NIS2 Directive Requirements Your Organisation Must Meet in 2026

NIS2 has applied across the EU since 18 October 2024, though because it is a directive rather than a regulation, what actually binds you is your member state’s transposing law. If your organisation operates in one of 18 covered sectors and counts as at least a medium-sized enterprise, you are almost certainly in scope. ENISA and the European Commission estimate roughly 160,000 EU entities are covered, against around 10,000 to 15,000 under NIS1. Most of them have not finished preparing.

By early 2026 around 20 of the 27 member states had adopted primary transposing legislation, though the Commission applies a stricter test. Our NIS2 transposition status for all 27 member states shows the current count and the date each law took effect.

On 7 May 2025 it sent reasoned opinions to 19 member states for failing to notify full transposition, because it requires notification of every implementing measure, including secondary and sector-specific rules, not just the framework law. A member state can have a primary act on the books and still draw a reasoned opinion for incomplete secondary legislation. Germany adopted its NIS2 Implementation Act (NIS2UmsuCG), in force since 6 December 2025. The directive itself was adopted in December 2022. Brussels has learned to set its watch to member-state time.

Cybersecurity is a board-level responsibility under this directive, not an IT department problem, and the first enforcement actions in 2026 are what will move it up the agenda. This piece covers what in-scope entities actually have to do. Before any of it, confirm you are in scope, which is where our companion piece on whether NIS2 applies to your company starts.

Ten Article 21 Measures Every In-Scope Entity Has to Implement

NIS2 requires all in-scope entities to implement ten categories of cybersecurity risk-management measure under Article 21. These are minimum legal requirements, and member states can add further obligations on top. They apply once NIS2 applies to your company.

Germany enacted this baseline as § 30 BSIG, in force since 6 December 2025, with fines up to €10 million and personal management liability attached, as we detail in NIS2 Germany transposition status and fines.

Article 21(2) sets out the ten. They run from policies on risk analysis and information system security through incident handling; business continuity, backup management, disaster recovery and crisis management; supply chain security covering direct suppliers and service providers; security in the acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure; policies to assess the effectiveness of the measures; basic cyber hygiene and cybersecurity training; policies on cryptography and, where appropriate, encryption; human resources security, access control and asset management; and multi-factor or continuous authentication with secured and emergency communications where appropriate.

Article 21(1) adds a proportionality clause. Measures have to be appropriate to actual risks, weighing size, exposure and the cost of implementation. How proportionality plays out depends on which category you fall into, because NIS2 draws a sharp line between essential and important entities that sets your supervisory regime and your maximum fine, a split we cover in full in our piece on essential versus important entities. In short, essential entities, the large organisations in the eleven Annex I sectors, face ex ante supervision under Article 32, meaning regulators can inspect proactively without waiting for an incident, and fines up to €10 million or 2% of global annual turnover, whichever is higher, under Article 34. Important entities, the smaller Annex I organisations plus all Annex II entities, face ex post supervision under Article 33 and fines up to €7 million or 1.4% of global turnover. A 60-person food manufacturer and a cloud infrastructure provider both face the same ten Article 21 categories. They do not face the same regulator standing over their shoulder.

The ENISA Technical Implementation Guidance provides detailed practical guidance on the cybersecurity measures defined in Commission Implementing Regulation (EU) 2024/2690, developed primarily for digital-sector entities but useful as a reference for any in-scope organisation, with its 13 thematic areas and mapping to ISO/IEC 27001. Organisations already certified against ISO 27001 will find the gap analysis substantially shortened. In our assessment three to six months is a realistic closure timeline for well-scoped certifications, though actual duration depends on the age and breadth of the certificate. The hardest category in practice is supply chain, because Article 21 requires entities to account for vulnerabilities specific to each direct supplier, which means reviewing vendor contracts and security postures, not just internal systems.

Article 20 adds a governance layer that is often missed. Management bodies, meaning boards, C-suites and equivalent structures, must formally approve the cybersecurity risk-management framework and oversee its implementation, and the directive makes the management body liable as an organ for infringements. Individual personal liability of executives is a matter of national implementation, and Germany has gone furthest. Section 38 of the amended BSIG establishes a non-delegable personal duty for managing directors to approve and supervise the measures, with personal liability to the company for damages caused by a culpable breach, and Section 65 BSIG sets a separate fine of up to €500,000 for the registration violation specifically. France, Belgium and Spain have their own national variations. Management bodies also have to complete cybersecurity training. After years of saying the board is responsible, the Commission is now writing it into law with euro amounts attached.

Report a Significant Incident Within 24 Hours or Face Supervisory Action

Article 23 runs on a three-stage clock that starts the moment your organisation becomes aware of a significant incident. There is no grace period for investigation. Your incident-reporting playbook needs to work at 3 a.m. on a bank holiday, because Article 23’s 24-hour clock does not care about office hours.

Within 24 hours, an early warning to your national CSIRT or competent authority, noting whether the incident is suspected malicious and whether it has cross-border impact. No detailed analysis is required at this stage. Within 72 hours, a full incident notification updating the early warning, with an initial severity and impact assessment and indicators of compromise where available. Within one month, a final report covering root cause, threat type, mitigation applied and any cross-border effects. If the incident is still ongoing at the one-month mark, you submit a progress report instead, then the final report within one month of handling completion.

