NIS2 COMPLIANCE IN 2026 – The Complete Guide for EU Businesses

I’ll be straight with you: the deadline already passed.

October 17, 2024. That was the date EU member states had to have NIS2 written into national law. It came and went. And from what I’ve seen working with companies across the continent, a lot of businesses that should have started this months ago are still somewhere between ‘we’ve got a plan’ and ‘we haven’t really started.’

I’m not here to lecture you. Compliance projects are genuinely difficult to prioritise when you’re also shipping product, managing a team, and dealing with a hundred other fires. But NIS2 has teeth that the original directive didn’t have. The penalties are real. The personal liability piece is real. And regulators who spent 2024 getting their own houses in order are now turning their attention outward.

So if you’ve landed here trying to get a clear picture of what NIS2 compliance actually involves, you’re in the right place. I’ve tried to write this the way I’d explain it to a client over coffee: no padding, no hiding behind jargon, and no pretending the hard parts aren’t hard.

What Even Is NIS2?

NIS2 is the EU’s second attempt at a cybersecurity framework for critical and important sectors. The first one, from 2016, was well-intentioned but had some real structural problems. Different countries implemented it so differently that two nearly identical companies on opposite sides of a border could face completely different compliance expectations.

The sectors it covered were too narrow. And the security requirements were written loosely enough that you could technically comply without doing much.

NIS2 is a more serious piece of work. It covers more industries. The requirements are specific enough that you can’t wriggle out of them. Enforcement mechanisms are stronger.

Two things changed that didn’t exist in the original:

First, senior managers can now be held personally liable if negligence on their part contributes to a compliance failure. Not the company. Them, personally.

Second, the directive extends security obligations to your supply chain. Your vendors, your SaaS tools, your managed service providers. If one of them gets hit and it takes you down with them, that’s a NIS2 issue on your end.

What does NIS2 compliance actually mean? It means having the security controls, governance, and incident response processes the directive requires, and being able to show a regulator evidence that they work. Not a folder of policies. Evidence.

Does NIS2 Apply to Your Business?

Essential Entities: The Obvious Ones

These are sectors the EU considers fundamental to national and economic stability. If you work in any of these areas, you’re almost certainly in:

• Energy: electricity, oil and gas networks, hydrogen production
• Transport: airlines, rail operators, ports, road freight at scale
• Banking and financial market infrastructure
• Healthcare: hospitals, labs, pharmaceutical manufacturers, medical device companies
• Water: drinking water supply and wastewater management
• Digital infrastructure: cloud providers, data centers, DNS operators, CDN providers, internet exchange points, trust service providers
• Public administration: central and regional government bodies
• Space: ground infrastructure operators

Important Entities: The Less Obvious Ones

Lighter supervisory treatment, same core security bar. This group catches people off guard:

• Postal and courier services
• Waste management
• Chemical manufacturing and distribution
• Food production and distribution at scale
• Manufacturing: medical devices, computers, electronics, machinery, vehicles
• Online marketplaces, search engines, social networks
• Research organisations

What About Company Size?

SaaS Companies and Tech Vendors: Read This Bit Carefully

This is where I see the most misunderstanding. If your software or services are used by companies that are themselves in scope for NIS2, there’s a real chance the directive applies to you as a digital service provider.

The supply chain provisions were specifically written to pull vendor obligations back up the chain. Cloud infrastructure, managed IT, business-critical SaaS, security tooling: if your customers are Essential or Important Entities, your own NIS2 status deserves a proper legal review. Guessing wrong in either direction is a problem.

What NIS2 Actually Requires: Breaking Down Article 21

Security Policies That Reflect Reality

You need written security policies. Everyone knows that. But the NIS2 requirement is that those policies are genuinely connected to how your organisation manages risk day to day. That means maintained asset inventories, actual threat assessments, documented decisions about identified risks. Not a policy drafted by a consultant three years ago that nobody’s touched since. Auditors are very experienced at spotting the difference between a document and a functioning process. If your policies describe procedures that don’t exist in practice, that gap will surface.

