Docs

Appearance

Frequently asked questions about NIS2 ​

This section gives the primary rule of NIS2 first, then names the section with the full rule.

Disclaimer

This page gives general information. It is not legal advice.

What is the NIS2 Directive and what does it replace? ​

NIS2 is Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 “on measures for a high common level of cybersecurity across the Union”. It replaces the first NIS Directive, Directive (EU) 2016/1148, which Article 44 repeals with effect from 18 October 2024.

“This Directive is addressed to the Member States” (Article 46). Thus, the obligations of entities apply through the national law that transposes NIS2 (Article 41(1)). Member States can keep or make provisions for “a higher level of cybersecurity” that are “consistent with” Union law (Article 5). Commission Implementing Regulation (EU) 2024/2690 applies directly, but only to its relevant entities (its Articles 1 and 16). See Dates and transposition of NIS2.

Who must comply with NIS2? ​

NIS2 applies through national law to “public or private entities” of Annex I or II types that are medium-sized enterprises or above those ceilings. Article 2(1) also has the condition that they “provide their services or carry out their activities within the Union”. Check also:

  • Scope “regardless of their size” for Annex I/II types, critical entities and entities providing domain name registration services, with Member State identification for Article 2(2)(b) to (e): Article 2(2) to (4).
  • Member States can add public administration entities at local level and education institutions: Article 2(5).
  • NIS2 does not apply to public administration entities that “carry out their activities in the areas of national security, public security, defence or law enforcement”: Article 2(7).
  • Member States can exempt some entities from the obligations in Article 21 or 23 “with regard to those activities or services”. These are entities that “carry out activities in the areas of national security, public security, defence or law enforcement”, and entities that “provide services exclusively to the public administration entities referred to in paragraph 7”. Then “the supervisory and enforcement measures referred to in Chapter VII shall not apply in relation to those specific activities or services”. Check also Articles 3 and 27: Article 2(8).
  • Paragraphs 7 and 8 do not apply where an entity “acts as a trust service provider”: Article 2(9).
  • NIS2 does not apply to entities that Member States “have exempted from the scope of Regulation (EU) 2022/2554 in accordance with Article 2(4) of that Regulation” (DORA): Article 2(10).
  • Sector-specific Union legal acts with equivalent requirements: Article 4.

When does NIS2 apply? ​

Member States had to transpose NIS2 by 17 October 2024 and apply the measures from 18 October 2024 (Article 41(1)). NIS2 entered into force on 16 January 2023. Entity obligations apply through national law: dates and transposition.

As of October 2026, the Commission press release IP/26/1499 gives this status. On 8 July 2026, the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice “for failing to notify measures transposing the NIS2 Directive”. See transposition status.

Check also the start date for relevant entities of 7 November 2024 for Implementing Regulation (EU) 2024/2690 (Article 16): dates. The Article 27(2) registry date is 17 January 2025: registry.

What does Article 21 require? ​

In NIS2, Member States “shall ensure that essential and important entities take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems which those entities use for their operations or for the provision of their services, and to prevent or minimise the impact of incidents on recipients of their services and on other services” (Article 21(1)). The measures “shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following” (Article 21(2)):

  • (a) “policies on risk analysis and information system security”
  • (b) “incident handling”
  • (c) “business continuity, such as backup management and disaster recovery, and crisis management”
  • (d) “supply chain security”
  • (e) “security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure”
  • (f) “policies and procedures to assess the effectiveness of cybersecurity risk-management measures”
  • (g) “basic cyber hygiene practices and cybersecurity training”
  • (h) “policies and procedures regarding the use of cryptography and, where appropriate, encryption”
  • (i) “human resources security, access control policies and asset management”
  • (j) “the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate”.

Check also:

  • The “proportionality” test and standards: Article 21(1).
  • For point (d), the items that entities take into account when they select the “appropriate” measures: Article 21(3).
  • Corrective measures: Article 21(4).
  • The Annex to Implementing Regulation (EU) 2024/2690, for relevant entities only: Article 21(5).
  • Sector-specific Union legal acts: Article 4.

See the minimum measures.

