Direct answer: NIS2 (Directive (EU) 2022/2555) entered into force in January 2023, and Member States had to transpose it by 17 October 2024. It covers medium-sized and large entities in 18 critical sectors, requires cybersecurity risk management, an early warning within 24 hours, an incident notification within 72 hours and a final report within one month, and makes management accountable. Maximum fines: essential entities at least EUR 10 million or 2% of worldwide annual turnover; important entities at least EUR 7 million or 1.4%, whichever is higher. On 20 January 2026, as part of a new cybersecurity package, the Commission proposed targeted NIS2 amendments (COM(2026) 13) to simplify jurisdictional rules, streamline the collection of ransomware data, facilitate supervision of cross-border entities and reinforce ENISA's coordinating role; the Commission says this eases compliance for 28,700 companies, including 6,200 micro and small enterprises. This is a proposal, not yet law; the existing NIS2 obligations still apply.
This guide is for security, legal, compliance, IT and management teams at companies with EU operations or digital services sold into the EU, especially cloud, data centre, CDN, managed service, SaaS, online marketplace and search engine providers. Data cut-off: 7 November 2026; sources are the European Commission NIS2 policy page, the EUR-Lex Directive, the 20 January 2026 press release and the COM(2026) 13 proposal page. Official facts, editorial interpretation and items to confirm are kept separate. This is not legal advice.
(1) NIS2 is already in force and implemented through national law; the 2026 proposal is a simplification, not a pause or repeal. (2) The reporting clock starts when you become aware of a significant incident: 24h early warning, 72h notification, one-month final report; trust service providers notify within 24h. (3) Management must approve and oversee risk measures and can be held liable; supply chain security is one of the 10 minimum measures, not optional.
Timeline: from entry into force to the 2026 proposal
NIS2 was adopted by the European Parliament and Council on 14 December 2022, entered into force in January 2023 and replaced NIS1 (Directive 2016/1148). Member States had to transpose it by 17 October 2024, and NIS1 was repealed from 18 October 2024. Certain digital infrastructure/digital service providers had to submit registration information to competent authorities by 17 January 2025. On 20 January 2026, the Commission proposed COM(2026) 13, a targeted amendment, as part of a new cybersecurity package; a separate proposal to revise the Cybersecurity Act was published the same day. The proposal must complete the legislative process before becoming law; until then, the current NIS2 text and national transposition laws govern.
| Date | Event | What it means |
|---|---|---|
| 14 Dec 2022 | NIS2 adopted | Replaces NIS1 and broadens sectors/entities |
| January 2023 | NIS2 enters into force | Member State transposition period begins |
| 17 Oct 2024 | Transposition deadline | Member States must transpose into national law |
| 18 Oct 2024 | NIS1 repealed | NIS2 and national law govern |
| 17 Jan 2025 | Registration deadline (covered entities) | Digital infrastructure/digital service providers submit registration data |
| 20 Jan 2026 | COM(2026) 13 proposal | Targeted simplification; not yet law, current duties unchanged |
Sources: European Commission NIS2 policy page, EUR-Lex Directive (EU) 2022/2555, 20 January 2026 press release and COM(2026) 13 proposal page (accessed 7 November 2026). Transposition progress, registration requirements and competent authorities follow national law; proposal status follows the legislative process.
Who is in scope: sectors, size and role
NIS2 covers medium-sized and large entities (under the EU SME definition) in the 18 sectors listed in Annexes I and II, plus certain categories regardless of size, such as public electronic communications networks/services, trust services, DNS/TLD, cloud, data centre, CDN, managed services, managed security services, online marketplaces, search engines and social platforms. Annex I high-criticality sectors generally correspond to essential entities and Annex II to important entities; the final classification depends on the annexes, size rules and Member State designations. Non-EU entities that are digital infrastructure/digital service providers in Annex I/II and offer services in the EU without an EU establishment must designate an EU representative; without one, any Member State where services are offered may take legal action against the entity.
