Digital Lexicon Hub

EU Directive 2022/2555, which sets cybersecurity risk-management, incident-reporting and governance duties for entities in 18 critical sectors.

NIS2 makes management bodies accountable for cybersecurity and reaches suppliers through supply chain requirements, so even companies outside its scope are asked by in-scope customers to prove controls, incident readiness and contract terms.

A 120-employee managed service provider confirms it is in scope, registers with its national authority, has its board approve a risk-management plan, and rehearses submitting an early warning within 24 hours of a significant incident.

Obligations depend on national transposition laws, which differ in detail and were adopted late in several Member States. The Commission proposed targeted amendments in January 2026, so thresholds and procedures may still change.

Entities are classed as essential or important by sector and size, with medium and large organizations in scope by default. Article 21 requires measures such as incident handling, business continuity, supply chain security and multi-factor authentication, and Article 20 makes management bodies approve and oversee them. Significant incidents follow staged reporting: early warning within 24 hours, notification within 72 hours and a final report within one month. For essential entities, maximum fines must be at least €10 million or 2% of worldwide annual turnover, whichever is higher.