NIS2, the European Union directive on network and information security

European Union law placing cybersecurity risk-management and incident reporting duties on entities across eighteen sectors, with the supervision and penalties behind them. It replaced the 2016 directive and widened considerably who is caught.

An entity is caught if it is of a type listed in the directive's two annexes and is medium-sized or larger — broadly, fifty or more staff, or annual turnover and balance sheet total both above ten million euro. Some providers are caught whatever their size, including public electronic communications services, trust service providers and domain name system services, and so is any organisation that is the sole provider in a member state of a service the state depends on.

The essential and important labels decide supervision and the fine ceilings rather than duties. The security and reporting obligations are substantially the same for both; an essential entity can be inspected because a supervisor decided to look, while an important entity is generally examined after something has happened. For breaches of Articles 21 and 23, Article 34 sets the ceiling that Member States must provide for at no less than EUR 10 million or 2 per cent of worldwide annual turnover for essential entities, and EUR 7 million or 1.4 per cent for important entities, whichever is higher.

It is a directive, so it binds through each member state's own transposing law and not directly. Member states were required to apply their national measures from 18 October 2024, and several were late.

Each member state names its own competent authority and incident reporting point in its transposing law. Cyprus, for example, transposed it by amending the Security of Networks and Information Systems Law of 2020, number 89(I)/2020, with the amending law number 60(I)/2025 in April 2025. The Cyprus Digital Security Authority is the single point of contact and CSIRT-CY is the national incident response team.

How an entity finds out it is in scope is also a national choice, and it is where guidance written for one country most often misleads a reader in another. Some countries ask entities to identify themselves and register by a deadline. Others have the authority draw up a list. Reporting deadlines and other detail can also differ in the national law. Before acting on any guide, check the national law that applies.

Two proposals to amend the directive are before the legislators. They are proposals, not law, status as at 24 October 2026. The Digital Omnibus proposal (COM(2025) 837 of 19 November 2025) would add an Article 23a for a single entry point for incident reporting run by ENISA. The proposal for a directive amending the NIS 2 Directive (COM(2026) 13 of 20 January 2026) would make targeted changes to scope and simplify some requirements. The European Parliament's Legislative Observatory lists both as awaiting committee decision (procedures 2025/0360(COD) and 2026/0012(COD)).