ComparisonEU

EU Cybersecurity Law NIS2 vs NIS1

Understand what changed and how to migrate your program.

Output: a migration plan that reuses NIS1 artefacts where possible and closes NIS2 gaps.

Back to main artifact Review sources

Author

Sorena AI

Published

Feb 23, 2026

Updated

Feb 23, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published Feb 23, 2026

Updated Feb 23, 2026

Overview

NIS2 (Directive (EU) 2022/2555) replaced NIS1 (Directive (EU) 2016/1148) and raised the EU's cybersecurity ambition through wider scope, clearer requirements, stronger governance, and stronger supervision tools. Use this page to map changes into your implementation plan.

Section 1

What changed at a high level

NIS2 is broader and more explicit. The biggest practical shift is that compliance must be evidenced with owned controls and repeatable reporting workflows.

Wider scope and more sectors: NIS2 extends coverage across more critical sectors and digital services.
Clearer classification: essential vs important entities, with Member State lists and identification mechanisms.
Stronger governance: management body accountability and training requirements (Article 20).
Stronger and more specific reporting: Article 23 timelines (24h early warning, 72h notification, final report within 1 month).
Stronger supervision/enforcement: explicit audit, scan, and enforcement powers with fine thresholds tied to Article 21/23 infringements.

Section 2

Controls and evidence (what you need to add if you had a "NIS1 policy binder")

Most NIS1 programs are policy-heavy. NIS2 expects measurable controls, effectiveness testing, and evidence readiness.

Build an Article 21 control register mapping a-j measures to control IDs, owners, KPIs, and evidence links.
Add effectiveness testing cadence (Article 21(2)(f)): audits, scans, control tests, and remediation tracking.
Strengthen supply chain security as a first-class control domain (Article 21(d)).
Integrate incident reporting templates, decision logs, and evidence capture into operations (Article 23).

Section 3

Migration plan (what to reuse vs rebuild)

You can reuse many artefacts - but you must tighten ownership, metrics, and reporting workflows.

Reuse: incident response policies, asset inventories, BC/DR plans, and vendor management structures.
Rebuild/upgrade: reporting timelines/templates and triage thresholds; management oversight cadence; evidence vault indexing; control KPIs.
Add: classification memo (essential vs important), transposition overlays per Member State, and audit-ready control testing evidence.
Validate: national authority/CSIRT reporting routes and portals before an incident happens.

Recommended next step

Use EU Cybersecurity Law NIS2 vs NIS1 as a cited research workflow

Research Copilot can take EU Cybersecurity Law NIS2 vs NIS1 from how this topic compares with adjacent regulations or standards to a reusable workflow inside Sorena. Teams working on EU Cybersecurity Law can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

Research workflow

Open Research Copilot for EU Cybersecurity Law NIS2 vs NIS1

Start from EU Cybersecurity Law NIS2 vs NIS1 and answer scope, timing, and interpretation questions with cited outputs.

Explore next step

Talk to Sorena

Talk through EU Cybersecurity Law

Review your current process, evidence gaps, and next steps for EU Cybersecurity Law NIS2 vs NIS1.

Explore next step

Primary sources