs, and a solely automated credit denial is an Article 22 decision.
- Lawful basis for each processing purpose
- Article 35 DPIA
- Data-subject rights incl. Article 22
At a financial entity, the model is ICT supporting a critical or important function.
- Chapter II ICT risk management
- Major-incident reporting
- Register of information entry
For financial entities NIS2 is largely disapplied: DORA is lex specialis under NIS2 Article 4. Run the same model at an energy or health company and the Article 21 measures attach instead.
- Article 21 cybersecurity measures (where in scope)
- 24h early warning, 72h notification
If the model ships to the bank as licensed software, it is a product with digital elements and the vendor carries manufacturer duties. Run purely as an internal model or hosted service, it stays outside the CRA and the entity regimes above cover it.
- Annex I secure-by-design & vulnerability handling
- Article 14 reporting (24h/72h)
- Article 12 bridge to AI Act Article 15
The regimes overlap where the controls live. Map controls once, keep one evidence record, and reuse it across every regime that attaches; the Modulos platform is built on that working model.
The regimes overlap where the controls live
The governance graph maps every control in the framework library to every regulation it serves. Where regimes map the same control, one implementation and one evidence record can support all of them, subject to each regime's own requirements, and most of NIS2's controls already serve at least one other framework.
Framework library v1.0.32
How the work gets done
Modulos gives compliance and security teams one workflow for requirements, controls, evidence, reviews, and exports. This helps you move faster from legal text to operational execution with clearer ownership and stronger auditability.
Turn legal obligations into assigned work
Translate NIS2 obligations into structured requirements and mapped controls so teams know exactly what needs to be done and by whom.
Reuse controls where requirements overlap
Map one control to multiple requirements when obligations overlap, reducing duplicate implementation and evidence effort across governance programs.
Keep evidence tied to execution
Attach evidence directly to controls and keep a durable trail of updates, reviewers, and decisions connected to each requirement.
Prove governance decisions
Use review statuses and structured approvals to show who validated what, when, and on which basis before marking work complete.
Export point-in-time audit packs
Generate project and control exports plus supporting evidence files to build point-in-time packages for internal and supervisory review.
Keep scope stable as requirements evolve
Manage framework scope deliberately, including updates and freeze points, so compliance work remains stable as your program matures.
How NIS2 fits with other frameworks
Most security teams run NIS2 alongside other regimes rather than instead of them. Article 21(2) of NIS2 maps directly onto the controls in ISO/IEC 27001 for information security; ISO/IEC 42001 supports the AI-management portion indirectly. There is no formal presumption of conformity, but most mature security programs run NIS2 inside an ISO/IEC 27001 management system.
For financial sector entities, Article 4 of NIS2 disapplies equivalent NIS2 risk-management and incident-reporting provisions where the Digital Operational Resilience Act (DORA) covers the same matter. NIS2 governance and supply-chain provisions that are not covered by DORA may still apply alongside.
For AI systems specifically, the EU AI Act and GDPR sit alongside NIS2 with overlapping risk-management and supply-chain expectations. Risk operating models such as the NIST AI RMF support the Article 21(2)(a) risk-analysis duty without substituting for it.
On the product side, the Cyber Resilience Act secures the software and hardware NIS2 entities buy and ship. The regimes complement each other: NIS2 regulates the organization and the CRA the product, but a vendor that is also an essential or important entity answers to both, including separate reporting tracks once CRA reporting starts on 11 September 2026.
For US-attestation work, SOC 2 control sets often share evidence with NIS2 cybersecurity-measure controls, especially around access, change, and incident management.
FAQ about NIS2
The NIS2 Directive (Directive (EU) 2022/2555) is the EU’s updated cybersecurity legislation, replacing the original NIS Directive of 2016. It expands the scope of regulated entities, raises baseline cybersecurity requirements, and tightens incident reporting obligations. EU member states had to transpose NIS2 into national law by 17 October 2024.
NIS2 stands for the second Network and Information Security Directive (Directive (EU) 2022/2555). It is the EU’s second-generation cybersecurity framework for essential and important entities, replacing Directive (EU) 2016/1148. NIS2 raises baseline cybersecurity requirements, expands sectoral scope, and tightens incident reporting across 18 sectors.