Incident Handling and the NIS2 Reporting Timeline

Operationally, this is the requirement that causes the most pain. The timelines are short:

• Early warning to your national CSIRT within 24 hours of identifying a significant incident
• Detailed incident notification within 72 hours
• Full final report within one month

What qualifies as ‘significant’? Roughly: anything that causes, or could realistically cause, serious disruption to your services, meaningful financial damage, or material harm to others. When you’re genuinely unsure, the directive expects you to report rather than deliberate.

Most companies haven’t rehearsed this workflow. That’s where NIS2 incident reporting failures happen — not in detecting the incident, but in executing the notification process under time pressure with people who’ve never done it before.

Business Continuity: Tested, Not Just Written

You need documented, tested plans for keeping operations running through a serious cyber incident. Backups, disaster recovery procedures, crisis communications, escalation paths. Tested. That word matters. A business continuity plan that exists only as a document and has never been exercised is, in practical terms, untested software. It fails when the pressure is real and the people running it have never actually run it.

NIS2 Supply Chain Security: The One That Surprises Everyone

NIS2 doesn’t only regulate your own systems. You’re responsible for assessing and managing the security risks your suppliers introduce to your operations. That means supplier due diligence processes, security obligations written into vendor contracts, and ongoing monitoring of supplier risk posture.

If a supplier gets compromised and takes you down with them, that’s a NIS2 compliance issue on your side of the relationship, not just theirs.

I’ve seen organizations spend months getting their internal controls in order and then discover they have 200 vendors they’ve never assessed. Start the supply chain workstream earlier than feels necessary.

Secure Development and Procurement Practices

When you build or buy technology, security needs to be part of the process from the start. Vulnerability management programmes, secure development practices, penetration testing, and the right security questions built into procurement before you sign anything.

Actually Proving Your Controls Work

Implementing security controls isn’t enough. NIS2 expects you to demonstrate their effectiveness through audits, assessments, and tracked metrics. If you can’t show a regulator that your controls are functioning as intended, that’s a gap, regardless of what your policies say they’re doing.

Basic Hygiene: No, You Can’t Skip This

The directive explicitly calls out MFA, patching discipline, encryption, and regular security awareness training for all staff as baseline requirements. Not aspirational. Baseline. If you haven’t sorted these, the more sophisticated controls you build on top of them are on a shaky foundation.

Access Control and People Processes

Clear, enforced processes for granting and revoking access. Privileged account management. Proper onboarding and offboarding. These are areas where policies frequently say one thing and operational reality says another. The gap matters.

Multi-Factor Authentication: It’s Explicitly Required

NIS2 names MFA. Not implied, not suggested named. It’s required across remote access, admin systems, and anywhere sensitive data or critical functionality is accessible. If you have systems still relying on passwords alone, that’s a direct compliance gap.

What Non-Compliance With NIS2 Actually Costs

The fines are significant enough that they need to be on the finance team’s radar, not just the security team’s.

Those are the ceilings. Actual enforcement decisions factor in the severity of the failure, whether negligence was involved, duration, prior history, and how cooperative the organisation was. Cooperation does count for something. It doesn’t eliminate the problem, but it affects outcomes.

Personal Liability: Why This One Changes the Board Conversation

This is genuinely new territory for most European businesses, and it’s the part that tends to shift executive attitudes when everything else hasn’t.

Under NIS2, individual senior managers can be held personally liable when negligence on their part contributes to a compliance failure. Some member states have gone further and given regulators the power to temporarily ban specific people from holding management positions.

Think through what that means in concrete terms. A CISO who documented a critical vulnerability, escalated it clearly, and got overruled. A CFO who cut the security budget for the third year running despite documented warnings. A CEO who kept treating cyber risk as somebody else’s problem. All of those situations now carry potential personal consequences for the individuals involved, not just the company.

