What changed from NIS1 to NIS2 and does it apply to my organization
NIS2 replaced the national identification of operators with a size threshold. Directive (EU) 2022/2555 repealed the first NIS Directive, Directive (EU) 2016/1148, with effect from 18 October 2024, and covers 18 sectors: 11 of high criticality in Annex I and 7 other critical sectors in Annex II. Under NIS1, Member States named a limited set of operators of essential services in seven sectors: energy, transport, banking, financial market infrastructures, drinking water, healthcare and digital infrastructure. Under NIS2, the Commission's FAQs explain that all medium and large companies in the listed sectors are in scope, while Member States keep discretion to add smaller entities where the risk is high. A customer or contract that cites NIS2 is usually pointing to this sector and size test.
Whether your organization is in scope, and whether it is classed as essential or important, depends on three things: the sector your activity falls under, your size, and how your Member State has transposed the Directive into national law. Essential entities face ex ante supervision and important entities face ex post supervision, but both carry the same Article 21 risk-management and Article 23 reporting duties. Start by listing each legal entity in your group, the sector and subsector of each, and its headcount and turnover. Then check whether a sector-specific EU law displaces NIS2 for that activity. Treat the result as a starting point, not a legal opinion.
Confirm the answer with your national competent authority, which is named in the transposition law of each Member State where you provide services. Ask in writing whether your entity is registered, whether it is essential or important, and which supervisor applies. Your legal counsel should review the national text, because transposition details differ between countries. Record the outcome and the date you asked, since a customer or regulator will likely ask how you reached your classification.
Which NIS2 changes affect the budget, the board and the deadline
NIS2 changed who is in scope, who answers for cybersecurity, how fast incidents must be reported and what a regulator can fine. Each card below covers one change, what it means for your organization, and the decision or check that should come first.
Size cap replaces national identification
Under the first NIS Directive, Member States named operators of essential services one by one. NIS2 replaces that step with a size threshold, so all medium and large companies in the listed sectors are in scope. Confirm your headcount and annual turnover or balance sheet against the thresholds in your national transposition law, then check whether your Member State has added smaller high-risk entities. Also confirm whether any sector-specific law displaces NIS2 for you.
Essential or important classification
NIS2 sorts in-scope entities into essential and important. Both face the same Article 21 risk-management and Article 23 reporting duties, but supervision differs: essential entities face ex ante supervision, while important entities face ex post supervision under Articles 32 and 33. Decide which category applies to each entity in your group, confirm it with your national competent authority where the law leaves room, and plan your evidence for the stricter regime if you are essential.
Management body accountability
The Commission states that NIS2 makes top management accountable for non-compliance with the cybersecurity risk-management measures and brings cybersecurity to the boardroom. Under NIS1, this duty sat mainly with IT and security teams. Ask whether the management body has approved the Article 21 measures, whether members have documented oversight, and whether they have completed the cybersecurity training that Article 20 requires. Name the executive who will report to the board on the measures.
24-hour early warning
Under Article 23(4)(a), an entity must submit an early warning without undue delay and in any event within 24 hours of becoming aware of a significant incident. NIS1 had no comparable first-hours deadline for most operators. Confirm who in your organization can decide that an incident is significant, how that person is reached outside office hours, and which authority and format apply in your Member State. Your detection and escalation process has to meet this clock before any forensic work starts.
Fines for essential entities
For infringing Article 21 or 23, essential entities face administrative fines of at least EUR 10 000 000 or at least 2% of total worldwide annual turnover in the preceding financial year, whichever is higher, under Article 34(4). The turnover basis means the exposure grows with group size, not only with the local business. Ask your legal and finance teams to calculate the figure on your group turnover, and confirm how your Member State applies the Article 34 criteria to a given infringement.
