NIS2

What is NIS2?

The EU directive on cybersecurity for essential and critical sectors.

Who is covered?

Medium and large entities in 18 sectors, including energy, transport, health and digital infrastructure.

When does it apply?

Member states had to transpose it by 17 October 2024; national laws apply thereafter.

What are the main obligations?

Management accountability (art. 20), risk management measures (art. 21), incident reporting within 24 and 72 hours (art. 23) and registration with supervisory authorities.

What are the most common risks?

Missing risk measures, late incident reporting and weak supply chain governance. Fines up to 10 million euro or 2 percent of global turnover (art. 32 and 34).

Which judgments affect the interpretation?

No case law yet; interpretation develops through national transposition and supervision.

Each article as its own node with legal text, obligations, affected roles and the turnover framework the act sets.

• NIS2 significant incident reporting · Does this apply to me?

Not in the register yet. not_in_register