eur-lex.europa.eu
Referenced sections
- Detailed Article 21 technical and methodological requirements and Article 23 significance criteria for the digital, ICT-management and trust-service entity types named in the Regulation.
By Sorena AIPublished Updated
NIS2
EU NIS2 Directive
A practical EU NIS2 Directive artifact based on Directive (EU) 2022/2555, cybersecurity risk-management measures, reporting, and Implementing Regulation (EU) 2024/2690 where applicable.
- In force
- Transposition
- Entity lists
- Implementing act
Understand EU NIS2 Directive
NIS2 is an EU directive on cybersecurity governance, risk management, and significant-incident reporting. It generally covers medium-sized and larger entities of a type listed in Annex I or II that provide services or carry out activities in the Union. Article 2 also captures specified entities regardless of size.
Start with the legal entity and each service. Map the exact Annex row, calculate SME status using partner and linked-enterprise data, check size-independent and sector-specific-law rules, classify the entity as essential or important, and identify jurisdiction. The Directive is the EU baseline; national implementing law controls local registration, authority routes, procedure, supervision, and penalties.
Use the EU text for the baseline, then validate each in-scope entity against the applicable national law, competent authority, registration route and incident-reporting channel.
Quick scan
Scope
Map the legal entity and service to Annex I or II, calculate SME status using group relationships, check special inclusions and exclusions, then apply the Article 26 jurisdiction rules.
Controls
Management bodies approve and oversee appropriate and proportionate measures. Apply Regulation 2024/2690 only to its named entity types.
Reporting
For a , preserve the awareness decision and route the early warning within 24 hours, the incident notification within 72 hours, requested updates, and the final or progress report through the applicable national channel.
What you can decide faster
- 1
In scope or out of scope
Map the actual service to an Annex I or Annex II entity type. Then test whether the entity is medium-sized or larger using annual work units, turnover or balance-sheet data and the partner and linked-enterprise aggregation rules. The SME definition normally requires a threshold change over two consecutive accounting periods before status changes. Check every regardless-of-size and Member State identification path before concluding that a small entity is outside scope.
- 2
Essential vs important
Both tiers have Articles 20, 21 and 23 duties. The main EU-level difference is supervision: can face ex ante and ex post supervision under Article 32, while are supervised ex post under Article 33.
- 3
Controls + reporting
Management bodies must approve and oversee proportionate measures, including supply-chain security, and follow training. Prepare reporting for significant incidents. Regulation (EU) 2024/2690 adds detailed control requirements and significance criteria only for the provider types it names. A sector-specific Union act displaces corresponding NIS2 duties only where Article 4's equivalence test is met.
Key dates for NIS2 compliance planning
Track adoption, the 17 October 2024 transposition deadline, entity-list and registry dates, Regulation (EU) 2024/2690, the Commission's 2025 reasoned opinions, and its 8 July 2026 Court referrals concerning Ireland, Spain, France, and the Netherlands. These enforcement steps do not replace a current country-law check.
Loading timeline...
Choose the next NIS2 decision
New to NIS2? Start with the legal entity, service, sector, size and Member State nexus. Once scope and tier are documented, move to governance, controls, incident reporting, national implementation or the comparison you need.
Start here: scope, sector and entity tier
Decide whether the Directive covers the entity and service, whether a size-independent rule applies, whether the entity is essential or important, and which Member State route needs validation.
- EU NIS2 Directive applicability test for entity scope
- NIS2 Annex I and Annex II Sector Scoping Guide
- NIS2 Size Cap Rule and Special Scope Cases
- NIS2 Entity Classifier Workflow: essential vs important entity scoping
- NIS2 essential vs important entities: Article 3 scope and supervision guide
- NIS2 Registration and Authority Notification Guide
Governance, controls, evidence and enforcement
Translate the classification into management-body decisions, proportionate measures, supply-chain controls, evidence records, supervisory readiness and penalty analysis.
- NIS2 entity supervision guide
- NIS2 Management Body Accountability: board duties, training, and evidence
- NIS2 Article 21 control baseline and evidence checklist
- NIS2 Article 21 control-by-control evidence checklist
- NIS2 Article 21 Gap Assessment Workflow: controls, evidence, and owners
- NIS2 Supply Chain Security Program: Article 21 Guide
- NIS2 Requirements: scope, Article 21 controls, reporting, and evidence
- NIS2 Compliance Checklist: scope, controls, reporting
- NIS2 Compliance Guide: scope, controls, reporting, and evidence
- NIS2 penalties and fines: Article 34 maximum levels and factors
Significant-incident triage and reporting
Build the significance decision, awareness timestamp, national authority route, staged submissions, recipient communications and defensible incident evidence before a crisis.
Dates and national implementation
Separate EU-level dates and historical infringement steps from the current national law, registration mechanism, authority instructions and operational country overlay that apply to each entity.
Compare regimes or answer a focused question
Keep NIS2 duties separate from CER, DORA, GDPR, NIS1 and voluntary ISO evidence, or use the FAQ when you already know the question you need to resolve.
- NIS2 vs CER Directive comparison: cyber obligations and critical-entity resilience
- NIS2 vs DORA: scope, overlap, and evidence for EU cyber compliance
- NIS2 vs GDPR breach reporting: EU deadlines and overlap
- NIS2 vs ISO/IEC 27001: legal duties, ISMS evidence, and reuse limits
- NIS2 vs ISO/IEC 27017: legal duties, cloud controls, and reuse limits
- NIS2 vs NIS1: what changed in EU cybersecurity compliance
- NIS2 FAQ: scope, Article 21 controls, incident reporting, and penalties
Sources
eur-lex.europa.eu
Referenced sections
- Binding EU baseline for scope, entity classification, management-body accountability, cybersecurity measures, incident reporting, jurisdiction, registration, supervision and enforcement.
digital-strategy.ec.europa.eu
Referenced sections
- Official 8 July 2026 enforcement update recording the Commission's decision to refer Ireland, Spain, France, and the Netherlands to the Court of Justice for failure to notify NIS2 transposition measures.
digital-strategy.ec.europa.eu
Referenced sections
- Commission state of play and country links; national implementing law and authority guidance remain necessary for country-specific conclusions.
Next steps
Plan NIS2 controls and incident reporting
Use the timeline as the entry point for an NIS2 work plan: confirm Annex I or Annex II scope, record essential or important entity status, assign control owners, and prepare the incident reporting clock for the Member State authorities that apply to your services.
- Create a scope record for each service, legal entity, Member State, Annex sector, size-cap result, and any regardless-of-size trigger.
- Translate Article 20 and into management approvals, risk-management measures, control owners, and evidence requests.
- Prepare incident triage so significant incidents can move from early warning to notification to final report within the NIS2 reporting sequence.
- Track national transposition overlays separately from the EU-level dates because portals, supervisory routes, and penalty rules are Member State specific.
- Open Assessment Autopilot
Convert NIS2 scope, measures, and reporting duties into owned tasks, evidence requests, and review checkpoints.
- Open Research Copilot
Research scope, timing, Article 4 overlap, and Member State implementation questions with cited outputs.
Share NIS2 transposition, entity-list, implementing-act, and review milestones across teams.
- Talk through implementation
Review NIS2 applicability, control evidence, incident reporting handoffs, and national implementation dependencies.