NIS2 Directive Guide (2026): Scope, Requirements, Reporting and Fines

Who it applies to

Sectors of high criticality (European Commission):

• energy
• transport
• banking and financial market infrastructures
• health, including pharmaceutical manufacturing
• drinking water and waste water
• digital infrastructure: IXPs, DNS, TLD registries, cloud, data centres, CDNs, trust services and electronic communications
• ICT service management: MSPs and MSSPs
• public administration
• space

Other critical sectors (European Commission):

• postal and courier services
• waste management
• chemicals
• food
• manufacturing of medical devices, electronics, machinery and vehicles
• digital providers: marketplaces, search engines and social networks
• research organisations

A size threshold brings all medium and large companies in these sectors into scope. Member States can also designate smaller high-risk entities. Entities are classed as essential or important, and each class has a different supervisory regime (European Commission).

Jurisdiction (European Commission):

• As a rule, an entity falls under the Member State where it is established. An entity established in several Member States falls under each of them.
• Telecoms providers fall under each Member State where they provide services.
• DNS, TLD, cloud, data centre, CDN, MSP and MSSP providers and online platforms fall under the Member State of their main establishment in the EU. ENISA keeps a registry of these entities.

For the financial sector, DORA applies instead of NIS2 for cybersecurity risk management and reporting (European Commission).

Germany shows the scale. Its implementing act came into force on 6 December 2025 and widened BSI supervision from about 4,500 to about 29,500 entities. Entities must check for themselves whether they are covered (BSI).

Key requirements

Risk-management measures

NIS2 lists 10 key elements that every entity must address. These include incident handling, supply chain security, vulnerability handling and disclosure, and cryptography and encryption (European Commission).

For digital infrastructure, ICT service management and digital providers, Implementing Regulation (EU) 2024/2690 of 17 October 2024 sets detailed requirements (ENISA). ENISA's June 2025 guidance covers these areas (ENISA guidance):

• network and information security policy
• risk management
• incident handling
• business continuity and crisis management
• supply chain
• secure acquisition and development
• effectiveness assessment
• cyber hygiene and training
• cryptography
• HR security
• access control
• asset management
• physical security

Management accountability

NIS2 makes senior management accountable for compliance (European Commission). It also introduces liability for natural persons in senior management positions (European Commission). ENISA's guidance expects management bodies to formally approve the security policy and to review it at least annually (ENISA guidance).

Incident reporting

Reporting happens in three stages (European Commission):

1. Early warning within 24 hours of becoming aware of a significant incident.
2. Incident notification within 72 hours.
3. Final report within one month.

Registration

National laws require registration. In Germany, for example, entities register through the "Mein Unternehmenskonto" account and the BSI portal, which opened on 6 January 2026 (BSI).

Certification process and timeline

NIS2 has no certification. Supervisors use audits, on-site and off-site checks, information requests and evidence reviews (European Commission). Key dates:

• January 2023: NIS2 entered into force (European Commission).
• 17 October 2024: transposition deadline; NIS1 repealed from 18 October 2024 (European Commission).
• 7 May 2025: reasoned opinions sent to 19 Member States (European Commission).
• 26 June 2025: ENISA technical implementation guidance published (ENISA).
• 19 November 2025: Digital Omnibus proposes a single entry point for incident reporting (European Commission).
• 20 January 2026: cybersecurity package proposed, including the NIS2 amendments and a small mid-cap category (European Commission).
• 8 July 2026: four Member States referred to the Court of Justice (European Commission).
• 17 October 2027: the Commission's first review report is due (European Commission).

Under the January 2026 proposal, certificates under a revised Cybersecurity Act could give a presumption of conformity with NIS2 (European Commission). This is not yet law.

Costs

The Directive sets no fees. Compliance costs are not cited.

Penalties

Member States must set maximum fines of at least (European Commission):

• essential entities: €10,000,000 or 2% of total worldwide annual turnover, whichever is higher
• important entities: €7,000,000 or 1.4% of total worldwide annual turnover, whichever is higher

Other sanctions include binding instructions and orders to implement audit recommendations. Senior managers can be held personally liable (European Commission).

Mapping to related frameworks

• DORA: takes precedence for in-scope financial entities (European Commission).
• CER Directive: critical entities under CER are also subject to NIS2 (European Commission).
• ISO/IEC 27001: ENISA maps the requirements to standards and national frameworks (ENISA).
• GDPR: the Digital Omnibus proposes a single entry point covering NIS2, GDPR, DORA and other reporting (European Commission).
• IEC 62443 and ISO 22301: support the OT security and continuity measures.

Readiness checklist

1. Determine your sector, size and essential or important status in each Member State.
2. Register with the national authority, for example the BSI portal (BSI).
3. Have management bodies approve the security policy and complete training (ENISA guidance).
4. Run a risk assessment covering the 10 key elements (European Commission).
5. Build 24-hour, 72-hour and one-month reporting workflows.
6. Map your suppliers and their security requirements.
7. Test business continuity, backups and crisis management.
8. Track national laws and the proposed amendments (European Commission).

Common pitfalls

• Assuming that no national law yet means no obligations. Laws are arriving country by country (European Commission).
• Treating NIS2 like DORA. Financial entities follow DORA (European Commission).
• No management approval or training.
• Missing the 24-hour early warning.
• Ignoring supplier risk.
• Relying on proposals before they are adopted.

How AssureCore helps

• Cross-framework Mapping reuses your ISO 27001, DORA and IEC 62443 controls for NIS2.
• The Risk Register tracks risks for each entity and sector.
• Policy Management drafts NIS2 policies with AI-assisted writing and gap analysis.
• Evidence Management keeps proof current for supervisors.
• Audit Reports (PDF/CSV) support board reporting.

Frequently asked questions

Official references

• European Commission – NIS2 Directive
• European Commission – NIS2 FAQs
• European Commission – NIS2 transposition
• European Commission – Court referrals (8 July 2026)
• European Commission – Cybersecurity Package Q&A (20 Jan 2026)
• ENISA – NIS2 Technical Implementation Guidance
• ENISA – Technical implementation guidance PDF (June 2025)
• BSI – NIS-2 implementing act in force (5 Dec 2025)
• European Commission – Digital Omnibus (19 Nov 2025)

Related frameworks

• DORA guide
• ISO 27001 guide
• NIST CSF guide
• TISAX guide