NIS2 Directive
Also known as: NIS2, NIS 2 Directive, Directive (EU) 2022/2555, EU cybersecurity directive
The NIS2 Directive is the EU's main cybersecurity law for organizations in critical and important sectors, from energy and health care to digital infrastructure, waste management, and manufacturing.
It requires risk management measures, fast incident reporting, and accountability at the top, since management can be held personally responsible. While it replaced a narrower 2016 law, the real change is scale: NIS2 brings many more organizations into scope.
NIS2 Directive, explained at three levels
At home
NIS2 is an EU law that makes important organizations, like hospitals, power companies, and internet providers, take cybersecurity seriously. The goal is fewer disruptions to the services people depend on every day.
At work
If your organization operates in a covered sector in the EU and meets size thresholds, NIS2 likely applies. That means having cybersecurity measures in place, reporting serious incidents quickly, and making sure leadership oversees security.
At home
NIS2 sets tight reporting deadlines: an early warning to authorities within 24 hours of becoming aware of a significant incident, a fuller notification within 72 hours, and a final report within a month. That pressure is meant to help authorities spot attacks that hit many organizations at once.
At work
NIS2 divides organizations into 'essential' and 'important' entities, mainly by sector and size. Required measures include risk analysis, incident handling, business continuity, supply chain security, encryption policies, access control, multi-factor authentication where appropriate, and staff training. Supervision is stricter for essential entities.
At home
Under NIS2, management bodies must approve cybersecurity measures and can be held liable for failures, and they must receive training. In my opinion, that personal accountability is the single biggest change, because it moves cybersecurity from the IT budget into the boardroom's risk agenda.
At work
Fines can reach €10 million or 2% of global turnover for essential entities and €7 million or 1.4% for important entities. Because NIS2 is a directive, national implementations differ in details such as registration, supervision, and sector scope, so multinationals need a country-by-country view. Supply chain requirements also push obligations onto vendors, including non-EU suppliers.
Real-world examples
At home
Fatima's local hospital in Belgium had to delay some appointments after a ransomware attack. Under NIS2, the hospital reported the incident to national authorities within 24 hours, and the national cybersecurity centre helped coordinate the response.
At work
Thomas is the IT security lead at a mid-sized food manufacturer in Germany. After confirming the company fell under NIS2 as an important entity, he briefed the board, set up an incident reporting process with the 24-hour deadline in mind, and started reviewing supplier security.
How it compares
| feature | NIS2 Directive | Original NIS Directive |
|---|---|---|
| Scope | Many more sectors and medium-sized organizations | Fewer sectors, inconsistently defined |
| Management accountability | Explicit, with training and liability | Not explicit |
| Incident reporting | 24 hours, 72 hours, one month | Without undue delay, less specific |
| Fines | Up to €10 million or 2% of turnover | Set nationally, often low |
| Supply chain | Required to be addressed | Limited |
NIS2 is broader, stricter, and more specific than the original NIS Directive.
For analysts
The 24-hour early warning is the hardest NIS2 requirement to meet in practice. I'd test it with a tabletop exercise: who decides an incident is significant, who files the report, and what happens at 2 a.m. on a Sunday.
History & origin
The original NIS Directive, adopted in 2016, was the EU's first cybersecurity law, but member states applied it inconsistently and it covered too few organizations. NIS2 was adopted in December 2022, with a transposition deadline of October 17, 2024, by which member states had to turn it into national law. Most missed the deadline: in November 2024, the European Commission opened infringement proceedings against 23 member states. National laws arrived through 2025 and beyond. In my view, NIS2's most important clause is the one making senior management responsible for cybersecurity. Technical controls are easy to require. Making leadership care is harder.