An incident is significant under Article 23(3) if it has caused or is capable of causing severe operational disruption or financial loss, or if it has affected or is capable of affecting other natural or legal persons through considerable material or non-material damage. For digital-sector entities specifically, meaning cloud providers, CDN operators, DNS services, online marketplaces, social network platforms and trust service providers, Commission Implementing Regulation (EU) 2024/2690 sets quantitative thresholds. An incident counts as significant if direct financial loss exceeds €500,000 or 5% of annual turnover, whichever is lower, if trade secrets are exfiltrated, or if a person’s health or life is put at risk. Entities outside the digital sector are not formally bound by those thresholds but can treat them as a practical calibration point.

One overlap is worth flagging. If the incident also involves personal data, GDPR’s 72-hour breach notification clock runs at the same time, and NIS2’s early-warning deadline is tighter. The two also run to different bodies. NIS2 notifications go to your national CSIRT or competent authority, GDPR notifications to your data protection authority. Separate institutions, separate forms, separate reporting chains. Some national authorities have begun coordinating, Germany’s BSI and BfDI among them, but parallel reporting is the safe assumption.

Most organisations are broadly ready for incident reporting in principle, because GDPR enforcement forced them to build the underlying processes. Our read is that the frameworks exist and the reflex does not. NIS2’s window is 24 hours, not 72, and it runs to your CSIRT, not your DPA. For companies without a security team available around the clock, the honest question is whether 24/7 coverage is realistic, and testing the playbook before you need it is the only way to find out.

Which Companies Are Actually Exempt, and the Supply-Chain Trap Most Miss

NIS2 covers 18 sectors across two annexes, but the exemptions are narrower than most companies assume, and the supply-chain provisions catch many organisations that believe they are out of scope.

Annex I lists eleven sectors of high criticality: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management, public administration and space. Annex II adds seven more: postal and courier services, waste management, chemicals, food, manufacturing (medical devices, electronics, machinery, motor vehicles), digital providers and research organisations.

The size floor is 50 or more employees, or annual turnover or balance sheet total above €10 million, measured across linked and partner enterprises rather than the single legal entity. Below that a company is out of scope unless it falls into an Article 2(2) category that ignores size: public electronic communications providers, trust service providers, TLD registries, DNS service providers, sole providers of an essential service in their member state, and entities whose disruption would cause significant systemic or cross-border impact. These are bound by the directive directly regardless of headcount or revenue, not merely through contractual pressure from customers.

The directive excludes some entities outright. Public administration in national security, defence and law enforcement is out under Article 2(7), and micro and small enterprises below both thresholds are out unless Article 2(2) applies.

Financial entities in scope of DORA (Regulation (EU) 2022/2554) are the other major carve-out. Under Article 4 of NIS2, DORA is lex specialis for ICT risk management and incident reporting, so the roughly 20 categories of financial entity DORA lists in its Article 2(1), from credit institutions and payment institutions to investment firms, insurers and crypto-asset service providers, plus critical ICT third-party providers, meet the equivalent NIS2 obligations through DORA compliance. They can still be identified as essential or important entities under NIS2 and remain subject to its cooperation framework, so read Article 4 for the exact interaction rather than assuming a clean exemption.

The supply-chain trap catches the rest. Most suppliers and vendors to in-scope entities are not directly bound by the directive, but Article 21(2)(d) requires their clients to assess supply-chain security, which in practice means contract-level flow-down. If you supply software, managed IT services or cloud infrastructure to an essential or important entity, NIS2 requirements will reach you through your customer’s procurement team regardless of your own formal scope status.

Five Actions to Complete Before the First Supervisory Assessment Lands

In-scope organisations should move on five actions as quickly as possible: confirm scope, register with the national competent authority, run an Article 21 gap analysis, build an incident-reporting playbook and get board approval in writing. Companies that start with the hardest gaps close them in months. Companies that wait for more clarity end up stuck halfway through a gap analysis when the first supervisory assessment lands.

Most mid-sized entities outsource at least the gap analysis. Our directory of NIS2 compliance providers by country lists the firms that do this work, so you can build a shortlist without trawling dozens of separate consultancy sites.

Confirm scope first. Map your sector against Annex I and Annex II using NACE codes, apply the size floor while aggregating linked and partner enterprises under Commission Recommendation 2003/361/EC, and identify your competent authority, which is set by your main establishment for digital service providers under Article 26 and by place of establishment otherwise.

Register with your national authority. Deadlines are set by member state law and vary. Germany’s BSI registration deadline was 6 March 2026, three months after the NIS2UmsuCG entered into force, and by that date only about 11,500 of an estimated 29,500 obligated entities had registered, which is why the BSI has said it will now identify non-registrants itself. Other member states set their own registration windows through 2024 and 2025, so find your national implementing act before assuming you have time.

Run an Article 21 gap analysis. Use the ENISA Technical Implementation Guidance on Implementing Regulation 2024/2690 as a benchmark, and prioritise supply-chain security under Article 21(2)(d), multi-factor authentication under Article 21(2)(j) and incident-handling procedures under Article 21(2)(b), because those are the areas most likely to surface in early supervisory assessments.

Build and test your incident-reporting playbook. Document who declares a significant incident, who notifies the authority and where the 24-hour early-warning template lives, then run a tabletop exercise before you need it. The clock does not stop for internal escalation.

Get board approval in writing. Article 20 requires the management body to formally approve the framework, so minute the approval. Untrained boards and missing documentation are the easiest non-compliance for a regulator to verify.

Looking ahead, the Commission’s 20 January 2026 amendment proposal would introduce a new small mid-cap category, for entities under 750 employees and €150 million turnover, treated as important rather than essential, extend coverage to submarine cable operators and European Digital Identity Wallet providers, and add mandatory ransomware reporting including payment details. It is a proposal, not law, with a 12-month transposition period envisaged after adoption, putting full effect into 2027 at the earliest. Nothing in it changes current obligations, so monitor it rather than wait for it.