The directive designed it that way. The goal is to make cybersecurity impossible to keep deprioritising. Whether that’s a proportionate approach is a legitimate debate. It’s also the operating reality, and it changes how these conversations go.

Step-by-Step: How to Actually Get NIS2 Compliant

1. Confirm your scope. Not ‘we think we’re probably covered.’ Actually confirm it, with legal input. Work out which national authority has jurisdiction over you. If you operate across multiple EU countries, understand that you may be dealing with more than one.
2. Run an honest gap analysis. Map your actual security posture against Article 21. Be brutal about the difference between what your policies describe and what your organisation does in practice. Everything that follows is built on this. If it’s inaccurate, the whole programme is built on sand.
3. Fix your security policies. If you have ISO 27001, use it as your starting point. But don’t assume it covers everything NIS2 requires, because it doesn’t. The incident reporting timelines, supply chain obligations, and management accountability sections all need specific attention.
4. Build your incident response process. Write the procedure. Assign roles to specific named people, not job titles. Map the notification workflow all the way from initial detection to the CSIRT submission. Make sure the senior managers who’d need to make decisions at 2am actually know what they’re supposed to do before that happens.
5. Attack the supply chain workstream early. Build a complete vendor inventory if you don’t have one. Tier your suppliers by how critical they are to your operations. Start due diligence on the high-priority ones. Update your standard contracts to include security obligations and audit rights. This consistently takes longer than every other workstream.
6. Close the technical gaps. Based on the gap analysis: MFA rollout, encryption improvements, network segmentation, vulnerability scanning, patching process improvements. Prioritise by actual risk, not by what’s most visible or easiest.
7. Train the people who matter. Everyone gets baseline security awareness training. Technical staff need more depth. Your board and senior leadership need to understand specifically what the personal liability provisions mean for them individually.
8. Test your plans before you need them. Run a tabletop incident response exercise with the real people who’d be in the room. Simulate the notification process under time pressure. Test the business continuity plan with the people who’d actually be executing it.
9. Register with your national competent authority. Most member states require in-scope entities to formally register. Check what your jurisdiction requires and get it done.
10. Build maintenance into your rhythm. NIS2 compliance isn’t a project with a finish line. Schedule regular reviews. Reassess when your business, systems, or threat environment changes significantly.

Where NIS2 Programmes Go Wrong: The Honest Version

After working through NIS2 compliance with businesses across manufacturing, technology, healthcare, and financial services, certain problems come up so reliably that they’re worth naming upfront.

Scope determination takes longer than expected.

The sector and size definitions look straightforward in the text of the directive and get complicated fast when applied to real businesses with subsidiaries, group structures, and activities that span multiple categories. This is an area where getting legal input early saves significant pain later.

The supplier list is always bigger than anyone thought.

When companies actually build a proper vendor inventory for the first time, they routinely find two or three times more suppliers than they’d assumed. Getting meaningful security assurance from all of them — especially the ones that resist due diligence — is a substantial programme of work. Start with the suppliers most critical to your operations and systematically work outward.

Getting the board to care before they have to.

Some leadership teams treat NIS2 as an IT department issue until they understand the personal liability provisions clearly. Once they understand that their own names could appear in an enforcement action, engagement tends to improve quickly. If you’re struggling to get senior attention, lead with that.

Overestimating what ISO 27001 covers.

ISO 27001 is genuinely useful here. It reduces NIS2 compliance effort considerably and gives you a strong foundation. But the certification doesn’t map cleanly onto the directive. The specific incident notification timelines, the supply chain security requirements, and the management accountability provisions all need additional work that ISO 27001 doesn’t address.

Badly underestimating the timeline.

Done properly, NIS2 compliance is six to eighteen months of sustained work. Companies that try to compress it into a few weeks typically end up with documentation that doesn’t reflect their actual practices. That’s arguably worse than having nothing, because it creates a false sense of security that surfaces at the worst possible moment — usually during an audit or an actual incident.

