NIS2 in plain words: does it apply to you, and what to do
NIS2 is the EU's cybersecurity law for organisations that keep the economy running. Here's who it covers, what it asks, and the smallest serious steps to get ready.
In 30 seconds
- What
- An EU directive, (EU) 2022/2555, replacing the 2016 NIS directive. It binds organisations through each country's national law.
- Who
- Generally medium and large organisations in 18 listed sectors: 50+ staff, or more than €10M in turnover and balance sheet. Some are covered whatever their size.
- Two classes
- Essential or important entities, with the same security duties but different supervision and fines.
- Duties
- Security measures in 10 areas, approved and overseen by management, who must also be trained.
- Incidents
- Significant incidents reported in stages: 24 h early warning, 72 h notification, 1 month final report.
- Key dates
- Adopted 14 Dec 2022. National laws were due by 17 Oct 2024. On 20 Oct 2026, 24 of the 27 EU countries have one in force; France, Ireland and Spain don't yet.
- Supply chain
- Your customers may pass NIS2 requirements down to you through questionnaires and contracts.
What NIS2 is
NIS2 is a European directive adopted in December 2022 to raise the level of cybersecurity across the EU. It replaces the first NIS directive of 2016, covers many more sectors, and makes the people who run the organisation responsible for it.
A directive doesn’t apply to companies directly. Each EU country writes it into national law, which sets the exact obligations, the authority you deal with, and the deadlines. The EU deadline for that was 17 October 2024; three countries still have no law in force, France among them.
Who is in scope
Three questions, in order: is one of your activities in a listed sector, are you at least medium-sized, and are you one of the cases covered whatever the size.
Annex I: high criticality 11 sectors
Annex II: other critical 7 sectors
The annexes define each sector by precise activities and legal references. Matching your company needs the annex text, so treat this list as a first filter.
The size rule
Generally, NIS2 covers medium and large organisations, using the EU’s SME definition: 50 or more staff, or more than €10M in annual turnover and balance sheet total. Below that, you’re usually out of scope.
Count the whole group. Partner and linked companies are added in, so a 40-person subsidiary of a large group usually isn’t “small”, with national variations. Some organisations are covered whatever their size: public telecoms providers, trust service providers, DNS providers and top-level domain registries, domain registration services, and organisations your country designates as critical.
Essential or important?
If you’re in scope, you’re one of two classes. The security work is the same; what changes is how closely you’re supervised, and the maximum fines.
Essential entity
Typically large organisations in Annex I sectors, plus some providers whatever their size (qualified trust services, DNS, top-level domain registries) and designated entities.
- Supervision
- Proactive (audits, inspections) and after incidents
- Max. fines
- At least €10M or 2% of worldwide turnover, whichever is higher
Important entity
Other in-scope organisations: for example medium-sized companies in Annex I sectors, and in-scope Annex II companies.
- Supervision
- After the fact, when there's evidence of a problem
- Max. fines
- At least €7M or 1.4% of worldwide turnover, whichever is higher
These are the minimum ceilings each country must allow; actual amounts come from national law.
The 10 measures you need in place
Article 21 lists ten areas. They must be proportionate to your size and risks, so a 60-person IT provider and a national energy operator will do different things. It’s good security practice, written down.
- Risk analysis and security policiesKnow your risks, write the rules.
- Incident handlingDetect, respond, learn.
- Business continuityBackups, disaster recovery, crisis management.
- Supply chain securityYour suppliers and IT providers included.
- Secure acquisition and developmentIncluding vulnerability handling and disclosure.
- Checking that it worksPolicies to assess the measures' effectiveness.
- Cyber hygiene and trainingFor all staff.
- CryptographyAnd encryption where it makes sense.
- People, access and assetsHR security, access control, asset inventory.
- MFA and secure communicationsIncluding emergency communications.
Management is accountable
This is the biggest change from the first NIS directive. Under article 20, the management body approves the security measures, oversees them, and can be held liable if the organisation fails to comply. Managers must also follow training so they can judge risks and the measures taken. The directive sets no format or frequency for that training; national law may.
