What the NIS2 2026 targeted amendments would change for your organization
The Commission proposed targeted amendments to NIS2 on 20 January 2026 (COM(2026) 13). They are a proposal, not adopted law, and they need approval by the European Parliament and the Council before they change anything. Until national law changes, your current NIS2 duties apply in full, including the Article 21 risk-management measures and the Article 23 reporting deadlines. A budget owner or compliance lead should plan against the obligations in force today and treat the proposal as a scenario to monitor. The Commission's press release IP/26/105 says the amendments would ease compliance for 28,700 companies, including 6,200 micro and small enterprises, and lower costs for 22,500 companies through a new small mid-cap category. Those figures are the Commission's own estimates of the proposal's reach, not a measure of what your organization would save.
Whether the proposal changes your position depends on four things: your size and whether a small mid-cap category would reach you, your sector under Annex I or Annex II, your cross-border footprint, and your role as a supplier to other in-scope entities. The Commission says the package would simplify jurisdictional rules and reinforce ENISA's coordinating role for cross-border entities, which matters most if you operate in several Member States. Confirm with your national competent authority and your legal counsel which category you would fall into under the proposed text, and check how your current Member State has transposed NIS2, since the proposal would not replace national law on its own.
The organization owns its controls and its legal position. An implementation partner can prepare systems, policies and evidence so that you can respond quickly if the category or deadlines change, but a partner does not decide your classification. Only an independent auditor or assessor issues a report on your controls. Read the proposal text itself through the Commission's COM(2026) 13 page, and ask your advisers to map each proposed change to your current evidence before the Parliament and Council positions are settled.
Which of the proposed changes touch which obligations
The January 2026 package (COM(2026) 13) is a proposal, so none of these changes applies yet. Most of them change who is covered, how jurisdiction is decided, or where reports go and how supervisors work, while the Article 21 risk-management duties and Article 23 reporting duties stay in place. The Digital Omnibus is a separate proposal of 19 November 2025, and the Commission says it would not modify existing reporting obligations.
Small mid-cap category
The proposal adds a new small mid-cap category that would receive lighter obligations than full essential or important entities. It changes who is in scope and how much of the Article 21 measures and Article 23 reporting a company must carry, so it touches both duties for the entities it covers. Companies near the size thresholds should check whether they would fall into this category once the text is adopted, and should not assume a lighter regime until the final law says so.
Simpler jurisdiction rules
The Commission proposes simplifying the rules that decide which Member State supervises an entity, which matters most for groups and providers operating across borders. This changes supervision and the authority a company deals with, not the content of Article 21 measures. Multinational groups should map where they are established and where they provide services now, then confirm the new allocation when the text is final.
Streamlined ransomware data collection
The proposal would streamline how authorities collect data on ransomware attacks, so organizations may be asked for the same facts once rather than through several channels. This affects how incident information is reported and used, not the duty to manage risk under Article 21. Security teams should confirm which ransomware fields they already capture in their incident records, since a leaner process still depends on that data being available.
Reinforced ENISA coordinating role
ENISA would take a stronger coordinating role for cross-border entities and would issue early alerts of threats and incidents, supporting companies with Europol and CSIRTs during ransomware response. This changes supervision coordination and threat intelligence flows, leaving Article 21 duties unchanged. Organizations should check that their contacts and alert routing reach the right national CSIRT, because early alerts only help if they reach the team that acts on them.
ENISA-run single-entry point
The Digital Omnibus proposal of 19 November 2025 would create an ENISA-run single-entry point for incident reports under NIS2, GDPR, DORA and other laws. It is a separate proposal, and the Commission says it would not modify existing reporting obligations, so Article 23 deadlines and content still apply. Organizations should keep their current reporting runbooks and confirm with their authority how a future single entry point would route each report.
One-year transposition period
Once the NIS2 amending Directive is adopted, Member States would have one year to implement it in national law, according to the Commission's press release of 20 January 2026. The period governs when national rules change, so existing transposition laws and the current Article 21 and Article 23 duties keep applying until then. Companies should track their national transposition bill and plan updates to policies and reporting processes after adoption, not before.
Would a small mid-cap category take my company out of NIS2?
