Docs

Appearance

NIS2 Directive (EU) 2022/2555 ​

NIS2 Directive illustration

The NIS2 Directive is Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 “on measures for a high common level of cybersecurity across the Union”. NIS2 is “addressed to the Member States” (Article 46). Entities get their NIS2 obligations from the national law that transposes NIS2 in each Member State.

This section gives the dates of NIS2, its structure, the guidance, and the proposals to amend NIS2. Five other sections give more information: Who NIS2 applies to, NIS2 cybersecurity measures, NIS2 incident reporting, NIS2 supervision and enforcement, and How to use the NIS2 Frameworks in Modulos.

Key facts
Instrument
Directive (EU) 2022/2555; applies through national transposing law
Adopted / in force
14 Dec 2022 / 16 Jan 2023
Applies
National transposing measures from 18 Oct 2024
Scope test
Entity types in Annexes I and II, medium-sized or larger; some cases regardless of size
Primary obligations
Arts 20, 21, 23; also Arts 3(4), 27, 28, 29(4)
Fines (Art 21 or 23)
Minimum levels for the national maximum fines, different for essential and important entities. See Administrative fines and other penalties.

Dates and transposition of NIS2 ​

Directive (EU) 2022/2555 is in the Official Journal of the European Union, OJ L 333, 27.12.2022, p. 80. Its full name is “Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)”.

NIS2 entered into force “on the twentieth day following that of its publication in the Official Journal of the European Union” (Article 45), that is, on 16 January 2023. Article 41(1) gives the transposition dates. By 17 October 2024, the Member States “shall adopt and publish the measures necessary to comply with this Directive”. They “shall apply those measures from 18 October 2024”.

Article 44 repeals Directive (EU) 2016/1148, the first NIS Directive, with effect from 18 October 2024. Article 44 also gives this rule: “References to the repealed Directive shall be construed as references to this Directive and shall be read in accordance with the correlation table set out in Annex III.”

The Articles of NIS2 on the obligations of entities give tasks to the Member States. For example, Articles 20(1) and 21(1) start with “Member States shall ensure”, and Article 23(1) starts with “Each Member State shall ensure”. Thus, examine the national law of each Member State where an entity is in scope. Article 5, “Minimum harmonisation”, gives this rule: NIS2 “shall not preclude Member States from adopting or maintaining provisions ensuring a higher level of cybersecurity, provided that such provisions are consistent with Member States’ obligations laid down in Union law”. Thus, national law can set more obligations than NIS2.

As of October 2026, the Commission press release IP/26/1499 of 8 July 2026 gives this information: “Member States had until 17 October 2024 to transpose the Directive. While most complied, Spain, France, Ireland and the Netherlands have yet to notify full transposition”.

On 8 July 2026, the Commission referred Ireland, Spain, France, and the Netherlands to the Court of Justice of the European Union “for failing to notify measures transposing the NIS2 Directive”. The Commission sent letters of formal notice on 28 November 2024 and reasoned opinions on 7 May 2025. It also made a “request to the Court to impose financial sanctions, consisting of a lump sum and daily penalties until notification of complete transposition”.

Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024 is in the Official Journal of 18 October 2024. It entered into force on 7 November 2024, “the twentieth day following that of its publication” (Article 16). It applies directly, and only to its relevant entities (Articles 1 and 16). For these entities and for the requirements of the Regulation, see Article 21(5).

Article 40 tells the Commission to “review the functioning of this Directive” by 17 October 2027 and each 36 months after that date. The report of the Commission “shall in particular assess the relevance of the size of the entities concerned, and the sectors, subsectors and types of entity referred to in Annexes I and II”.