| Dimension | Key point | Check first |
|---|---|---|
| Sectors | Energy, transport, banking, financial market infrastructure, health, water, wastewater, digital infrastructure, ICT service management, public administration, space, postal, waste, chemicals, food, manufacturing, digital providers, research and other sectors in the 18-sector list | Specific subsector in Annex I/II |
| Size | Medium-sized and large entities; some categories regardless of size | Staff, turnover/balance sheet |
| Classification | Essential vs important | Annex, size, Member State designation |
| Non-EU entities | Digital infrastructure/digital service providers offering services in the EU without establishment | Whether an EU representative is required |
| Other rules | DORA has specific rules for financial entities; CRA covers products | Whether lex specialis/overlap applies |
Sources: Directive (EU) 2022/2555 Articles 2, 3 and 26 and Annexes I/II; European Commission NIS2 policy page (accessed 7 November 2026). This is an editorial summary; sector classification, size calculation and essential/important determination follow the Directive, national transposition law and competent authority designations.
10 minimum risk measures: not just a document
Article 21 requires appropriate and proportionate technical, operational and organisational measures based on an all-hazards approach, covering at least 10 areas: risk analysis and information system security policies; incident handling; business continuity and crisis management; supply chain security; security in acquisition, development and maintenance (including vulnerability handling and disclosure); policies to assess effectiveness; basic cyber hygiene and training; cryptography and encryption policies; human resources security, access control and asset management; and multi-factor authentication, secured communications and emergency communications. Measures must be proportionate to risk, entity size and incident impact, and an entity that finds itself non-compliant must take corrective measures without undue delay. Supply chain security requires assessing direct suppliers' vulnerabilities, product quality and secure development practices, taking into account coordinated risk assessments under Article 22.
| # | Minimum measure | Checkable evidence |
|---|---|---|
| 1 | Risk analysis and information system security policies | Risk assessment, policy documents, approvals |
| 2 | Incident handling | Incident response process, drills, post-mortems |
| 3 | Business continuity and crisis management | BCP/DR plans, backup and recovery tests |
| 4 | Supply chain security | Supplier due diligence, contract clauses, SBOM/vulnerability data |
| 5 | Acquisition/development/maintenance security | SDL, vulnerability management/disclosure, patch records |
| 6 | Effectiveness assessment | Internal audit, penetration tests, KPIs/KRIs, management review |
| 7 | Cyber hygiene and training | Training records, phishing drills, awareness material |
| 8 | Cryptography and encryption | Encryption policy, key management, algorithm inventory |
| 9 | HR/access control/asset management | Permission matrix, offboarding, asset register |
| 10 | MFA and secure communications | MFA coverage, encrypted communications, emergency comms |
Sources: Directive (EU) 2022/2555 Article 21 (accessed 7 November 2026). "Checkable evidence" is an editorial list, not an official template; specific technical/methodological requirements may be refined by implementing acts or national guidance.
Reporting: 24 hours, 72 hours, one month
Article 23 requires essential and important entities, after becoming aware of a "significant incident", to submit an early warning within 24 hours (indicating whether it is suspected to be caused by unlawful or malicious acts and whether it could have cross-border impact), an incident notification within 72 hours (updating the early warning, initial assessment of severity and impact, indicators of compromise where available), and a final report within one month of the incident notification (detailed description, root cause/threat type, applied and ongoing mitigation, cross-border impact). If the incident is still ongoing when the final report is due, submit a progress report then and a final report within one month of handling the incident. Trust service providers must notify significant incidents affecting their trust services within 24 hours. The CSIRT/competent authority should respond without undue delay, where possible within 24 hours of the early warning.
| Stage | Deadline | Content |
|---|---|---|
| Early warning | Within 24 hours of awareness | Whether suspected malicious/unlawful; possible cross-border impact |
| Incident notification | Within 72 hours | Updated information, severity/impact, available IoCs |
| Final report | Within one month of notification | Detailed description, root cause, mitigation, cross-border impact |
| Ongoing incident | Within one month of handling | Progress report first, then final report |
| Trust service providers | Within 24 hours of awareness | Notification of significant incidents affecting trust services |
Sources: Directive (EU) 2022/2555 Article 23 (accessed 7 November 2026). The definition of "significant incident", reporting channels/format and CSIRT/competent authority division follow the Directive, implementing acts and national law; this is not legal advice.