What are the NIS2 incident reporting timelines? ​

Through national law, essential and important entities report significant incidents to the CSIRT or, where applicable, the competent authority (Article 23(4)). The time limits are:

  • Early warning: 24 hours. Incident notification: 72 hours. Each period starts at “becoming aware of the significant incident”, with notification “without undue delay” (points (a), (b)).
  • Intermediate report on request (point (c)).
  • Final report: “not later than one month after the submission of the incident notification under point (b)” (point (d)).
  • Progress report and then final report for an ongoing incident (point (e)).

Check the point (b) derogation for trust service providers, for significant incidents with an “impact” on trust services (second subparagraph). Check criteria for a significant incident (Article 23(3), plus Implementing Regulation (EU) 2024/2690 for relevant entities).

How does NIS2 relate to DORA? ​

For financial entities identified as essential or important entities through national law for transposition of NIS2 Article 3, DORA is a sector-specific Union legal act (DORA Article 1(2)). NIS2 Article 4(1) and (2) set the equivalence conditions that remove “the relevant provisions of this Directive”, with Chapter VII supervision and enforcement: Article 4.

Check also:

  • NIS2 continues for entities to which the sector-specific Union legal act does not apply (Article 4(1)): Article 4.
  • NIS2 does not apply to entities that Member States exempt from DORA through DORA Article 2(4) (NIS2 Article 2(10)): scope test.

See NIS2 and DORA compared.

How does NIS2 relate to ISO/IEC 27001? ​

An ISO/IEC 27001:2022 certificate is not sufficient to show NIS2 compliance. ISO/IEC 27001 is voluntary, with clauses and Annex A controls related to Article 21(2): related provisions.

NIS2 obligations apply through national law and, for relevant entities, Implementing Regulation (EU) 2024/2690: certification and standards. Competent authorities supervise compliance (Articles 32 and 33): supervision.

Check the standards condition in Article 21(1). Check also Articles 24 and 25. Article 25(1) tells Member States to “encourage the use of European and international standards and technical specifications relevant to the security of network and information systems”. Article 24(1) tells Member States that they “may require” essential and important entities “to use particular ICT products, ICT services and ICT processes” that are “certified under European cybersecurity certification schemes”, “to demonstrate compliance with particular requirements of Article 21”.

What are the NIS2 fines? ​

NIS2 sets minimum levels for maximum fines in national law for infringements of Articles 21 or 23:

  • Essential entities: EUR 10 000 000 or 2 % (Article 34(4)).
  • Important entities: EUR 7 000 000 or 1.4 % (Article 34(5)).

The % is of “the total worldwide annual turnover in the preceding financial year of the undertaking”, “whichever is higher”: fine rules. For public administration entities, each Member State “may lay down the rules on whether and to what extent administrative fines may be imposed” (Article 34(7)).

Check periodic penalty payments, no Article 34 fine after a GDPR fine “arising from the same conduct”, and penalties in national law (Articles 34(6), 35(2), and 36). Check also liability of natural persons (Articles 32(6) and 33(5)).

What is the difference between essential and important entities under NIS2? ​

Essential and important entities have the same NIS2 obligations in Articles 21 and 23, but different supervision, fine levels and enforcement powers.

Check these rules:

Is NIS2 being amended? ​

Two Commission proposals contain changes to NIS2. As of October 2026, the two proposals are not law, and NIS2 applies without their changes.

  • COM(2026) 13 of 20 January 2026 changes Annex I ceilings in its proposal (Article 3(1)(a)). It also changes the “regardless of their size” rules for DNS service providers, “providers of European Digital Identity Wallets”, and “providers of European Business Wallets” (Articles 2(2), 3(1)(b)). It adds paragraphs 23(12) and 23(13) on “ransomware attacks” (Article 1, point (8), of the proposal). It extends Article 26(3) to each essential or important entity that “is not established in the Union but offers services within the Union”.
  • COM(2025) 837 of 19 November 2025, Article 6, adds an ENISA single-entry point in its proposal (new Article 23a). It also adds a different Article 23(12), on CRA Article 14(3) reports.

Which Modulos Frameworks cover NIS2? ​

Modulos gives NIS2 as two Frameworks with the name NIS2: OFF-15 for the Organization, and MFF-15 for each AI System. You add OFF-15 to your organization AI System. If you do not have an organization AI System, contact Modulos. Modulos recommends that you add MFF-15 to each AI System that the entity uses for its services.

