NIS2
NIS2Also called NIS2 Directive, directive (EU) 2022/2555
NIS2 is the EU directive that sets cybersecurity rules for essential and important entities in 18 sectors, including banking, financial market infrastructure, energy, health and digital infrastructure. It requires risk management measures, management accountability and fast incident reporting. It replaced the first NIS Directive and has applied since 18 October 2024.
How it works
Member states transpose NIS2 into national law and decide which entities fall in scope, largely by sector and size. In-scope entities adopt measures covering risk analysis, incident handling, business continuity, supply chain security and encryption. Management bodies must approve and oversee those measures and receive training. Significant incidents trigger an early warning within 24 hours, a notification within 72 hours and a final report within one month.
For banks and financial market infrastructure, DORA applies as the sector-specific law, so DORA's ICT rules take precedence over NIS2's equivalent duties. NIS2 still matters to financial groups through non-financial subsidiaries, critical suppliers and cloud providers in scope. Maximum fines for essential entities must be at least €10 million or 2% of worldwide turnover. The Commission proposed targeted amendments on 20 January 2026.
The rules
Sets cybersecurity risk management, governance and incident reporting duties, with maximum fines of at least €10 million or 2% of worldwide turnover.
Essential and important entities in 18 sectors across the EUSpecifies the technical cybersecurity measures and the thresholds for a significant incident for digital service entities.
Digital infrastructure and ICT service providers such as cloud, data centre and managed service providersActs as sector-specific law for financial entities, so its ICT risk and incident rules apply in place of NIS2's equivalents.
EU financial entities and critical ICT third-party providersCommon questions
Does NIS2 apply to banks?
Banking and financial market infrastructure are NIS2 sectors. For those entities, DORA is the sector-specific law, and its ICT risk management and incident reporting rules apply instead of NIS2's equivalent provisions. National authorities still list them for NIS2 coordination purposes.
What are the NIS2 incident reporting deadlines?
A significant incident requires an early warning to the national CSIRT or authority within 24 hours of becoming aware of it. A fuller incident notification follows within 72 hours. A final report is due within one month of the notification.
What is the difference between essential and important entities?
Essential entities are generally larger firms in the highest-criticality sectors and face proactive supervision and higher maximum fines. Important entities are subject to reactive, after-the-event supervision, with maximum fines of at least €7 million or 1.4% of worldwide turnover.
Are management bodies personally accountable under NIS2?
Management bodies must approve the cybersecurity risk management measures, oversee their implementation and follow training. Member states must ensure they can be held liable for infringements, and authorities can in some cases temporarily bar individuals from management roles at essential entities.
Our coverage
News and analysis on GRC and resilience from RegTech Post.
Read the coverage →RegTech PostNIS2 Overview: How the EU Is Reshaping Digital SecurityRead the article →RegTech PostDanish RegTech Firm Formalize Secures €30 Million in Series B FundingRead the article →