The short answer is that nobody can yet say, and the honest first step is to test your company against the wording rather than assume an exit. The Commission's proposal of 20 January 2026 (COM(2026) 13) would add a small mid-cap category to NIS2, intended to carry lighter obligations for companies that are too large for the micro and small rules but smaller than the current size threshold for full treatment. In its press release IP/26/105, the Commission estimates that the changes would ease compliance for 28,700 companies, including 6,200 micro and small enterprises, and lower compliance costs for 22,500 companies. These are the Commission's own estimates, not measured outcomes, and the category exists only as a proposal that the European Parliament and the Council must still approve.
Whether your company would fall into that category depends on three things you can check today: headcount, turnover and balance sheet total, and the sector listed in Annex I or Annex II. Compare those figures with the adopted wording once it exists, not with the proposal's summary or with press coverage. Then confirm the result with your national competent authority, because NIS2 reaches organizations through national transposition laws, and Member States must still decide how the amended rules apply in their territory. Until that check is done, keep your current NIS2 position, including whether you are essential or important, and do not reduce risk-management, incident reporting or supplier work on the strength of a proposal.
Plan for the uncertainty in the meantime. Ask your legal or compliance team to record the current classification and the date of your last review, and to flag the points where the adopted text or your national law could change your result. If you would benefit from lighter obligations, the sensible move is to scope the work you already need for NIS2 so that it can be adjusted later, not to pause it. A written scope agreed with any outside partner should state which NIS2 requirements apply on the current law and which would be revisited once the amendments are final.
What stays in force while the proposal is pending
This table compares the current NIS2 position in six areas with what the 20 January 2026 proposal (COM(2026) 13) would change. Read the middle column as the law that applies today and the last column as a proposal that needs Parliament and Council approval before it takes effect. Where the Commission materials do not give detail, confirm the wording against the adopted text.
| Area | Position today under NIS2 | What the proposal would change and status |
|---|---|---|
| Article 21 risk-management measures | The ten minimum measures in Article 21(2) apply to essential and important entities now. Implementing Regulation 2024/2690 sets detailed requirements for the digital entity types it covers. | Public Commission materials do not detail changes to Article 21. Confirm any change against the adopted text. Status: proposal only. |
| Article 23 reporting timelines | Significant incidents follow the 24-hour early warning, 72-hour notification and one-month final report sequence in Article 23. | The separate Digital Omnibus proposal would add an ENISA-run single-entry point. The Commission says it would not modify existing reporting obligations. Status: proposal only. |
| Supervision and penalties (Articles 32 to 34) | Essential entities face ex ante supervision and important entities face ex post supervision. Fines follow Article 34. | No detail on changed supervision or fine levels is supplied. Confirm against the adopted text. Status: proposal only. |
| Jurisdiction (Article 26) | Article 26 determines which Member State supervises an entity, which can be hard to pin down for groups with cross-border operations. | The Commission says the proposal would simplify jurisdictional rules. Confirm the exact mechanics in the adopted text. Status: proposal only. |
| ENISA's role | NIS2 gives ENISA no single-entry point for incident reports. National CSIRTs and authorities handle reporting. | ENISA would take a reinforced coordinating role, issue early alerts and support responses to ransomware with Europol and CSIRTs. Status: proposal only. |
| Transposition period if adopted | Member States were required to transpose NIS2 by 17 October 2024, and that date has passed. | Member States would have one year to implement the amending Directive in national law after adoption. Status: depends on the adoption date. |
How the proposal reads for each type of reader
The proposal's most visible change for a mid-size company is a new small mid-cap category. The Commission says this category would lower compliance costs for 22,500 companies, and that the amendments would ease compliance for 28,700 companies in total, including 6,200 micro and small enterprises. Whether your company would fall in that category depends on size thresholds and on the amended text, which is not yet adopted.
- Scope today: Until the amendments are adopted, the existing size-cap rule and sector annexes in Directive (EU) 2022/2555 still decide whether you are in scope.
- Possible change: A small mid-cap category could carry lighter obligations than the standard essential or important regime. The details are not yet settled.
- Unchanged duties: Management accountability, incident reporting and the Article 21 risk-management measures remain in force for any entity already in scope.
- Planning value: Mapping your position against the Annex I and II sectors now lets you move quickly if the category is confirmed.
- Scope confirmation: Ask your national competent authority or counsel how the category would be defined and whether your sector is affected.
Check with your national authority or counsel whether you are in scope today, whether the proposed category would apply to you, and when any change would take effect in your Member State.