The Requirements for Articles 2 to 4, 20, 26 to 30, 32, and 33 are in OFF-15 only. The Requirements for Articles 21 and 23 are in the two Frameworks. Some of these Requirements also include Implementing Regulation (EU) 2024/2690, which applies to relevant entities only. See The two NIS2 Frameworks and Requirements of the NIS2 Frameworks.

What does Article 4 do for sector-specific Union legal acts? ​

For essential or important entities, NIS2 Article 4 removes “the relevant provisions of this Directive”, with Chapter VII supervision and enforcement, when the requirements of sector-specific Union legal acts are “at least equivalent in effect”.

The Article 4 section gives each condition:

  • Equivalent cybersecurity risk-management measures, or “immediate access” to notifications together with equivalent notification requirements (Article 4(2)).
  • NIS2 continues to apply to entities to which the sector-specific Union legal act does not apply (Article 4(1), second sentence).
  • No obligation to record the result (Article 4).
  • DORA as a sector-specific Union legal act for financial entities identified as essential or important entities through national law for transposition of NIS2 Article 3 (DORA Article 1(2)).

How does NIS2 apply to non-EU providers? ​

Through national law, Article 26(3) applies if an Article 26(1)(b) entity “is not established in the Union, but offers services within the Union”. The entity must designate a representative in the Union.

Check the Article 26(1)(b) entity types. The Directive gives no representative rule for other types. Check jurisdiction, the representative's Member State, and “legal actions” without a representative or against the entity (Article 26(3) and (4)). Check also the test for services in the Union (recital 116).

The proposal COM(2026) 13 of 20 January 2026 extends Article 26(3) to each essential or important entity that “is not established in the Union but offers services within the Union”. As of October 2026, it is not law: proposal.

What is Commission Implementing Regulation (EU) 2024/2690? ​

Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024 gives technical and methodological requirements for Article 21(2) measures and more criteria for significant incidents.

Check its two functions and limits:

  • The Annex requirements for measures (Article 2(1)): requirements.
  • Criteria for significant incidents (Articles 3 to 14): criteria.
  • The Regulation applies directly from 7 November 2024 (Article 16), only to its relevant entities. These are the essential or important entities of the types in Article 1: entity types and dates.
  • The obligation to “document its reasoning” when a relevant entity does not apply a requirement with an Annex condition (Article 2(2)): conditions.

Does the size-cap rule apply uniformly? ​

No. NIS2 Article 2(1) applies to medium-sized enterprises of Annex I or II types, or entities above those ceilings, that “provide their services or carry out their activities within the Union”. Recital 7 uses the name “size-cap rule”.

The scope test gives these limits:

  • Scope “regardless of their size” for Article 2(2) types, CER critical entities, and entities providing domain name registration services (Article 2(2) to (4)).
  • SME ceilings for persons, “annual turnover” and “annual balance sheet total” (Recommendation 2003/361/EC, Annex Article 2(1)).
  • Control by public bodies does not prevent SME status for NIS2 (Article 2(1), second subparagraph).
  • “two consecutive accounting periods” and data of partner enterprises and linked enterprises (Recommendation Annex Articles 4(2) and 6(2)).

When must NIS2 entities update their registration details? ​

Through national law, NIS2 entities notify changes to Article 3(4) information “without delay, and, in any event, within two weeks of the date of the change”. In Article 27(3), they notify changes “without delay and in any event within three months of the date of the change”.

Check entities in the list and registry, and when the two time limits apply (Articles 3(3), 26(1)(b), 27). Check also entities that Member States can exempt (Article 2(8)).

The proposal COM(2026) 13 of 20 January 2026 removes Article 27(2) and gives two weeks for registry changes. As of October 2026, it is not law: proposal.

What does Article 20 require of management bodies? ​

NIS2 Article 20(1) tells Member States to make sure that the management bodies of essential and important entities “approve the cybersecurity risk-management measures taken by those entities in order to comply with Article 21, oversee its implementation and can be held liable for infringements by the entities of that Article”. Article 20(2) tells Member States to make sure that the members of the management bodies “are required to follow training”.

Check the second subparagraph of Article 20(1): the paragraph is “without prejudice to national law as regards the liability rules applicable to public institutions, as well as the liability of public servants and elected or appointed officials”. Check also the liability of natural persons (Articles 32(6) and 33(5)). See Article 20 and Liability of natural persons.

