Which organisations fall under NIS 2, and what are the reporting deadlines?
The rules cover essential and important entities in the sectors listed in the directive, as a rule from fifty employees or ten million euro in turnover. A significant incident requires an early warning within 24 hours, a notification within 72 hours and a final report within one month. Management must approve the risk measures and can be held responsible for shortcomings.
Source
- Reference
- Directive (EU) 2022/2555 Articles 3, 21 and 23
- Acts
- —
- Area
- Public law, family and social insurance
- Read date
- 2026-09-22
Other acts in the same area
- LOU · SFS 2016:1145
- Utlänningslagen · SFS 2005:716
- Medborgarskapslagen · SFS 2001:82
- Äktenskapsbalken · SFS 1987:230
- Sambolagen · SFS 2003:376
Questions and answers
Ready-made pack
DORA/NIS2 pack
total 186.25 € (about 201 USD)
The basis for what you just read, ready for the file.
Operational resilience and incident reporting in one pack: DORA, NIS2 and the Cyber Resilience Act with the duties in one structure.
Evidence chain, hash and read date per row. One-time purchase, delivered instantly.
Next step
Three ways to put the register to work in your own practice.
Start with your task
Litigation
Find support in a judgment
Search guiding decisions, see what became final and follow changes in the law.
In-house, deals
Map the rules in a transaction
Move from theme to act and on to the article that carries the duty.
Compliance
Assess the risk in a process
Risk scoring per legal area, with the sources behind every score.