NIS1 and NIS2 side by side
This table compares the first NIS Directive with NIS2 across scope, sectors, entity classes, supervision, management accountability, reporting, fines and legal status. Read each row as the change an organization must plan for, and check how the national transposition law in its Member State adds to the EU baseline.
| Dimension | First NIS Directive (NIS1) | NIS2 Directive |
|---|---|---|
| Legal status | Directive (EU) 2016/1148, repealed with effect from 18 October 2024 | Directive (EU) 2022/2555, applied through national laws from 18 October 2024 |
| Scope method | Member States identified operators of essential services case by case | Size threshold: medium and large entities in listed sectors are in scope |
| Sectors | Seven sectors, including energy, transport, banking, health, drinking water and digital infrastructure | 18 sectors: 11 high-criticality (Annex I) and 7 other critical (Annex II) |
| Entity classes | Operators of essential services and digital service providers | Essential and important entities, facing the same Article 21 and Article 23 duties |
| Supervision | Lighter touch for digital service providers, without ex ante supervision | Essential entities supervised ex ante, important entities ex post |
| Management accountability | Not a central feature of the directive | Top management is accountable for non-compliance with the risk-management measures |
| Incident reporting timing | Notification duties set by national rules | Early warning within 24 hours of awareness, followed by staged reports |
| Maximum fines (essential entities) | Set by national law | At least EUR 10 000 000 or at least 2% of worldwide turnover, whichever is higher |
| National flexibility | Member States designed their own identification and rules | Article 5 lets Member States keep or adopt rules for a higher level of security |
How essential and important entities differ under NIS2
Essential and important entities face the same substantive duties. Both must take appropriate and proportionate technical, operational and organizational measures to manage risks to their network and information systems under Article 21, and both must report significant incidents under Article 23. The classification does not lower the bar for the controls themselves. A mid-sized important entity and a large essential entity in the same sector are expected to meet the same Article 21 measures, with proportionality judged against their own risk profile and size.
- Article 21 measures: risk analysis, incident handling, business continuity, supply chain security, vulnerability handling, cryptography, access control and asset management apply to both classes.
- Article 23 reporting: the 24-hour early warning, the 72-hour incident notification and the one-month final report apply to both classes.
- Management accountability: the management body's duty to approve and oversee the measures applies regardless of classification.
- Proportionality: the depth of each measure can scale with exposure, size and cost of implementation, but the measure must still exist.
- Sector-specific rules: some sectors are governed by other EU laws that may displace parts of NIS2, so check that first.
Confirm with your national competent authority or sector regulator which class applies to you and whether any lex specialis applies.
Essential entities are subject to ex ante supervision. This means the competent authority can oversee them proactively, before any incident occurs, through measures such as on-site inspections, off-site supervision, regular and targeted security audits, security scans and requests for information. Authorities may also request evidence of compliance and can take enforcement steps if they find gaps. Essential entities should expect that their documentation, asset inventories and risk assessments can be requested at any time.
- Proactive oversight: inspections and audits can occur without a triggering incident.
- Scope of audits: authorities can order security audits and scans, and may require the entity to bear the cost of those audits in line with national rules.
- Evidence readiness: policies, risk registers, asset lists and test results should be current and retrievable.
- Fine ceiling: for infringements of Article 21 or 23, the maximum fine is at least EUR 10 000 000 or at least 2% of total worldwide annual turnover in the preceding financial year, whichever is higher, under Article 34(4).
- Confirm: how your Member State applies these powers and whether it sets additional penalty rules under Article 36.
Ask your authority which supervisory measures apply to your entity type and what evidence it expects in the first inspection.
Important entities are subject to ex post supervision. The competent authority acts mainly after it receives evidence, a report, an incident or other indication that the entity may not be complying. The duties are the same, so an important entity that fails to implement Article 21 measures can still face enforcement. The difference lies in when scrutiny usually begins and in the penalty framework that applies to them under national law. Do not read ex post supervision as a lower compliance standard.
- Reactive trigger: supervision typically starts after an incident, a complaint, a report or information from another authority.
- Same measures: the Article 21 measures and Article 23 deadlines apply in full from the first day.
- Evidence after the fact: you may need to show, retrospectively, which measures were in place when the issue occurred, so logs and records matter.
- Penalties: the Article 34 fine structure differs for important entities, so check how your Member State transposed it and whether the essential entity ceiling applies to you.