Does Article 21 prescribe specific technical controls? ​

Only in part. NIS2 Article 21(2) gives ten minimum measures, and some of these measures name the solutions to use. For example, point (j) names “the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate”. These rules also apply:

  • Member States “may require” essential and important entities “to use particular ICT products, ICT services and ICT processes” that are “certified under European cybersecurity certification schemes adopted pursuant to Article 49 of Regulation (EU) 2019/881” (Article 24(1)).
  • Member States can keep or adopt provisions for “a higher level of cybersecurity” that are “consistent with Member States’ obligations laid down in Union law” (Article 5).
  • For relevant entities, the Annex to Implementing Regulation (EU) 2024/2690 gives the technical and methodological requirements of each Article 21(2) point (Article 2(1)).

See Article 21(2) and Article 21(5).

How does Article 21(3) supply-chain risk assessment work? ​

NIS2 Article 21(3) is about the supply chain security measures of Article 21(2), point (d). Member States make sure that, when entities select the “appropriate” point (d) measures, they take into account these items:

  • “the vulnerabilities specific to each direct supplier and service provider”
  • “the overall quality of products and cybersecurity practices of their suppliers and service providers, including their secure development procedures”. This item applies to all suppliers and service providers, not only to the direct suppliers.
  • the results of the coordinated security risk assessments of critical supply chains in Article 22(1).

See Article 21(3).

What happens when an entity does not comply with Article 21? ​

Through the national law that transposes NIS2 Article 21(4), an entity that finds that it does not comply with the Article 21(2) measures “takes, without undue delay, all necessary, appropriate and proportionate corrective measures”.

Check the order to comply with Article 21 (Articles 32(4)(d), 33(4)(d)), and powers only for essential entities (Article 32(4)(g)). Check also “ex post supervisory measures” for important entities (Article 33(1)) and fine levels (Article 34(4) and (5)). See Article 21(4).

What makes an incident 'significant' under Article 23(3)? ​

In NIS2 Article 23(3), an incident is a significant incident if it “has caused or is capable of causing severe operational disruption of the services or financial loss for the entity concerned” (point (a)). An incident is also a significant incident if it “has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage” (point (b)).

For the relevant entities of Implementing Regulation (EU) 2024/2690 only, Articles 3 to 14 of that Regulation add criteria. An example is “direct financial loss for the relevant entity that exceeds EUR 500 000 or 5 % of the relevant entity’s total annual turnover in the preceding financial year, whichever is lower” (Article 3(1)(a)). Check also recurring incidents (Article 4) and the incidents that are not significant incidents (Article 3(2)). See Article 23(3).

What are the staged reports under Article 23(4)? ​

Through national law, NIS2 Article 23(4) gives these reports on a significant incident to the CSIRT or, where applicable, the competent authority:

  • Early warning (point (a)): “without undue delay and in any event within 24 hours of becoming aware of the significant incident”.
  • Incident notification (point (b)): “without undue delay and in any event within 72 hours of becoming aware of the significant incident”.
  • Intermediate report (point (c)): on request of the CSIRT or the competent authority.
  • Final report (point (d)): “not later than one month after the submission of the incident notification under point (b)”.
  • Progress report and then final report (point (e)): for an ongoing incident, with their time limits.

Check the derogation for trust service providers for significant incidents with an “impact” on trust services (second subparagraph).

What is the trust-service 24-hour derogation in Article 23? ​

In NIS2, a trust service provider notifies significant incidents “that have an impact on the provision of its trust services” to the CSIRT or, where applicable, to the competent authority. The time limit is “without undue delay and in any event within 24 hours of becoming aware of the significant incident”. This rule is the second subparagraph of Article 23(4), and it applies through national law.

The rule replaces only point (b). Check the start of the final report period, which the Directive does not give for this condition (Article 23(4)(d)). Check also significant incident criteria for relevant entities (Implementing Regulation (EU) 2024/2690, Article 14).

Does Article 23 require notifying customers or the public? ​

Not in all conditions. Through national law, NIS2 Article 23 gives obligations with conditions for service recipients:

  • Incident notification: “Where appropriate”, “without undue delay”, for significant incidents “that are likely to adversely affect the provision of those services” (Article 23(1)).
  • Significant cyber threat information: “Where applicable”, “without undue delay”, “measures or remedies” for recipients “potentially affected by a significant cyber threat”, and, “Where appropriate”, information about the significant cyber threat (Article 23(2)).