The 2026 proposal: what it simplifies, what it does not change
COM(2026) 13, published on 20 January 2026, makes "targeted amendments" to NIS2. The official objectives are to simplify jurisdictional rules, streamline the collection of data on ransomware attacks, facilitate supervision of cross-border entities and reinforce ENISA's coordinating role; it complements the single-entry point for incident reporting proposed in the Digital Omnibus. The Commission says it eases compliance for 28,700 companies, including 6,200 micro and small enterprises. It is a proposal, not adopted law; until the legislative process concludes, companies must continue to comply with current NIS2 and national law. The proposal does not state that the 24h/72h/one-month reporting, the 10 measures or management accountability are being removed.
| Item | Official description in the 2026 proposal | What to do now |
|---|---|---|
| Jurisdiction | Simplify jurisdictional rules for cross-border entities | Determine main establishment/representative under current Article 26 |
| Ransomware data | Streamline collection of ransomware-related data | Keep incident and ransom records for future reporting |
| Cross-border supervision | Facilitate supervision and reinforce ENISA coordination | Prepare a cross-border evidence pack and single contact |
| Reporting entry point | Complement the Digital Omnibus single entry point | Keep using current CSIRT/competent authority channels |
| Compliance burden | Eases compliance for 28,700 companies (6,200 micro/small) | Do not use this to postpone current duties |
| Legal status | Proposal requiring the legislative process | Monitor; do not treat it as current law |
Sources: European Commission press release of 20 January 2026, COM(2026) 13 proposal page and NIS2 policy page (accessed 7 November 2026). "What to do now" is editorial advice; proposal content, number and status follow the official legislative process page.
90-day implementation checklist
If there is no NIS2 programme yet, use the first 90 days to establish whether you are in scope, which category you fall into, who owns it and where the evidence is, then close the gaps. The order is: scope and classification, governance and ownership, gap assessment, reporting SOP, supply chain and contracts, drills and evidence.
| Phase | Action | Output |
|---|---|---|
| Weeks 1-2 | Map sectors, entities, size and Member States under Annexes I/II | Scope list, preliminary essential/important classification |
| Weeks 2-3 | Confirm competent authority, registration/representative and cross-border jurisdiction | Compliance route, EU representative (if applicable) |
| Weeks 3-4 | Management approves scope, owner and budget | Board/management decision, RACI |
| Weeks 4-7 | Gap assessment against the 10 Article 21 measures | Gap list, remediation plan, evidence index |
| Weeks 6-8 | Build 24h/72h/one-month reporting SOP and templates | Contact list, notification templates, escalation path |
| Weeks 7-10 | Supply chain due diligence and contract security clauses | Supplier tiers, contract terms, SBOM/vulnerability requirements |
| Weeks 10-12 | Tabletop exercise and evidence review | Exercise report, remediation items, management review |
Editorial implementation advice, not an official template; specific measures, registration, reporting and audit requirements follow NIS2, national law and competent authority guidance.
FAQ
Is NIS2 in force now?
Yes. NIS2 entered into force in January 2023, Member States had to transpose it by 17 October 2024, and NIS1 was repealed from 18 October 2024. The specific duties, competent authorities, registration and enforcement follow national law.
Have the January 2026 amendments been adopted?
No. COM(2026) 13 is a targeted amendment proposal published on 20 January 2026 and must complete the legislative process before becoming law. Until then, companies must comply with current NIS2 and national law; do not read the simplification proposal as a pause or repeal.
Which companies are in scope?
In principle, medium-sized and large entities in the 18 sectors listed in Annexes I/II, plus certain categories regardless of size (public electronic communications, trust services, DNS/TLD, cloud, data centre, CDN, managed/managed security services, online marketplaces, search engines, social platforms and others). Whether an entity is essential or important depends on the annexes, size rules and Member State designation.
When do the 24h/72h/one-month clocks start?
When the entity becomes aware of a significant incident: early warning within 24 hours, incident notification within 72 hours, final report within one month of the notification. If the incident is still ongoing when the final report is due, submit a progress report and a final report within one month of handling it. Trust service providers notify within 24 hours.
Does NIS2 apply to non-EU companies?
