The short answer
NIS2 (Directive (EU) 2022/2555) sets cybersecurity and incident reporting rules for medium and large organisations in 18 sectors that provide services in the EU. Member states had to put it into national law by 17 October 2024. It does not apply in the UK, which has its own NIS Regulations.
What is NIS2?
NIS2 is Directive (EU) 2022/2555, on measures for a high common level of cybersecurity across the EU. It replaced the original NIS Directive. Because it is a directive, each member state has to write it into national law. The deadline was 17 October 2024, with the national rules applying from 18 October 2024.
Who does NIS2 apply to?
Organisations that operate in the sectors listed in its annexes, are medium-sized or larger, and provide their services in the EU. Some types of organisation are in scope whatever their size.
| Annex I: sectors of high criticality | Annex II: other critical sectors |
|---|---|
| Energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business to business), public administration, space | Postal and courier services, waste management, chemicals, food, manufacturing, digital providers, research |
What is the difference between essential and important entities?
Essential entities include large organisations in Annex I sectors, qualified trust service providers, top-level domain registries and DNS service providers of any size, and public administration bodies. Other organisations in scope are important entities. The difference matters most for supervision and fines.
What are the NIS2 fines?
Member states must set maximum fines of at least:
- Essential entities: €10 million or 2% of total worldwide annual turnover, whichever is higher.
- Important entities: €7 million or 1.4% of total worldwide annual turnover, whichever is higher.
What does NIS2 expect of senior management?
Management bodies must approve and oversee the organisation’s cybersecurity risk management measures, can be held liable for failures, and must take part in training.
What are the NIS2 incident reporting deadlines?
| Report | Deadline |
|---|---|
| Early warning | Within 24 hours of becoming aware of a significant incident |
| Incident notification | Within 72 hours |
| Final report | No later than one month after the incident notification |
Have all EU countries put NIS2 into law?
Not on time. The European Commission sent letters of formal notice in November 2024 and reasoned opinions to 19 member states in May 2025. On 8 July 2026 it referred Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for failing to transpose the rules.
Does NIS2 apply in the UK?
No. The UK is covered by the Network and Information Systems Regulations 2018, in force since 10 May 2018. But UK organisations can still meet NIS2. Providers based outside the EU that offer certain services in the EU, such as cloud computing, data centre, managed service and managed security services, must appoint a representative in the EU.
What is the UK Cyber Security and Resilience Bill?
The Cyber Security and Resilience (Network and Information Systems) Bill would update the UK’s 2018 rules. According to the government’s summary, it would bring medium and large managed service providers, data centres above set thresholds, large load controllers and regulator-designated critical suppliers into scope, and introduce a 24-hour initial notification and a 72-hour full report for incidents, with the NCSC informed at the same time. Most measures need secondary legislation after it becomes law.
It passed the House of Commons on 16 June 2026 and completed committee stage in the House of Lords in September 2026. As at 15 October 2026, Lords report stage was scheduled for 26 October 2026.
Sources
- EUR-Lex: Directive (EU) 2022/2555 (NIS2)
- European Commission: referral of four member states to the Court of Justice (July 2026)
- legislation.gov.uk: The Network and Information Systems Regulations 2018
- UK Parliament: Cyber Security and Resilience (Network and Information Systems) Bill
- gov.uk: summary of the Cyber Security and Resilience Bill
This is general information, not legal or professional advice. Rules change, so check the sources and take advice for your situation. Spotted something out of date? Email hello@asand.io.