NIS2

Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2 Directive)

Confirmed by two sources. Last verified 10 October 2026

Next full re-check due: April 2027. Regulator news is checked monthly; changes are logged in the change log.

Cite this page: GlanceDesk Jurisdiction, “NIS2 (European Union)”, glancedeskjurisdiction.com/laws/eu-nis2, last verified 10 October 2026.

European Union Cybersecurity

Status: In force since 16 Jan 2023; transposition deadline 17 Oct 2024 (NIS1 repealed 18 Oct 2024). Applies via national laws.✓Sources: digital-strategy.ec.europa.eu, oeil.europarl.europa.eu, cm.twobirds.com
Who it applies to: Medium and large public/private entities in Annex I (high-criticality) and Annex II (other critical) sectors providing services in the EU; some (e.g. DNS, TLD registries, trust services, telecoms) regardless of size. Non-EU digital providers must appoint an EU representative.✓NIS2 Art 2(1)–(2), Art 26(3), Annexes I–II ↗ · Sources: ncsc.gov.ie, rgpd.com, eur-lex.europa.eu, insideprivacy.com
Size thresholds: Size-cap rule: medium or large enterprises under Recommendation 2003/361/EC — 50+ staff, or annual turnover and balance-sheet total both above EUR 10m (partner and linked enterprises aggregated). Large entities in Annex I are usually 'essential'; others 'important'. Some sectors (e.g. DNS, trust services, public administration) are covered regardless of size.✓NIS2 Arts 2(1)–(2), 3(1)–(2); Recommendation 2003/361/EC Annex Arts 2–3 ↗ · Sources: ncsc.gov.ie, rgpd.com
Regulator: National competent authorities and CSIRTs in each Member State; ENISA and the NIS Cooperation Group at EU level✓NIS2 Arts 8, 10, 14 ↗ · Sources: digital-strategy.ec.europa.eu, ncsc.gov.ie
Breach or incident reporting: Significant incidents to CSIRT/authority: early warning within 24h, incident notification within 72h, final report within 1 month of the notification. Inform service recipients where relevant.✓NIS2 Art 23(1), (4) ↗ · Sources: eur-lex.europa.eu, ncsc.gov.ie, williamfry.com
Data protection officer: No named officer, but management bodies must approve and oversee cybersecurity measures, take training, and can be held personally liable.✓NIS2 Art 20 (governance; liability Arts 32(6), 33(5)) ↗ · Sources: ncsc.gov.ie, cm.twobirds.com
Local representative: Certain non-EU digital providers (e.g. cloud, DNS, online marketplaces, search, social platforms) offering services in the EU must designate an EU representative by written mandate.✓NIS2 Art 26(1)(b), (3) ↗ · Sources: eur-lex.europa.eu, rgpd.com, insideprivacy.com
Maximum penalty: Essential entities: maximum of at least EUR 10m or 2% of worldwide turnover; important entities: at least EUR 7m or 1.4% (whichever higher). National caps may be higher.✓NIS2 Art 34(4)–(5) ↗ · Sources: ncsc.gov.ie, cm.twobirds.com, rgpd.com

Facts marked “Being verified” are still being confirmed and are not given as answers.

What you must do✓

Check whether your sector (Annex I/II) and size bring you into scope; register with the national authority.
Have management approve cybersecurity risk measures and complete training.
Implement Art 21 measures: risk analysis, incident handling, backups, MFA, encryption, supply-chain security.
Set up a process to send 24h early warnings and 72h notifications of significant incidents.
Assess security of suppliers and service providers.
Follow the national transposition law in each country where you operate.

Recent changes

On 8 Jul 2026 the Commission referred Ireland, Spain, France and the Netherlands to the CJEU for late transposition; the Netherlands' law then took effect on 15 Aug 2026. Commission proposed targeted NIS2 simplifications on 20 Jan 2026 (pending).✓

Sources

Sources used for the independent check (16)

= confirmed by two independent sources, at least one official. How we verify

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.