Guidance and other sources ​

The recitals of NIS2 come before its Articles. The recitals help you to read the Articles, but they do not set obligations. Guidance from the Commission, the NIS Cooperation Group, and ENISA is not binding. The obligations of entities come from the national law that transposes NIS2 and, for relevant entities, from Implementing Regulation (EU) 2024/2690. The section for the related Articles gives more information on each guidance document:

  • Guidelines on Article 3(4) — the “Commission Guidelines on the application of Article 3(4) of Directive (EU) 2022/2555 (NIS 2 Directive)” (2023/C 324/02, 14 September 2023). They give guidance on the information that entities send for the list of entities. These guidelines are not binding (The list of entities and the registry).
  • Guidelines on Article 4 — the “Commission Guidelines on the application of Article 4(1) and (2) of Directive (EU) 2022/2555 (NIS 2 Directive)” (2023/C 328/02, 18 September 2023). They give guidance on sector-specific Union legal acts. These guidelines are not binding (Article 4).
  • NIS Cooperation Group reference document — the “Reference document on security measures for entities under NIS2” (version 1.0, June 2026). It gives “a set of high-level cybersecurity objectives” for the Article 21 measures. The document “is not legally binding, is for advisory purposes only” (Guidance on the Article 21 measures).
  • ENISA guidance — the ENISA “Technical Implementation Guidance” on Implementing Regulation (EU) 2024/2690 (version 1.0, June 2025). It gives guidance for relevant entities. The document “is not legally binding and is only of an advisory character” (Article 21(5)).

NIS2 structure ​

NIS2 Directive (EU) 2022/2555
Chapter I — General provisionsArticles 1–6: subject matter, scope, essential and important entities, sector-specific Union legal acts, minimum harmonization, definitions
Chapter II — Coordinated cybersecurity frameworksArticles 7–13: national cybersecurity strategies, competent authorities and single points of contact, cyber crisis management, CSIRTs, coordinated vulnerability disclosure, cooperation at national level
Chapter III — Cooperation at Union and international levelArticles 14–19: Cooperation Group, CSIRTs network, EU-CyCLONe, international cooperation, report on the state of cybersecurity, peer reviews
Chapter IV — Cybersecurity risk-management measures and reporting obligationsArticles 20–25: governance, cybersecurity risk-management measures, risk assessments of critical supply chains, reporting obligations, certification schemes, standardization
Chapter V — Jurisdiction and registrationArticles 26–28: jurisdiction and territoriality, registry of entities, database of domain name registration data
Chapter VI — Information sharingArticles 29–30: cybersecurity information-sharing arrangements and the notification of participation, voluntary notification
Chapter VII — Supervision and enforcementArticles 31–37: supervision, enforcement, administrative fines, personal data breaches, penalties, mutual assistance
Chapter VIII — Delegated and implementing actsArticles 38–39: exercise of the delegation, committee procedure
Chapter IX — Final provisionsArticles 40–46: review, transposition, amendments, repeal of Directive (EU) 2016/1148, entry into force, addressees

NIS2 has nine chapters and three Annexes. The “Sectors of high criticality” are in Annex I, “Other critical sectors” are in Annex II, and the “Correlation table” is in Annex III. Chapters II, III, and VIII give tasks to the Member States and at Union level, for example to the Commission, ENISA, and the Cooperation Group. The obligations of entities are in these Articles:

  • Article 3(4) — information for the list of entities, and changes to this information (Who NIS2 applies to).
  • Article 20 — the management bodies approve and oversee the measures. In Article 20(2), “the members of the management bodies of essential and important entities are required to follow training” (NIS2 cybersecurity measures).
  • Article 21 — the cybersecurity risk-management measures (NIS2 cybersecurity measures).
  • Article 23 — notification of significant incidents, and communication to the recipients of services (NIS2 incident reporting).
  • Article 27(2) and (3) — information for the ENISA registry, for the types of entity in Article 27(1) (Who NIS2 applies to).
  • Article 28 — domain name registration data, for TLD name registries and entities providing domain name registration services (Who NIS2 applies to).
  • Article 29(4) — notification to the competent authorities by essential and important entities “upon entering into” cybersecurity information-sharing arrangements and, as applicable, “once the withdrawal takes effect” (NIS2 incident reporting).

For Chapter VII, see NIS2 supervision and enforcement.