It depends on whether the company is an entity type in Annexes I/II and offers services in the EU. A digital infrastructure/digital service provider under Article 26(1)(b) that offers services in the EU without an EU establishment must designate an EU representative; without one, any Member State where services are offered may take legal action. Apply the test to your business model and national law.
What are the fines?
Article 34 requires Member States to set administrative fines for infringements of Articles 21/23 of at least EUR 10 million or 2% of worldwide annual turnover for essential entities (whichever is higher), and at least EUR 7 million or 1.4% for important entities (whichever is higher). Specific amounts, procedures and whether public bodies are subject follow national law.
What must management do?
Management must approve and oversee the implementation of the Article 21 risk measures, members must undergo training, and they can be held liable for the entity's infringement of Article 21. In practice: approve scope and budget, appoint an owner, review risk reporting regularly and treat cybersecurity as a business decision.
How do NIS2, DORA and CRA relate?
They address different things: NIS2 covers cybersecurity risk management and reporting for essential/important entities; DORA has specific rules for financial entities and their ICT third-party risk and may apply as lex specialis; CRA covers products with digital elements. Map the regulations together so the same incident or supplier does not fall through reporting gaps or create duplicate programmes.
Research method and limitations
This article separates "official facts" from "editorial advice": the NIS2 entry-into-force/transposition dates, 18 sectors, 24h/72h/one-month reporting, 10 minimum measures, management accountability, Article 26 jurisdiction/EU representative and Article 34 fines come from EUR-Lex Directive (EU) 2022/2555 and the European Commission NIS2 policy page; the 20 January 2026 proposal objectives, the 28,700/6,200 company figures and the "proposal" status come from the Commission press release, the COM(2026) 13 proposal page and the NIS2 policy page. The 90-day list and the "evidence/action" columns are editorial.
Eight limitations: (1) this is not legal advice; (2) national transposition progress, registration requirements, competent authorities and enforcement differ and are not checked country by country here; (3) COM(2026) 13 is not yet in force and the final text may change; (4) the definition of "significant incident", reporting format/channels follow implementing acts and national law; (5) the article does not provide a clause-by-clause mapping of DORA, CRA, GDPR and NIS2; (6) special national arrangements for public bodies/SMEs are not covered; (7) no technical control checklist or audit template is provided; (8) policies and guidance may update, so recheck the official pages before publishing.
Sources and basis
- European Commission, NIS2 Directive: securing network and information systems: digital-strategy.ec.europa.eu/en/policies/nis2-directive. 18 sectors, 17 October 2024 transposition deadline, NIS1 repealed from 18 October 2024, 20 January 2026 proposal and 28,700/6,200 companies. Accessed 7 November 2026.
- EUR-Lex, Directive (EU) 2022/2555 (NIS2): eur-lex.europa.eu/eli/dir/2022/2555. Articles 2/3 scope, Article 20 governance, Article 21 10 measures, Article 23 24h/72h/one-month reporting, Article 26 jurisdiction and EU representative, Article 34 fines. Accessed 7 November 2026.
- European Commission, Commission strengthens EU cybersecurity resilience and capabilities (press release, 20 January 2026): digital-strategy.ec.europa.eu/en/news/commission-strengthens-eu-cybersecurity-resilience-and-capabilities. New cybersecurity package, revised Cybersecurity Act and targeted NIS2 amendments. Accessed 7 November 2026.
- European Commission, Proposal for a Directive as regards simplification measures and alignment with the Cybersecurity Act (COM(2026) 13, 20 January 2026): digital-strategy.ec.europa.eu/en/library/proposal-directive-regards-simplification-measures-and-alignment-cybersecurity-act. Simplifying jurisdiction, ransomware data collection, cross-border supervision and ENISA coordination; complementing the Digital Omnibus single reporting entry point. Accessed 7 November 2026.
- European Commission, NIS2 Directive FAQs: digital-strategy.ec.europa.eu/en/revision-network-and-information-security-directive-questions-and-answers. NIS2 background, expanded scope and main rules. Accessed 7 November 2026.
Data cut-off 7 November 2026; based on official pages and the Directive; not legal advice; specific obligations follow NIS2, national law and competent authority requirements.