NIS2 Directive

What do you need to know?

1. NIS2 makes your board accountable for ten minimum security measures and a 24-hour incident clock, and AI sits inside that perimeter. AI systems, AI suppliers and some AI providers are all reached.
2. Non-compliance is costly, and costlier for "essential" than "important" entities. Essential entities (broadly, large organisations in high-criticality sectors) face proactive audits, higher fines and possible management bans.
3. The law is live almost everywhere, while the promised simplification is only a proposal. France, Ireland and Spain have yet to transpose, and relief from the 2026 amendment proposals is unlikely before 2027-2028.

What should you do now?

1. Classify yourself, country by country. Map each EU entity to sector and size, decide essential or important, and confirm registration. AI providers should test the cloud, MSP/MSSP and platform categories.
2. Put the board on record. Have management formally approve the Art. 21 measures, schedule board training, and document oversight.
3. Rehearse the 24h/72h/one-month clock. Build one incident playbook that runs NIS2, GDPR and AI Act reporting in parallel. Do not wait for the proposed single reporting point.
4. Bring AI inside the security perimeter. Add models, agents, pipelines and AI APIs to the asset inventory, with access control, multi-factor authentication, logging and vulnerability handling.
5. Harden the AI supply chain. Vet model and API vendors and write security, incident notification, audit and exit terms into contracts. If you sell AI, expect customers to demand the same.

What must your board and security programme deliver, and where does AI fit?

Management bodies must approve the risk-management measures, oversee them, complete training (Art. 20) and can be held liable for breaches.

Risk-management measures (Art. 21). Entities must take appropriate and proportionate technical, operational and organisational measures on an "all-hazards" basis. That means protecting systems and their physical environment against any threat. Proportionality reflects risk exposure, size, and the likely severity of incidents. The ten minimum measures are:

1. Risk analysis and information security policies
2. Incident handling
3. Business continuity, including backups, disaster recovery and crisis management
4. Supply chain security with direct suppliers and service providers
5. Security in acquiring, developing and maintaining systems, including vulnerability handling and disclosure
6. Procedures to assess whether the measures work
7. Basic cyber hygiene and cybersecurity training
8. Cryptography and, where appropriate, encryption
9. HR security, access control and asset management
10. Multi-factor or continuous authentication and secured communications, where appropriate

Implementing Regulation (EU) 2024/2690, in force since 7 November 2024, details these measures for cloud, data centre, MSP, MSSP, platform, DNS and trust service providers. It sets numeric "significant incident" triggers, such as a direct loss above EUR 500,000 or 5% of turnover, whichever is lower.

Incident reporting (Art. 23). An incident is significant if it can cause severe operational disruption or financial loss, or considerable damage to others. Significant incidents go to the national CSIRT (computer security incident response team) or competent authority in stages:

Registration. Member States had to list in-scope entities by 17 April 2025. Entities supply contact details (including IP ranges), sector and countries of operation, and report changes within two weeks. Digital providers register in their main EU establishment's country, feeding a registry run by ENISA, the EU cybersecurity agency. Non-EU digital providers must appoint an EU representative.

How AI fits. NIS2 has no AI-specific rules. It reaches AI in three ways:

• AI systems you use. If you are in scope, your copilots, agents, ML pipelines and model APIs are part of the IT estate the measures must cover. This is a reasonable reading rather than explicit text, but it is the safe one.
• The AI supply chain. In-scope entities must assess direct suppliers' security, including secure development practices. Model and API vendors are suppliers, so even out-of-scope AI vendors will feel NIS2 through customer contracts.
• AI providers. Being an AI company does not by itself bring you into scope. You are in scope only if you fall into a listed category and meet the size threshold. Listed categories include cloud computing, data centre, MSP or MSSP, online platform, and manufacturing of computers and electronics. No official guidance yet classifies generative-AI or model-API providers specifically.

The EU AI Act adds its own cybersecurity duties, so one AI-related breach could start several regulatory clocks at once.

How much could a breach cost?

Your class (essential or important; see the scope section below) sets your exposure.