Changes from the first NIS Directive ​

Directive (EU) 2016/1148, the first NIS Directive, put entities into two groups: “operators of essential services” and “digital service providers”. NIS2 recital 6 gives this view: the “differentiation between operators of essential services and digital service providers” “has been proven to be obsolete”. With the first NIS Directive, “Member States were responsible for identifying the entities which met the criteria to qualify as operators of essential services” (NIS2 recital 7). NIS2 uses “a uniform criterion”, “a size-cap rule” (recital 7), in Article 2(1), together with the types of entity in Annexes I and II.

NIS2 also adds these items:

  • obligations of the management bodies (Article 20)
  • minimum supervisory and enforcement powers (Articles 32 and 33)
  • minimum levels for the maximum administrative fines (Article 34).

In Article 3(1)(g), a Member State can keep as essential entities the entities that it identified before 16 January 2023 as “operators of essential services”.

Supervision, enforcement, and fines ​

Chapter VII of NIS2 (Articles 31 to 37) gives the minimum powers of the competent authorities and the minimum levels for the maximum administrative fines. See NIS2 supervision and enforcement.

Proposals to amend NIS2 ​

As of October 2026, two proposals of the European Commission contain changes to NIS2. The two proposals are not law, and NIS2 applies without their changes. The two proposals add two different new Articles 23(12). Each new Article 23(12) is only part of the proposal that adds it.

COM(2026) 13 of 20 January 2026 ​

COM(2026) 13 (procedure 2026/0012(COD)) is a proposal for a directive “amending Directive (EU) 2022/2555 as regards simplification measures and alignment with the [Proposal for the Cybersecurity Act 2]”. As of October 2026, it is not law. These are some of the changes in its Article 1:

  • Article 3(1), point (a) — the essential entities of an Annex I type are the entities that “exceed the ceilings for small mid-cap enterprises”. A new Article 6, point (42), refers to Recommendation (EU) 2025/1099 for “small mid-cap enterprise”.
  • Articles 2(2) and 3(1), point (b) — the proposal removes DNS service providers from the entities that are in scope regardless of their size. It also removes them from the essential entities regardless of their size. Article 3(1)(b) names “qualified trust service providers, providers of European Digital Identity Wallets, providers of European Business Wallets and top-level domain name registries, regardless of their size”.
  • Articles 2(3a) and 3(1), point (h) — the entities “identified as owners, managers and operators of strategic dual-use infrastructure” are in scope regardless of their size. They are essential entities. The proposal gives no number for the Regulation that identifies them. That Regulation is also a proposal, on “a framework of measures to facilitate the transport of military equipment”.
  • Articles 3(4) and 27 — the proposal replaces the first subparagraph of Article 3(4) and removes Article 27(2). The information for the list of entities increases. For example, new point (c) is “the address of the entity or, where applicable, the address of the entity’s main establishment and its other legal establishments in the Union or, if not established in the Union, of its representative designated pursuant to Article 26(3)”. New point (f) is “the entity’s IP ranges”. In the new Article 27(1), ENISA keeps “a registry of essential and important entities as well as entities providing domain name registration services”. Essential and important entities notify changes to their Article 3(4) information “without delay and in any event within two weeks of the date of the change” (new Article 27(3)). This rule replaces the time limit of three months in Article 27(3).
  • Articles 5 and 21(5) — “Where the Commission adopts implementing acts referred to in the first and second subparagraphs of this paragraph, Member States shall not impose any further technical, methodological or sectoral requirements of the measures referred to in Article 21(2)” on the entities in their scope. Article 5 applies “without prejudice to” this rule.
  • Article 23(12) and (13) — new Article 23(12) applies to the implementing acts of Article 23(11), first subparagraph. In these implementing acts, the Commission “shall include requirements that the following information as regards ransomware attacks is submitted pursuant to paragraph 1”. Paragraph 1 is Article 23(1), the notification of significant incidents. The three items are “whether the entity detected a ransomware attack”, “the attack vector of the ransomware attack”, and “whether mitigation measures have been implemented”. New Article 23(13) applies to “a significant incident caused by a ransomware attack”. Member States “shall ensure” that “the entities concerned” give the items that follow on request of the CSIRT or, where applicable, the competent authority. The entities give them “via a communication channel provided by the CSIRT or, where applicable, the competent authority”. The items are:
    • “if the entity has received a ransom demand and, where applicable, by whom”
    • “if a ransom was paid and if yes, what amount in what means of payment and to which recipient or receiving end, including the crypto-asset and crypto-asset service provider, where applicable”.
  • Article 24(4) to (6) — Member States “may require essential and important entities to obtain a certificate on the cyber posture under a European cybersecurity certification scheme adopted pursuant to Article 75” of the Cybersecurity Act 2 proposal, to show compliance with Article 21.
  • Article 26 — Article 26(1) gets a new point (d) for “air carriers”. The proposal replaces Article 26(3). The new Article 26(3) tells each essential or important entity that is “not established in the Union but offers services within the Union” to “designate a representative in the Union”. That entity is in the jurisdiction of the Member State “where the representative is established”. If that entity is of an Article 26(1)(a) type, it is in the jurisdiction of the Member State “in which it provides its services”. If the entity has no representative in the Union, “any Member State in which the entity provides services may take legal actions against the entity for the infringement of this Directive”. At this time, Article 26(3) applies to the types of entity in Article 26(1), point (b). These types include entities providing domain name registration services, which the new Article 26(3) of the proposal does not name.
  • Article 37a — ENISA helps Member States with mutual assistance.