Information to the “public” is a power of the CSIRT or the competent authority. It applies where “public awareness is necessary to prevent a significant incident or to deal with an ongoing significant incident”, or where “disclosure of the significant incident is otherwise in the public interest” (Article 23(7)). The CSIRT or the competent authority “may, after consulting the entity concerned, inform the public about the significant incident or require the entity to do so”. Check also the order of a competent authority to tell persons “potentially affected by a significant cyber threat” (Articles 32(4)(e) and 33(4)(e)).

Where do Article 23 reports go and what feedback does the entity receive? ​

The entity sends NIS2 Article 23(4) reports to the CSIRT or, where applicable, the competent authority. National law identifies these recipients (Articles 8(1), 10(1)). The competent authority forwards the notification to the CSIRT “upon receipt” (Article 23(1)).

Article 23(5) gives the “response” and its conditions:

  • “initial feedback” “without undue delay and where possible within 24 hours of receiving the early warning”.
  • Guidance on “mitigation measures” on request.
  • CSIRT “technical support” on request.
  • Guidance on reports to law enforcement authorities for incidents “suspected to be of criminal nature”.

How is NIS2 scope handled in Modulos? ​

In Modulos, you make NIS2 scope decisions for the entity before you add the Frameworks. Check scope, entity groups and sector-specific Union legal acts (Articles 2 to 4).

Each AI System gets all Requirements of its Framework. The Requirement Owner marks a Requirement as out of scope when its obligation does not apply, with the facts in a comment. A scope decision does not make a Requirement fulfilled: step 4.

Modulos wants to use the NIS2 Scope tags in a new release to remove Requirements from the scope: NIS2 tags.

What's the typical rollout sequence? ​

Modulos recommends eight steps for NIS2, which sets no sequence. The full procedure gives each step:

  1. Make entity scope decisions (Articles 2 to 4).
  2. Send list and registry information. Do the representative and domain name registration data work, where applicable (Articles 3(4), 27(2), 26, 28).
  3. Add OFF-15 and MFF-15 to applicable AI Systems.
  4. Mark Requirements as out of scope when their obligations do not apply.
  5. Do the Article 20 work.
  6. Do the Article 21 work at each level, plus the Implementing Regulation (EU) 2024/2690 Annex work for relevant entities.
  7. Do the Article 23 and Article 29(4) work. Do the Article 30 work for voluntary notifications.
  8. Prepare for supervision and enforcement (Articles 32, 33).

What do the NIS2 tags in Modulos mean? ​

The NIS2 tags put the Requirements of OFF-15 and MFF-15 into groups. Each Requirement has a NIS2 Domain tag, which gives the area of the measures or obligations. Each Requirement also has NIS2 Basis tags, which give the source of the obligation. The source is an Article of the Directive or Implementing Regulation (EU) 2024/2690, which applies to relevant entities only. Some Requirements also have a NIS2 Scope tag, which gives the type of entity or the condition for which the obligation applies.

Modulos wants to use the NIS2 Scope tags in a new release to remove Requirements from the scope. Until then, follow step 4 of Steps that Modulos recommends. See NIS2 tags.

What evidence is typically needed for a NIS2 audit? ​

NIS2 gives no general list of records for an audit. Competent authorities can request information, “documented cybersecurity policies” and “evidence of implementation” (Articles 32(2)(e) to (g), 33(2)(d) to (f)). Important entities have “ex post supervisory measures” (Article 33(1)): supervisory powers.

Check also these records:

Does Modulos manage cross-Member-State coordination? ​

No. The information to other Member States is a task of the authorities, not of the entity. No Requirement includes Article 23(6) to (10). “Where appropriate, and in particular where the significant incident concerns two or more Member States”, the CSIRT, the competent authority, or the single point of contact tells “the other affected Member States and ENISA” “without undue delay” (Article 23(6)).

The part of the entity is the cross-border information in its reports (Article 23(1) and (4)). The Requirements on Article 23 in OFF-15 and MFF-15 include these obligations of the entity. See Article 23(6) to (11).