At essential entities, Member States must make it possible to hold decision-makers personally liable. Member States may also add national penalties.

Enforcement escalates from audits and binding instructions to fines, with suspensions and bans reserved for when earlier steps fail.

Where does transposition stand, and what is changing?

Transposition. Most Member States missed the October 2024 deadline. Two unofficial trackers both put the count at 24 of 27 with national NIS2 laws in force as of early October 2026. Both count primary laws only, not the Commission's test of "full" transposition. Recent arrivals include Germany (6 December 2025), Poland (2 April 2026) and the Netherlands (15 August 2026).

Outstanding: France, Ireland and Spain. France's "Résilience" bill passed the Senate in March 2025; its National Assembly debate, set for 7 October 2026, was postponed with no new date. Ireland's and Spain's bills remain unadopted.

Infringement steps. The Commission sent letters of formal notice in November 2024 and reasoned opinions to 19 Member States on 7 May 2025. On 8 July 2026 it referred Ireland, Spain, France and the Netherlands to the Court of Justice of the EU, seeking a lump sum plus daily penalties. The Netherlands' law took effect weeks later, so its case may be narrowed or dropped. This is not confirmed.

Proposed changes. These are not adopted law.

• Digital Omnibus (19 November 2025): a single entry point for reporting incidents under NIS2, GDPR and DORA.
• NIS2 targeted amendments (20 January 2026), alongside a revised Cybersecurity Act:
  • a "small mid-cap" category (fewer than 750 employees, turnover up to EUR 150m), classed as important at most
  • ransomware-specific reporting and optional "cyber-posture certificates"
  • an EU-representative duty for all non-EU in-scope entities

The Commission says 28,700 companies would benefit. As of March 2026, Parliament and Council had not adopted positions. A 12-month transposition period would follow, so relief is unlikely before 2027-2028.

What is NIS2, and who is in scope?

NIS2 (Directive (EU) 2022/2555) is a directive. Unlike a regulation, it does not apply directly. Each Member State must pass its own national law to put it into effect, a process called transposition. Authorities, registration and some penalties therefore vary by country. NIS2 replaced NIS1, which was repealed on 18 October 2024.

Sectors. NIS2 covers 18 sectors, split between Annex I (high criticality) and Annex II (other critical sectors). It keeps the NIS1 sectors: energy, transport, health, finance, water and digital infrastructure. It adds:

• public electronic communications
• online platforms and other digital services
• waste and wastewater
• manufacturing of critical products
• postal and courier services
• central and regional public administration
• space

For AI companies, the digital categories matter most: digital infrastructure, ICT service management and digital providers. They include cloud computing, data centres, content delivery networks, managed service providers (MSPs, which run IT for clients), managed security service providers (MSSPs), online marketplaces, search engines and social networks.

Size threshold. NIS2 applies to entities in these sectors that are at least medium-sized: 50 or more employees, or annual turnover or balance sheet above EUR 10 million. Large means 250 or more employees, or turnover above EUR 50 million and a balance sheet above EUR 43 million. Some are in scope regardless of size, including telecoms, trust service, top-level domain (TLD) and DNS providers, and sole national providers of an essential service.

Essential vs important. The class depends on both sector and size, not sector alone.

• Essential: large Annex I entities, plus qualified trust service providers, TLD registries and DNS providers of any size. Also medium-sized telecoms providers, central government, critical entities under the companion CER Directive, and designated entities.
• Important: everything else in scope. In practice, that means medium-sized Annex I entities and medium or large Annex II entities.

So a mid-size cloud provider is usually important; a large one is essential.

Which dates matter?

Where does this come from?

• Directive (EU) 2022/2555 (NIS2) — EUR-Lex
• NIS2 Directive policy page — European Commission
• Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice — European Commission, 8 July 2026
• Commission calls on 19 Member States to fully transpose NIS2 — European Commission, 7 May 2025
• Implementing Regulation for certain digital service providers enters into force — Hunton
• Navigating NIS2: what organisations need to know — Goodwin, October 2025
• Commission proposes targeted amendments to NIS2 — Covington / Inside Privacy, January 2026