In practice: a short, recorded approval of your security plan, a regular review on the management agenda, and a training session for the managers themselves.
Reporting a significant incident
An incident is significant if it has caused, or could cause, severe disruption or financial loss for you, or considerable damage to others. You report it to your national CSIRT or competent authority, in stages. The clock starts when you become aware of it, even if the investigation is still running.
- T0AwareYou become aware of a significant incident.
- Within24 hEarly warning, saying whether it looks malicious or cross-border.
- Within72 hIncident notification: first assessment, severity, impact.
- Within1 monthFinal report, one month after the notification.
One incident, several clocks. If personal data is involved, GDPR has its own 72-hour notification to the data protection authority. Your cyber insurer and your customers’ contracts may set their own deadlines too. QoBot keeps all of them on one page during an incident.
Where your country stands
Obligations, deadlines and the authority you report to come from your national law. On 20 October 2026, 24 of the 27 EU countries have a NIS2 law in force; France, Ireland and Spain don’t yet. The Commission referred those three, and the Netherlands, to the EU Court of Justice on 8 July 2026; the Dutch law has applied since 15 August 2026.
Each row links the law in the national gazette and the authority’s page. Registration dates and reporting channels differ by country: confirm them with your authority before planning around a date.
| Country | Status, checked 20 Oct 2026 | National law | Authority |
|---|---|---|---|
| Austria | In force since 1 Oct 2026. Registration due by early January 2027 | NISG 2026, BGBl. I No. 94/2025 | Federal Office for Cybersecurity · CSIRT: CERT.at |
| Belgium | In force since 18 Oct 2024 | Law of 26 April 2024 (NIS2 law) | Centre for Cybersecurity Belgium (CCB), also the national CSIRT |
| Bulgaria | In force: published 13 Feb 2026 | Amended Cybersecurity Act, State Gazette No. 17/2026 | Sector authorities named by the Council of Ministers: check with CERT Bulgaria, the national CSIRT |
| Croatia | In force since 15 Feb 2024 | Cybersecurity Act, NN 14/2024 | National Cyber Security Centre (NCSC-HR) · CSIRT: also CARNET CERT |
| Cyprus | In force since 25 Apr 2025 | Law 60(I)/2025, amending Law 89(I)/2020 | Digital Security Authority · CSIRT: CSIRT-CY |
| Czechia | In force since 1 Nov 2025 | Act No. 264/2025 Coll. on cybersecurity | NÚKIB, National Cyber and Information Security Agency |
| Denmark | In force since 1 July 2025 | NIS 2 Act, Act No. 434 of 6 May 2025 | Sector authorities; general guidance from SAMSIK · CSIRT: Danish Defence Intelligence Service |
| Estonia | In force since 1 Jan 2026 | Amended Cybersecurity Act, RT I 30.12.2025 | Information System Authority (RIA) · CSIRT: CERT-EE |
| Finland | In force since 8 Apr 2025 | Cybersecurity Act 124/2025 | NCSC-FI at Traficom, plus sector supervisors |
| France | Not transposed. The bill passed the Senate in March 2025 and an Assemblée nationale committee in September 2025, with no plenary debate since | Bill on critical infrastructure resilience and cybersecurity | ANSSI: eligibility test, voluntary pre-registration |
| Germany | In force since 6 Dec 2025. The registration period has passed | NIS2 Implementation Act, BGBl. 2025 I No. 301 | BSI, Federal Office for Information Security |
| Greece | In force since 27 Nov 2024 | Law 5160/2024, Government Gazette A’ 195 | National Cybersecurity Authority |
| Hungary | In force since 1 Jan 2025 | Act LXIX of 2024 on the cybersecurity of Hungary | SZTFH, Supervisory Authority for Regulated Activities · CSIRT: NKI |
| Ireland | Not transposed. The National Cyber Security Bill isn’t published yet; the 2018 NIS Regulations still apply | Government legislation programme, autumn 2026 | National Cyber Security Centre |