- Confirm: whether your national law or your authority's list places you in the important category and which fine rules apply to you.
Once you know your class, ask counsel to map the penalty provisions of your national transposition law to your entity.
The classification of essential or important status is set by the Member State, based on the entity's sector, size and other criteria in NIS2. Entities do not choose their class, and the same company can be treated differently in different Member States if it operates there. Because the class changes the supervisory model and the fine ceiling, it should be recorded in your compliance file with the source of the decision. Where a group operates in several Member States, confirm the position in each one.
- Member State decision: the national authority or transposition law determines the class and publishes the list or criteria.
- Sector and size: the Annex I and Annex II sectors and the size threshold inform the decision, so check both.
- Multi-country groups: a group may face different classifications and different authorities in each jurisdiction.
- Record the basis: keep the letter, register entry or legal reference that confirms your class.
- Re-check: the classification may change if the Member State updates its list or if EU amendments take effect.
Ask your national competent authority in writing to confirm your class before you plan your evidence program and budget.
How the NIS2 timeline replaced NIS1 deadlines
The sequence of adoption, transposition, repeal and implementing rules shows what NIS1 organizations had to move to, and which dates now set the obligations they must evidence.
Adopt NIS2 and publish it in the Official Journal
On 14 December 2022 the EU adopted Directive (EU) 2022/2555, and it was published in the Official Journal (OJ L 333) on 27 December 2022. Entered into force on 16 January 2023, it set the baseline for a high common level of cybersecurity across the Union. Organizations should record this as the point from which the new scope and obligations were public, and start mapping which of their entities fall under the expanded sector list. Check: a dated scope assessment that names each legal entity and the sector it sits in.
Adopt national transposition laws by the deadline
Member States had to adopt and publish national transposition measures by 17 October 2024 and apply them from 18 October 2024 (Article 41). Because NIS2 is a directive, the obligations an organization must meet come from its national law, which can also add stricter rules under Article 5. Organizations should identify the competent authority and national law for each country where they operate, and confirm any local registration or reporting duties. Check: a register of applicable national laws and supervisors per Member State.
Retire NIS1 and move to NIS2 obligations
NIS2 repealed Directive (EU) 2016/1148 with effect from 18 October 2024 (Article 44). From that date, the first NIS Directive no longer frames the obligations, and entities identified under the older regime had to meet the broader NIS2 duties in the Article 21 risk-management measures and Article 23 reporting. Organizations should update their compliance baseline to NIS2 terminology and close any gap between their NIS1 controls and the new requirements. Check: a gap register that replaces NIS1 references in policies with NIS2 articles.
Apply the Implementing Regulation to covered digital providers
Commission Implementing Regulation (EU) 2024/2690, adopted on 17 October 2024 and published on 18 October 2024, sets the technical and methodological requirements of the Article 21(2) measures and the significant incident criteria for DNS, TLD, cloud, data center, CDN, managed and managed security service providers, online platforms and trust service providers. Organizations in these categories should check whether the regulation binds them directly and map their controls to its requirements. Check: a documented determination of whether the regulation applies to each service line.
Use ENISA guidance to structure evidence
ENISA published non-binding technical implementation guidance for Implementing Regulation 2024/2690 on 26 June 2025, with examples of evidence and mappings to ISO/IEC 27001:2022 and NIST CSF 2.0. Organizations can use it to decide what evidence a supervisor would expect for each measure, while confirming with their national authority how it is applied locally. Check: an evidence index that lists, for each measure, the artifact, its owner and its review date.
Build the staged incident reporting sequence
Article 23 sets a staged sequence for a significant incident: an early warning without undue delay and in any event within 24 hours of becoming aware, then an incident notification, then a final report. The 72-hour notification and one-month final report follow the same clock. Organizations should prepare templates, named decision makers and a contact route to the national CSIRT or competent authority before an incident occurs. Check: a tested playbook that shows who sends each stage and where the timestamps are recorded.