Why Even Well-Prepared Companies Still Fail NIS2 Audits

These aren’t failures from organizations that didn’t try. These are failure patterns that emerge even when a company has invested time and money in compliance.

The documentation looks right. The reality doesn’t.

This is the most common failure mode. Policies describing processes that nobody actually follows. Risk registers that haven’t been updated in over a year. Experienced auditors are very good at finding the gap between what a document claims and what an organisation does on a normal working day. The gap is usually obvious within an hour.

The incident response plan has never been practiced.

An untested incident response plan is, functionally, untested software. When a real incident happens, people fall back on what they actually know how to do under pressure, not what a document says they should do. Meeting the 24-hour early warning requirement is extremely difficult if the people running the process have never actually run it before.

Supply chain momentum ran out.

Getting the supplier due diligence programme started is the easy part. Sustaining it through to actual meaningful security assurance from every high-risk vendor — and then doing something about the gaps — is what most programmes don’t finish. It needs a dedicated owner and persistent follow-through, not a one-off questionnaire sent to a list and then forgotten.

The programme was owned entirely by IT.

NIS2 has real implications for legal, HR, procurement, finance, and the board. Compliance programmes that live only within the IT or security team tend to miss critical cross-functional dependencies. The vendor contract work needs legal involvement. The management accountability requirements need genuine engagement from the people whose names are on the line.

How Our NIS2 Compliance Services Work in Practice

We work with medium and large businesses across the EU that need to get NIS2 compliant without the cost and delay of building an entire internal compliance team from scratch. Our work tends to fall into four areas, though most engagements end up touching all of them.

NIS2 Readiness Assessment

We start by building an honest picture of where you actually are. That means reviewing your current security policies, controls, and processes against Article 21 and producing a gap report that tells you exactly what needs to happen and in what order. Not a theoretical framework you can’t act on. Something you can use to start running a programme the following week.

Compliance Programmed Delivery

For companies that want hands-on support through the whole process, we embed with your team and drive the programme alongside you. Policy development, supplier engagement, technical controls, training, evidence collection. We keep things moving when other priorities compete for attention, which they always do.

Incident Response Design and Testing

We design incident response procedures built around how your organisation actually operates, not copied from a template. Then we run exercises that put your real people through the notification process under time pressure. It’s unglamorous work. It makes a measurable difference when something actually goes wrong.

Ongoing Compliance Support

For clients who want a long-term partner rather than a one-off engagement, we run regular compliance health checks, track regulatory developments across relevant member states, and reassess posture as the business evolves. Compliance isn’t something you achieve and then leave alone.

Not sure where you stand? We offer a free 30-minute NIS2 assessment call for CTOs, CISOs, and founders. No presentation. No pitch. Just an honest look at your specific situation and what it would take to get compliant.

Real Example: Nine Months from Uncertain to Compliant

Where They Started

A Dutch B2B SaaS company. Around 180 staff, roughly €22 million annual turnover. Their product was workflow automation software for logistics operators across five EU countries. Important Entity territory, though they hadn’t formally confirmed that when we first spoke.

They had SOC 2 Type II, which gave them a decent foundation to work from. What they didn’t have was a formal incident response procedure, a properly maintained vendor list, or anyone in a dedicated security governance role. The CISO function was being handled by the Head of IT on top of everything else they were doing.

What Nine Months Looked Like

How It Ended Up

They passed an initial supervisory review without significant findings. The compliance posture also turned into something none of us had anticipated: a commercial differentiator. Two large logistics clients specifically named NIS2 compliance as a factor in their vendor selection decisions during procurement. The ROI on the compliance investment ended up being broader than a pure risk mitigation story.

NIS2 Compliance Questions We Get Asked Most Often

What’s the actual difference between NIS2 and GDPR?

