NIS2 Directive: Who It Applies To, Duties and Deadlines
NIS2 is the EU cybersecurity law for medium and large organisations in critical sectors. It requires a set of risk-management measures approved by management, incident reports within 24 hours, 72 hours and one month, and it carries fines of at least EUR 10 million or 2% of worldwide turnover for essential entities.
It is a directive, so it applies through each Member State's own law; check your national implementation and supervisor. Everything below is from the Directive's text. Last reviewed 12 November 2026. Not legal advice.
Updated 12 November 2026
Who is in scope
- Sector: the entity is of a type listed in Annex I (sectors of high criticality) or Annex II (other critical sectors).
- Size: it is at least a medium-sized enterprise under the EU SME definition (Recommendation 2003/361/EC). Small and micro entities are generally out.
- Regardless of size: some types are in anyway, including public electronic communications providers, trust service providers, TLD registries, DNS providers, domain registration services, certain public administration entities, and sole providers of an essential service in a Member State.
Annex I sectors: energy; transport; banking; financial market infrastructures; health; drinking water; waste water; digital infrastructure; ICT service management (business-to-business); public administration; space. Annex II lists further sectors; read it in the Directive to confirm whether yours is there.
The ten risk-management measures (Article 21)
Measures must be "appropriate and proportionate", and include at least:
- Policies on risk analysis and information system security.
- Incident handling.
- Business continuity, such as backup management and disaster recovery, and crisis management.
- Supply chain security, including relationships with direct suppliers and service providers.
- Security in acquiring, developing and maintaining systems, including vulnerability handling and disclosure.
- Policies and procedures to assess whether the measures are effective.
- Basic cyber hygiene practices and cybersecurity training.
- Policies on cryptography and, where appropriate, encryption.
- Human resources security, access control policies and asset management.
- Multi-factor or continuous authentication, secured voice, video and text, and secured emergency communications, where appropriate.
Useful starting points: an incident response plan, a risk register, and phishing-resistant MFA (see FIDO2 and NIS2).
Incident reporting (Article 23)
| Report | Deadline |
|---|---|
| Early warning | Without undue delay, within 24 hours of becoming aware of a significant incident |
| Incident notification | Without undue delay, within 72 hours of becoming aware |
| Final report | Not later than one month after the incident notification (a progress report instead if the incident is still ongoing) |
Your national law names who receives the reports. Rehearse the 24-hour step: it is the one most plans miss.
Management accountability and fines
- Management bodies approve the measures, oversee them, can be held liable, and must follow training (Article 20).
- Essential entities: maximum fines of at least EUR 10 million or 2% of worldwide annual turnover, whichever is higher (Article 34).
- Important entities: at least EUR 7 million or 1.4%, whichever is higher.
Frequently asked questions
What is NIS2?
NIS2 is Directive (EU) 2022/2555 of 14 December 2022, the EU law on a high common level of cybersecurity. It replaced the original NIS Directive (2016/1148) from 18 October 2024. As a directive it works through national laws: Member States had to adopt and publish their measures by 17 October 2024 and apply them from 18 October 2024, so the exact duties depend on the country you operate in.
Who does NIS2 apply to?
Public or private entities of a type listed in Annex I (sectors of high criticality) or Annex II (other critical sectors) that are at least medium-sized under the EU SME definition. Some types are covered regardless of size, including public electronic communications providers, trust service providers, top-level domain registries and DNS providers, and certain public administration entities.
What is the difference between essential and important entities?
Essential entities are mainly Annex I entities that exceed the medium-sized ceilings, plus certain types regardless of size (for example qualified trust service providers, TLD registries and DNS providers). Any Annex I or II entity in scope that is not essential is an important entity. Both must apply the same risk-management measures and report incidents; the difference is mainly in supervision and the maximum fines.
What are the NIS2 reporting deadlines?
For a significant incident (Article 23): an early warning without undue delay and in any event within 24 hours of becoming aware of it; an incident notification within 72 hours; and a final report not later than one month after the incident notification. If the incident is still ongoing at that point, a progress report is due then and the final report within one month of handling it.
What counts as a significant incident?
Article 23(3): one that has caused or is capable of causing severe operational disruption of the services or financial loss for the entity, or that has affected or is capable of affecting other people by causing considerable material or non-material damage.
What are the NIS2 fines?
Article 34 sets the floor for national maximums. Essential entities: a maximum of at least EUR 10 million or 2% of total worldwide annual turnover, whichever is higher. Important entities: at least EUR 7 million or 1.4%, whichever is higher. Turnover is that of the undertaking the entity belongs to.
Are directors personally responsible under NIS2?
Article 20 requires management bodies to approve the cybersecurity risk-management measures, oversee their implementation, and be able to be held liable for infringements. Members of management bodies must follow training.