| Italy | In force since 16 Oct 2024. Registration each year, 1 Jan to 28 Feb | Legislative Decree 138/2024 | ACN, National Cybersecurity Agency |
| Latvia | In force since 1 Sep 2024 | National Cybersecurity Law | National Cyber Security Centre · CSIRT: CERT.LV |
| Lithuania | In force since 18 Oct 2024 | Cybersecurity Law, as amended by Law No. XIV-2902 | National Cyber Security Centre (NKSC), also CERT-LT |
| Luxembourg | In force since 10 May 2026 | Law of 5 May 2026 on cybersecurity | ILR; CSSF for the financial sector |
| Malta | In force since 23 Jan 2026 | Subsidiary Legislation 460.41 | Critical Infrastructure Protection Department, named in the regulations: check with it |
| Netherlands | In force since 15 Aug 2026 | Cybersecurity Act (Cbw) and its decree, Stb. 2026, 187 and 189 | NCSC-NL for registration; sector supervisors |
| Poland | In force since 3 Apr 2026. Self-registration closed on 3 Oct 2026 | Amended National Cybersecurity System Act, Dz.U. 2026 item 252 | Ministry of Digital Affairs and sector authorities · CSIRTs: NASK, GOV, MON |
| Portugal | In force since April 2026, 120 days after publication | Decree-Law 125/2025 | National Cybersecurity Centre (CNCS), also CERT.PT |
| Romania | In force: Emergency Ordinance 155/2024, published 31 Dec 2024, approved by Law 124/2025 | Senate file of the 2026 amendment | National Cyber Security Directorate (DNSC) |
| Slovakia | In force since 1 Jan 2025 | Act No. 366/2024, amending the Cybersecurity Act | National Security Authority (NBÚ) · CSIRT: SK-CERT |
| Slovenia | In force since 19 June 2025 | Information Security Act (ZInfV-1) | Government Information Security Office · CSIRT: SI-CERT |
| Spain | Not transposed. The government approved a draft in first reading in January 2025; it never reached Parliament, which was dissolved on 6 Oct 2026 for the 29 Nov elections. The 2018 NIS law still applies | Royal Decree-law 12/2018 (NIS1, in force) | INCIBE-CERT for companies, CCN-CERT for the public sector |
| Sweden | In force since 15 Jan 2026 | Cybersecurity Act (2025:1506) | NCSC at FRA · CSIRT: CERT-SE |
Sources: each country's gazette and authority, read on 20 October 2026, and the Commission's press release IP/26/1499. The Commission's per-country NIS2 pages were last updated in July 2025, so this table doesn't rely on them. Bulgaria's sector authorities, Malta's authority website and Romania's entry-into-force day couldn't be confirmed on an official page.
The UK sits outside NIS2. It has its own Network and Information Systems Regulations 2018: operators of essential services in energy, transport, health, drinking water and digital infrastructure, plus online marketplaces, search engines and cloud services, report incidents to their sector regulator within 72 hours. The Cyber Security and Resilience Bill would bring medium and large managed service providers and data centres into scope, with a 24-hour first notice and a full report within 72 hours. On 20 October 2026 it had passed the House of Commons and committee stage in the House of Lords, with Lords report stage set for 26 October; it isn’t law yet. UK central government and NHS buyers expect Cyber Essentials from suppliers that handle personal data or government information.
If you’re not in scope
NIS2 can reach you even when you’re out of scope. In-scope organisations must manage the security of their supply chain, so expect their questionnaires, contract clauses and audit requests. The same ten measures answer most of those questions.
Getting NIS2-ready: who does what
What QoBot does
- Checks whether NIS2 applies to you, and explains why.
- Runs the gap analysis against the 10 measures, from what you already have.
- Writes the policies and the plan, and decides the order.
- Prepares your incident playbook with every reporting clock.
- Follows up each week and tells you honestly what's still open.
What your team does
- Management approves the measures and follows the training.
- Your team applies the actions with QoBot's step-by-step guides.