GDPR is about protecting personal data: how it’s collected, stored, processed, and shared. NIS2 is about the security of the networks and systems organizations use to deliver services.

They overlap when a cyberattack also results in a data breach, which is common. But they’re separate laws with different regulators, different requirements, and different penalty calculations. You need to think about both, not treat one as a replacement for the other.

Does NIS2 apply to every business operating in the EU?

No. It applies to medium and large organisations in the sectors listed in the directive. Smaller businesses can be brought into scope if a national authority decides their services are critical at a national level, but that’s not the default. The scope question is worth getting proper legal advice on.

Assuming you’re out of scope and being wrong is a worse outcome than investing in a scope review.

Be honest: how long does NIS2 compliance actually take?

Six to eighteen months from a genuine standing start. Where you land depends on your current security posture and how complicated your supply chain is. Companies with ISO 27001 already in place and a functioning security team can often get through it in six to nine months.

Companies starting from a low baseline with a large and unmanaged supplier base should plan for closer to eighteen months. Anyone who tells you they can get you fully compliant in six weeks is either selling something or planning to cut corners that will matter later.

What if we get hit by a breach while we’re still mid-compliance programmed?

You could face two separate enforcement exposures: penalties for the security failures that enabled or worsened the breach, and separately, penalties for any failures in the incident notification process.

Regulators will consider whether you were making genuine documented progress toward compliance at the time, or doing nothing. Being mid-programme with evidence of real progress is a meaningfully different position from having done nothing. It’s not an immunity. But it’s a different conversation.

Can you outsource NIS2 compliance entirely?

A lot of the execution can be outsourced: programme management, technical assessments, policy development, training, supplier due diligence. What can’t be outsourced is accountability.

The management liability provisions sit with your senior leadership regardless of who’s doing the implementation work. Hiring an external firm to run your compliance programme doesn’t transfer the personal responsibility that sits with your executives.

We’re based outside the EU but serve EU customers. Does NIS2 apply to us? (H3)

Possibly. Non-EU digital service providers offering services within the EU may need to designate an EU representative and could be subject to NIS2 obligations. The answer depends on your specific business model and client base. This is not an area to navigate by general rule. Get specialist advice.

What does ‘significant incident’ actually mean under NIS2?

Roughly: any incident that causes or could realistically cause serious disruption to your services, material financial damage, or significant harm to other organisations or individuals. The assessment factors in how many users are affected, how long the disruption lasts, and how wide the geographic impact is.

When you’re genuinely uncertain whether something qualifies, the directive’s expectation is that you report rather than wait. The cost of an unnecessary report is low. The cost of missing a required one is not.

We have ISO 27001 certification. Are we basically NIS2 compliant already?

You’re in a much better position than most organizations and the certification will reduce your NIS2 compliance effort considerably. But the honest answer is no, not automatically.

The incident notification timelines, the supply chain security requirements, and the executive accountability provisions all go beyond what ISO 27001 certification covers. Think of it as a strong foundation you’re building on, not a building you’ve already finished.

So, Where Do You Go from Here?

Enforcement is increasing. The national competent authorities across the EU that spent 2024 building their regulatory frameworks are now turning their attention to the organisations they supervise. Early enforcement actions are beginning to surface publicly. The comfortable position of ‘we’re planning to get to this’ is getting harder to hold.

The gap between where most companies currently are and where they need to be doesn’t close by itself. And it tends to get more expensive to fix the longer you leave it, because the shortcuts taken under time pressure create technical debt that compounds.

We work best with companies that are ready to treat this as a real programme with real resources behind it. If that’s where you are, let’s talk.

What Working With Us Looks Like in Practice

• Clear view of your actual compliance position, typically within two weeks of starting an assessment
• Remediation roadmap built around your real timeline and resources, not an idealised version
• Hands-on delivery support across every workstream
• Incident response procedures your team can actually execute when something goes wrong at 11pm on a Friday
• A long-term relationship if you want one, not a project that disappears once the report is delivered