COM(2025) 837 of 19 November 2025 ​

COM(2025) 837 (procedure 2025/0360(COD)), the Digital Omnibus, is a proposal for a regulation. Its Article 6 amends NIS2. As of October 2026, this proposal is not law. Article 6 has these changes:

  • New Article 23a — “ENISA shall develop and maintain a single-entry point to support the obligation to report incidents and related events under the Union legal acts where those Union legal acts provide so”. ENISA “may ensure that the single-entry point builds on the single reporting platform established under” Regulation (EU) 2024/2847, the Cyber Resilience Act. This rule is “Without prejudice to Article 16” of that Regulation. The new Article 23a(5) also gives this rule: “ENISA shall enable the notification of incidents under each Union legal act referred to in paragraph (1) only after piloting the functioning and after the Commission published a notice pursuant to paragraph 6.”
  • Article 23(1) — entities notify significant incidents “via the single-entry point established pursuant to Article 23a”.
  • New Article 23(12) — “When a manufacturer notifies a severe incident pursuant to Article 14(3) of Regulation (EU) 2024/2847 and the incident reporting under that Article contains relevant information as required under paragraph 4 of this Article, the reporting of the manufacturer under Article 14(3) of Regulation (EU) 2024/2847 shall constitute reporting of information under paragraph 4 of this Article.”
  • Article 30(1) — voluntary notifications to the CSIRTs or the competent authorities also go through the single-entry point.

The proposal does not change the time limits of Article 23(4).

NIS2 and other EU laws ​

NIS2 applies together with other legal acts. Each item gives more information:

  • DORA, Regulation (EU) 2022/2554 — for financial entities identified as essential or important entities “pursuant to national rules transposing Article 3” of NIS2, DORA is a sector-specific Union legal act for NIS2 Article 4 (DORA Article 1(2)). NIS2 also “does not apply to entities which Member States have exempted from the scope of Regulation (EU) 2022/2554 in accordance with Article 2(4) of that Regulation” (NIS2 Article 2(10)). See Article 2(10), Article 4, and NIS2 and DORA compared.
  • Cyber Resilience Act, Regulation (EU) 2024/2847 — its Article 14, “Reporting obligations of manufacturers”, applies from 11 September 2026 (Article 71(2) of that Regulation). These obligations are different from the NIS2 Article 23 obligations. See NIS2 and other EU reporting obligations and CRA reporting obligations.
  • GDPR, Regulation (EU) 2016/679 — NIS2 “applies without prejudice to Regulation (EU) 2016/679” (Article 2(12)). Article 35 gives the rules when an infringement of Article 21 or 23 can also be a personal data breach. See Administrative fines and other penalties.
  • CER Directive, Directive (EU) 2022/2557 — NIS2 applies “regardless of their size” to “entities identified as critical entities under Directive (EU) 2022/2557” (Article 2(3)). See The Article 2 scope test.
  • ISO/IEC 27001:2022 — a voluntary standard. An ISO/IEC 27001 certificate is not sufficient to show compliance with the obligations of NIS2. See Articles 24 and 25.

