Article 5Minimum harmonisation

One sentence with a large consequence. The Directive does not prevent Member States from adopting or keeping provisions that give a higher level of cybersecurity, provided those provisions are consistent with their obligations under Union law.

NIS2 is therefore a floor, not a ceiling. A Member State’s law may go further, so the Directive as published is not a statement of any one State’s requirements. An organisation established in more than one Member State should expect to read each State’s law, and Article 26 on jurisdiction decides which State’s law applies to which establishment or service. Whether and how any particular State has gone further is a matter for its own legislation and is not something this Directive tells you.