NIS2

Nothing changed in the last 90 days. Sign in to read further back.

1. 2027-10-17 in 342 days Commission's first review of how the Directive works is due, then every 36 months (Article 40)
2. 2026-07-08 Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice for not notifying full transposition, asking for a lump sum and daily penalties
3. 2026-01-20 Commission proposes NIS2 simplification amendments, COM(2026) 13
4. 2025-11-19 Commission proposes a single-entry point for incident reporting in the Digital Omnibus, COM(2025) 837
5. 2025-06-26 ENISA publishes its technical implementation guidance for Implementing Regulation (EU) 2024/2690

1. 2026-01-20
   NIS2 simplification proposal, COM(2026) 13 Draft

   Commission proposal amending Directive (EU) 2022/2555 as regards simplification measures and alignment with the proposed Cybersecurity Act 2. source

   More

   • Not adopted; the European Parliament lists procedure 2026/0012(COD) as awaiting a committee decision, with a committee draft report dated 24 September 2026.
2. 2025-11-19
   Digital Omnibus proposal, COM(2025) 837 Draft

   Commission proposal whose Article 6 adds a single-entry point for incident reporting, run by ENISA (new Article 23a), and routes NIS2 incident notifications through it. source

   More

   • A severe-incident report made by a manufacturer under Article 14(3) of the Cyber Resilience Act would also count as NIS2 reporting where it contains the required information.
   • Not adopted; the European Parliament lists procedure 2025/0360(COD) as awaiting a committee decision.
3. 2023-12-22
   Directive (EU) 2022/2555 (as corrected 2023) ErrataCurrent text

   Corrigendum to the English text of Article 19(1): the Cooperation Group establishes the peer-review methodology "by", not "on", 17 January 2025. source

   More

   • EUR-Lex lists nine corrigenda; this one (R(04)) is the only one that corrects the English version.
4. 2022-12-14
   Directive (EU) 2022/2555 Major version

   The NIS 2 Directive, published in OJ L 333 of 27 December 2022. source

   More

   • It repealed Directive (EU) 2016/1148 (NIS1) with effect from 18 October 2024.

NIS2 covers medium-sized and larger entities in the sectors of its Annexes I and II that operate in the EU, plus some entities regardless of size.

Size rule

It applies to entities of a type in Annex I or II that qualify as medium-sized enterprises or exceed those ceilings and provide services or carry out activities in the EU (Article 2(1)). source

Any size

Providers of public electronic communications networks or services, trust service providers, TLD registries and DNS providers, domain name registration services, sole national providers of an essential service, and entities identified as critical under the CER Directive (Article 2(2)-(4)). source

Public administration

Central government entities, and regional ones after a risk-based assessment; Member States may add local public administration and education institutions (Article 2(2)(f) and 2(5)). source

Essential or important

Essential entities include large Annex I entities, qualified trust service providers, TLD registries, DNS providers, central government and critical entities; most other in-scope entities are important entities (Article 3). source

Excluded

Public administration entities working in national security, public security, defence or law enforcement (Article 2(7)). For financial entities covered by DORA, DORA's ICT risk and incident rules apply instead (recital 28). source

There is no certificate: entities take the risk-management measures themselves, and national authorities supervise them, proactively for essential entities and after the fact for important ones.

Risk-management measures

Take appropriate technical, operational and organisational measures on an all-hazards basis, covering at least the areas listed in Article 21(2), including incident handling, business continuity, supply chain security and multi-factor authentication. source

Management body

The management body must approve the measures, oversee their implementation, can be held liable for infringements of Article 21, and must follow training (Article 20). source

Incident reporting

For a significant incident: early warning within 24 hours, incident notification within 72 hours, final report within one month after the notification (Article 23(4)). source

Digital providers

For DNS, cloud, data centre, CDN, managed (security) service providers, online marketplaces, search engines, social networks and trust service providers, Implementing Regulation (EU) 2024/2690 sets the technical requirements and when an incident is significant. source

Essential entities

Authorities can run on-site inspections, random checks, regular and targeted security audits by an independent body, ad hoc audits and security scans (Article 32(2)). source

Important entities

Authorities act ex post, when given evidence or indications of non-compliance, with inspections, targeted audits and information requests (Article 33). source

Certification

Member States may require certain ICT products, services or processes certified under European cybersecurity certification schemes (Article 24). source

National competent authorities enforce the national laws that transpose NIS2; the Directive sets the minimum fine ceilings those laws must allow.

Who enforces

Each Member State designates one or more competent authorities for supervision and a single point of contact (Article 8). source

Managers

For essential entities, authorities can seek a temporary ban on a CEO or legal representative exercising managerial functions if ordered fixes are not made (Article 32(5)). source

Transposition cases

The Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice on 8 July 2026 for not notifying full transposition. source

1. Law text Directive (EU) 2022/2555 (NIS 2 Directive)
2. Law text Commission Implementing Regulation (EU) 2024/2690 - risk-management measures and significant incidents for digital infrastructure and digital providers
3. Guidance ENISA NIS2 Technical Implementation Guidance (v1.0)
4. Law text Digital Omnibus proposal COM(2025) 837 (amends NIS2; not adopted)
5. Law text NIS2 simplification proposal COM(2026) 13 (not adopted)

1. CER Directive

   Adopted the same day for the physical resilience of critical entities; every entity identified as critical under CER is also in NIS2 scope regardless of size.

2. DORA

   The financial-sector regulation whose ICT risk, incident reporting and testing rules apply to financial entities instead of NIS2's.

3. CRA

   Sets security requirements for products with digital elements and binds manufacturers, while NIS2 binds the entities that operate services.

4. UK NIS Regulations

   The UK's regulations based on the first NIS Directive; NIS2 does not apply in the UK.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 7 September 2026. Subscribe to NIS2 (RSS)