NIS2 in Modulos ​

Modulos gives NIS2 as two Frameworks with the name “NIS2”. OFF-15 is at the Organization level. MFF-15 is at the AI System level. The two levels are a Modulos decision, and NIS2 does not divide its obligations into these two levels.

Other Frameworks, for example DORA, ISO 27001, and the Cyber Resilience Act, can be on the same AI Systems. For the Controls that are in more than one Framework, see Control overlap. For the decisions, the steps, and the Requirements of each Framework, see How to use the NIS2 Frameworks in Modulos.

Where to go next ​

Who NIS2 applies to

The Article 2 scope, essential and important entities in Article 3, Article 4 and DORA, jurisdiction, the list of entities, and the registry.

NIS2 cybersecurity measures

Governance in Article 20, the Article 21 measures, and Implementing Regulation (EU) 2024/2690.

NIS2 incident reporting

Significant incidents, the Article 23 reports and their time limits, and Articles 29 and 30.

NIS2 supervision and enforcement

Supervision of essential and important entities, enforcement powers, liability of natural persons, and administrative fines in Articles 31 to 37.

How to use the NIS2 Frameworks in Modulos

The two Frameworks, the decisions, the steps, and the Requirements.

NIS2 and DORA compared

How NIS2 and DORA apply together.

NIS2 FAQ ​

For more information about NIS2, see NIS2 FAQ.

Sources ​

  • NIS2, Directive (EU) 2022/2555, OJ L 333, 27.12.2022, p. 80, CELEX 32022L2555: Articles 2 to 5, 20 to 46, Annexes I to III, and recitals 6 and 7 (EUR-Lex).
  • Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024, OJ L, 2024/2690, 18.10.2024: Articles 1 and 16 (EUR-Lex).
  • NIS2 Directive, information from the European Commission of 2 July 2026 (European Commission).
  • Press release IP/26/1499 of the European Commission, 8 July 2026 (European Commission).
  • COM(2026) 13, proposal of the European Commission of 20 January 2026, procedure 2026/0012(COD): Article 1 (EUR-Lex).
  • COM(2025) 837, the Digital Omnibus proposal of the European Commission of 19 November 2025, procedure 2025/0360(COD): Article 6 (EUR-Lex).
  • NIS Cooperation Group, “Reference document on security measures for entities under NIS2”, version 1.0, June 2026: the “Disclaimer” and section 1.1 (European Commission).
  • ENISA, “Technical Implementation Guidance” on Commission Implementing Regulation (EU) 2024/2690, version 1.0, June 2025: the “Disclaimer” (ENISA).
  • Guidelines on Article 3(4), “Commission Guidelines on the application of Article 3(4) of Directive (EU) 2022/2555 (NIS 2 Directive)”, 2023/C 324/02, OJ C 324, 14.9.2023: points 1 to 3.
  • Guidelines on Article 4, “Commission Guidelines on the application of Article 4(1) and (2) of Directive (EU) 2022/2555 (NIS 2 Directive)”, 2023/C 328/02, OJ C 328, 18.9.2023 (EUR-Lex).
  • DORA, Regulation (EU) 2022/2554: Article 1(2) (EUR-Lex).
  • Cyber Resilience Act, Regulation (EU) 2024/2847: Articles 14 and 71(2) (EUR-Lex).

Disclaimer

This section gives general information only. The obligations of entities come from the national law that transposes NIS2 in each Member State and, for relevant entities, from Implementing Regulation (EU) 2024/2690. Before you make a decision, read NIS2 on EUR-Lex and the national law, and get help from a person who knows this law.