Prepare for the Commission review
The Commission must review the functioning of NIS2 by 17 October 2027 and every 36 months thereafter (Article 40). Organizations should expect the scope, measures and reporting rules to be reassessed, and the January 2026 proposal (COM(2026) 13) is still under discussion by the Parliament and Council. Organizations should keep their evidence current and track changes through their national authority and the Commission's pages. Check: a dated watch list of NIS2 developments and an owner who reports changes to management.
What carried over from NIS1 and what did not
Some of the EU machinery built under the first NIS Directive carries over. NIS2 keeps the CSIRTs network and the NIS Cooperation Group, so national CSIRTs and the Member State authorities still coordinate through the same channels. NIS2 adds the European cyber crisis liaison organisation network (EU-CyCLONe) for large-scale incidents and crises, which gives national crisis managers a forum that NIS1 did not provide. For an organization operating across borders, the practical question is which national authority receives its reports and which CSIRT it deals with during an incident, so confirm that mapping with each Member State where it is established before an incident forces the issue.
What did not carry over is the compliance model. NIS2 creates no certificate of compliance, so no EU or national body issues a document that proves an entity meets its obligations. Supervisors instead rely on inspections, security audits, security scans, information requests and administrative fines under Articles 32 to 34. An entity should therefore be able to produce, on request, a current risk assessment, approved policies, records of management oversight and incident logs. Ask any consultant or auditor to explain which of these artifacts they would expect a supervisor to request first.
Article 5 allows Member States to adopt or keep rules that ensure a higher level of cybersecurity than NIS2 requires. Because NIS2 is a directive, the rules an entity actually faces are those in its national transposition law, which may add obligations, shorten deadlines or extend scope. Before setting the program baseline, check the transposition law and any sector regulator guidance in each Member State where the entity operates, and record the results so the compliance file reflects the stricter national requirement where one applies.
Questions buyers ask about the NIS1 to NIS2 change
Does NIS2 apply to my company if NIS1 did not cover it?
It may, because NIS2 replaced the NIS1 approach of national identification with a size threshold. The Commission's NIS2 FAQs say that all medium and large companies in the listed sectors are in scope, while Member States may add smaller high-risk entities. Check two things: whether your activity falls within one of the 18 sectors in Annex I or Annex II, and whether your headcount and turnover meet the medium or large threshold. Sector-specific laws can also displace NIS2 for some entities, so confirm the position with your national competent authority or your legal counsel. Your Member State's transposition law sets the final rules, so the EU text alone does not settle the question.
Is NIS1 still in force after NIS2 took effect?
No. NIS2 repealed the first NIS Directive, Directive (EU) 2016/1148, with effect from 18 October 2024, under Article 44. Member States had to adopt and publish transposition measures by 17 October 2024 and apply them from 18 October 2024. Your existing obligations now come from your national law implementing NIS2, so any older registration or identification letter from a NIS1 regime should be checked against current national rules. Some national transitions and registration steps may still be ongoing, so ask your national authority which obligations apply to you today and which deadlines it has set. The NIS2 Directive text on EUR-Lex is the primary source for the repeal and transition rules.
Who decides whether my entity is essential or important?
Under NIS2, the classification follows from the entity's sector, size and type, set out in the Annexes and in Article 3, rather than from a national list of identified operators. Essential and important entities face the same risk-management and reporting duties, but essential entities face ex ante supervision while important entities face ex post supervision, under Articles 32 and 33. Your national transposition law and your competent authority apply these rules to your case, and they may hold registration or information requests that help confirm the category. Document your reasoning, including the sector, size and any national additions, and confirm the outcome in writing with the authority or your counsel.
Do I need a certificate to show NIS2 compliance?
No. NIS2 creates no certificate of compliance. National competent authorities oversee compliance through inspections, security audits, security scans, information requests and administrative fines, under Articles 32 to 34. A certification scheme may still help your evidence, but it does not replace supervision. Your management body owns the controls and must be able to show how they operate. An independent auditor or certification body can assess your controls against a chosen standard and issue a report or certificate for that standard, but that report is not a NIS2 certificate. Ask your authority which forms of evidence it accepts before buying any assessment.