- You answer what only you know: your tools, suppliers, people.
- A few short, explained tasks a week, each with a time estimate.
You'd likely be an important entity under your country's NIS2 law. 7 of the 10 areas are partly in place. Next steps this week:
- Hugo: turn on MFA for the VPN · guide ready · ~20 minYour turn
- You: approve the security policy v1 · ~10 minNeeds you
FAQ
Is NIS2 mandatory in my country today?
Only once your country's transposition law is in force. The directive binds EU countries, which then bind organisations through national law. On 20 October 2026 that's the case in 24 of the 27 EU countries; France, Ireland and Spain haven't transposed it yet. The table Where your country stands links each law and authority. Where the law isn't in force, getting ready still makes sense: the measures are good practice, and your customers may already ask for them.
We have 35 employees. Are we out of scope?
Usually, if you're independent and your turnover or balance sheet is €10M or less. Count your group, though, and check the cases covered whatever the size: telecoms, trust services, DNS, domain registration, and organisations your country designates.
Does ISO 27001 make us NIS2-compliant?
It covers much of the same ground: risk analysis, policies, incident handling, suppliers, access control. It doesn't give you, on its own, the management training of article 20, the reporting deadlines of article 23, or registration with your national authority. See ISO 27001 in plain words.
What's the difference with DORA?
DORA, Regulation (EU) 2022/2554, is the digital resilience law for the financial sector (banks, insurers, investment firms and others). It applies since 17 January 2025. For those entities, DORA's rules on ICT risk and incidents take precedence over NIS2's on the same topics.
Do we need to register somewhere?
Yes, once your national law applies. In-scope organisations give their authority basic details (name, contacts, sector, countries where they provide services) and report changes within two weeks. The procedure and dates come from national law, and several deadlines have passed: Germany's, Poland's (3 October 2026) and Luxembourg's (10 July 2026), for example. Austria's runs to early January 2027. In France, where the law isn't passed, ANSSI offers a voluntary pre-registration.
We're in the UK. Does NIS2 apply to us?
Not as UK law: the UK left the EU before NIS2 and has its own NIS Regulations 2018, which a Cyber Security and Resilience Bill is set to update. NIS2 can still reach you through an EU subsidiary, through EU services you provide (the directive asks non-EU providers of some digital services to name a representative in the EU), or through EU customers' contracts.
Can QoBot certify that we're NIS2-compliant?
No. NIS2 has no compliance certificate, and software can't certify compliance. QoBot gets you ready, documents what's in place, and tells you what an authority or auditor would look for.
Sources
- Directive (EU) 2022/2555 (NIS2)EUR-Lex · OJ L 333, 27.12.2022 · arts. 2, 3, 20, 21, 23, 26, 32 to 34, 41, Annexes I and IIOfficial text
- Implementing Regulation (EU) 2024/2690EUR-Lex · technical measures and significant incidents for digital providersOfficial text
- Recommendation 2003/361/ECEUR-Lex · definition of micro, small and medium-sized enterprisesOfficial text
- Regulation (EU) 2022/2554 (DORA)EUR-Lex · digital operational resilience for the financial sectorOfficial text
- European Commission press release IP/26/1499Ireland, Spain, France and the Netherlands referred to the Court of Justice, 8 July 2026Official page
- French NIS2 bill: legislative fileAssemblée nationale · status checked 20 October 2026Official page
- ANSSI NIS2 portal (France)Eligibility test, voluntary pre-registration, ReCyFOfficial page
- The Network and Information Systems Regulations 2018 (UK)legislation.gov.uk · SI 2018/506, regs. 3, 8, 11, 12Official text
- Cyber Security and Resilience (Network and Information Systems) Bill (UK)UK Parliament · Lords report stage set for 26 October 2026, status checked 20 October 2026Official page
- Cyber Security and Resilience Bill: factsheetsGOV.UK, DSIT · managed service providers, data centres, incident reportingOfficial page
This page explains the rules in plain words. It isn't legal advice: for a borderline case, ask a lawyer. Report an error