The NIS2 Directive entered into force on 16 January 2023. EU member states were required to transpose it into national law by 17 October 2024 under Article 41, with NIS2 applicable and the original NIS Directive (2016/1148) repealed from 18 October 2024 under Article 44. On 8 July 2026 the European Commission referred Ireland, Spain, France, and the Netherlands to the Court of Justice for incomplete transposition. Verify the country-specific implementation status before relying on national readiness.
Yes, for entities in scope. NIS2 is binding EU law transposed into national legislation across the member states. In-scope essential and important entities must implement the Article 21(2) cybersecurity risk-management measures and the Article 23 incident reporting obligations. Non-compliance exposes entities to Article 34 administrative fines, with additional enforcement powers for essential entities under Article 32.
NIS2 covers two annexes. Annex I lists sectors of high criticality (energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management (B2B), public administration, space). Annex II lists other critical sectors (postal and courier services, waste management, chemicals, food, manufacturing, digital providers, research). Article 3 then sets the classification rule for essential vs important status, based on sector, entity size, special provider categories, and Member State CER identification.
Medium and large entities (≥ 50 employees or > €10M annual turnover or balance sheet) operating in the 18 sectors listed in Annexes I and II. Article 2(2) also brings certain entities into scope regardless of size, including DNS service providers, TLD name registries, trust service providers, and specific public electronic communications providers. Non-EU digital and ICT providers in the Article 26(1)(b) categories that offer those services in the EU also fall under Article 26 jurisdiction in addition to the Article 2 scope rules.
The UK has not adopted NIS2; it follows the UK NIS Regulations 2018, with a UK Cyber Security and Resilience Bill introduced to Parliament in November 2025 as the planned NIS2-equivalent reform. UK companies that fall within the Article 26(1)(b) provider categories (DNS, TLD, domain registration, cloud, data centre, CDN, managed services, managed security services, online marketplaces, search engines, social platforms) and offer those services in the EU may fall under NIS2 jurisdiction for those services. The UK domestic regime and EU NIS2 obligations can apply simultaneously.
Article 21(2) sets ten cybersecurity risk-management measures: (a) risk-analysis and information-system security policies; (b) incident handling; (c) business continuity, backup, and crisis management; (d) supply-chain security; (e) security in network and information-system acquisition, development, and maintenance with vulnerability handling; (f) effectiveness assessment of risk-management measures; (g) basic cyber hygiene and cybersecurity training; (h) cryptography policies; (i) human-resources security, access control, and asset management; (j) multi-factor authentication and secured communications. Article 23 adds incident-reporting obligations on top.
Article 23(4) sets four stages for significant incidents: (a) an early warning to the CSIRT or competent authority within 24 hours of becoming aware; (b) an incident notification within 72 hours of awareness, with an initial severity and impact assessment; (c) an intermediate report on request; (d) a final report within one month of the incident notification under (b). For ongoing incidents, a progress report is also required.
For infringements of the Article 21(2) measures or the Article 23 reporting obligations, Article 34 requires member states to allow administrative fines of at least €10 million or 2% of total worldwide annual turnover (whichever is higher) for essential entities, and at least €7 million or 1.4% for important entities. National caps may be set higher. Article 20 makes management bodies responsible for approving and overseeing the Article 21(2) measures and exposes them to individual liability. For essential entities, supervisory authorities can also exercise the exceptional Article 32(5) power to request a temporary prohibition of CEO or legal-representative duties when measures remain ineffective.
Most NIS2 Article 21(2) risk-management measures map directly to ISO/IEC 27001 controls. Holding ISO/IEC 27001 certification does not satisfy NIS2 by itself: there is no formal presumption of conformity in the directive. It does provide a defensible operational baseline that significantly reduces NIS2 implementation effort, which is why most mature security programs operate ISO/IEC 27001 inside their NIS2 compliance approach.
Modulos automates the governance, risk, and compliance workflow that NIS2 Article 21(2) expects: risk-management policy documentation, incident-response evidence, supply-chain risk records, and audit trails for security controls. Controls map across NIS2, ISO/IEC 27001, ISO/IEC 42001, the EU AI Act, and SOC 2 simultaneously, so one evidence pipeline serves multiple frameworks.
By industry
How this applies in your sector
See how this plays out in the sectors where it drives the most AI governance work:
Where the NIS2 work goes next
Talk to an expert
Walk through the Article 21(2) measures with someone who has taken security programs through them.
Book a NIS2 demo →Keep exploring on your own
The framework docs cover NIS2 measure by measure, and the governance graph shows the overlap with ISO/IEC 27001 and DORA.