What does a supervisor check during a NIS2 inspection?
A supervisor checks whether your entity has implemented the Article 21 risk-management measures and reports significant incidents under Article 23. In practice, expect requests for a current risk assessment, policies approved by the management body, evidence of access control, patching, backup and incident handling, supplier security arrangements, and records of the 24-hour early warning, 72-hour notification and one-month final report. Essential entities may face proactive inspections and scans, while important entities are usually checked after an indication of non-compliance. The ENISA technical guidance on Implementing Regulation 2024/2690 gives examples of evidence for the sectors it covers. Confirm the exact evidence list and format with your national authority.
Does the change add cost or effort, and what drives it?
Most organizations that move from NIS1 coverage to NIS2 scope see more cost, mainly because the scope widened and the duties became explicit. Costs fall into one-time work, such as the gap analysis, risk assessment, policy writing, system hardening, logging and reporting process design, and recurring work, such as monitoring, testing, training, evidence collection and supplier reviews. The main drivers are how many systems and sites are in scope, how mature your current controls are, whether you can run incident reporting within 24 hours, and how much of the work you outsource. No supplied figure gives a general cost, so request a written, scoped quote from any provider and ask your national authority about its expectations. DeployOpen plans and implements systems and prepares evidence under a fixed written scope, but it does not issue audit reports or certificates.
Who owns the NIS2 obligations and who helps prepare the evidence
The organization owns its NIS2 obligations. Under NIS2, the duty to manage cybersecurity risk sits with the in-scope entity, and the management body must approve and oversee the Article 21 measures. Management is accountable for non-compliance, so the board or executive team should decide who runs the program, what risk appetite applies, and how progress is reported upward. Those decisions cannot be delegated to a vendor. An implementation partner such as DeployOpen can plan, implement, configure, and document the systems and evidence that support those controls, but the controls remain the entity's own, operated under its authority and governance.
Two parties issue findings, and neither is a partner. Supervision sits with the national competent authority in the Member State that has jurisdiction, which can inspect, request information, run security audits and scans, and impose administrative fines. An organization may also engage an independent assessor to test its controls and report on them. The distinction matters because NIS2 creates no certificate of compliance. No consultant, platform vendor, or implementation partner can stamp an entity as compliant, and any document presented as proof of NIS2 compliance should be checked against what the authority or assessor actually issued. Ask any firm you engage to state in writing that it prepares evidence and does not certify.
Confirm the split of roles before work starts. Put a written responsibility matrix in the scope of work that names who approves each control, who maintains each evidence record, and who answers the authority's questions. Confirm with your national competent authority which evidence it expects and whether it accepts the ENISA technical guidance for Implementing Regulation (EU) 2024/2690 as a reference, since that guidance is non-binding. A clear split protects the board, because accountability stays with management even when preparation is outsourced.
How DeployOpen works on this
DeployOpen helps organizations work out what changed between the first NIS Directive and NIS2, then prepares the systems and evidence that show how their own controls meet the new obligations. We plan, build and document self-hosted open-source platforms inside the client's own infrastructure, and an independent authority, not DeployOpen, decides compliance.
How we scope
- We agree a written scope before work starts, listing which entities, systems and sectors are covered.
- The scope records whether each entity is likely essential or important, and which national authority it would answer to.
- Engagements are fixed-scope, with deliverables and timelines confirmed in writing before any work begins.
How we build
- We configure self-hosted open-source platforms in your cloud accounts, data centers or air-gapped networks.
- We harden, back up and integrate these platforms so the controls they provide can be shown to a supervisor.
- We run security testing on applications, APIs and infrastructure to check that the implemented measures behave as described.
How we hand over
- We document configurations, procedures and the evidence each control produces, mapped to the control areas in scope.
- We confirm with you which records your management body must review and approve, and prepare them for that review.
- Your team receives the documentation and runbooks, and ownership of every control stays with your organization.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after handover.
- Before a supervisor or auditor reviews your evidence, we can help you check it for gaps and consistency.
- Confirm with us in the quote which deliverables, reviews and testing cycles are included in your fixed scope.