For a group operating in several Member States, the Commission says the proposal would simplify jurisdictional rules and facilitate supervision of cross-border entities through a reinforced coordinating role for ENISA. The jurisdiction rules currently sit in Article 26 of Directive (EU) 2022/2555. The amendments are a proposal, so the group should plan around current rules while tracking the change.
- Jurisdiction: The Commission says the proposal would simplify the rules that decide which Member State supervises an entity. The exact mechanics depend on the final text.
- Coordination: The proposal gives ENISA a reinforced coordinating role for cross-border entities. Expect more central coordination, not a single regulator for the group.
- Current obligations: Each Member State's transposition law still applies to each establishment that is in scope today.
- Governance: The management body accountability duties in Article 20 do not change with the proposal.
- Documentation: Keep one evidence set that can be presented to several authorities, because the proposal does not remove national supervision.
Confirm with counsel in each Member State where you operate which authority is competent today, and ask how the jurisdiction changes would apply to your group structure once adopted.
Managed service providers and cloud providers serve NIS2 customers and also carry their own obligations. The proposal's jurisdiction and cross-border changes matter to providers that operate across borders, and the ENISA coordinating role may affect how supervision of such providers works. The implementing regulation Commission Implementing Regulation (EU) 2024/2690 already sets technical requirements for these provider types.
- Own obligations: Cloud, data center, managed and managed security service providers remain subject to the technical requirements of Implementing Regulation (EU) 2024/2690 under current rules.
- Customer expectations: Your customers will keep asking for evidence under Article 21 and for reporting support, whatever the amendments do.
- Cross-border supervision: If you serve customers in several Member States, the proposed ENISA coordinating role may change how cross-border supervision is handled.
- Contract terms: Review contract clauses on notification timing and evidence sharing, since these will not change simply because a proposal is pending.
- Supplier scope: The trusted ICT supply chain framework in the revised Cybersecurity Act proposal is a separate package that would affect suppliers across the 18 NIS2 sectors.
Ask your national authority or counsel whether your service type falls under the provider rules and how the proposed changes would apply to the services you deliver across borders.
The Commission says the proposal would streamline the collection of data on ransomware attacks. Under the same package, ENISA would support companies with Europol and CSIRTs in responding to ransomware, and would issue early alerts of threats and incidents. These are proposed roles, and they do not replace the reporting duties you already have.
- Stated aim: The Commission's goal is to make ransomware data collection more efficient across the EU, so authorities can see patterns faster.
- Proposed support: ENISA would work with Europol and national CSIRTs to help companies respond to ransomware, subject to adoption.
- Single-entry point: The Digital Omnibus proposal would create an ENISA-run single-entry point for incident reports. The Commission says it would not modify existing reporting obligations.
- Article 23 stays in force: The 24-hour early warning, 72-hour notification and one-month final report under Article 23 still apply to significant incidents.
- Plan now: Build your response plan around current Article 23 deadlines, and treat any new reporting channel as an addition once it exists.
Confirm with your national CSIRT or competent authority how ransomware incidents must be reported today and whether any new channel would be introduced in your Member State after adoption.
How the amendments would become binding if adopted
The proposal only changes NIS2 once it passes through the EU legislative process and each Member State writes the amendments into national law, so the sequence below shows what each stage produces and where organizations should watch.
Commission adopts the proposal
On 20 January 2026 the European Commission proposed targeted amendments to NIS2, recorded as COM(2026) 13. The output is a legislative proposal, not law: it sets out the new small mid-cap category, the simpler jurisdiction rules, the ransomware data collection and the expanded role for ENISA. Organizations can read the text in the Commission's proposal document and the accompanying press release IP/26/105 to see what is being suggested before any change is made.
Parliament and Council review the text
The European Parliament and the Council of the EU must each review the proposal and agree on its final wording, which can change the Commission's text. The output is an agreed version of the amending Directive. Commission pages updated through July 2026 still describe the measures as a proposal, so no content should be treated as settled. Ask your legal or public affairs team to track the legislative file, and confirm the current stage with the Parliament and Council records rather than relying on press summaries.
Amending Directive is published
Once both institutions approve the text, the amending Directive is signed and published in the Official Journal of the European Union. Publication fixes the legal text and starts the national implementation clock. The output is an official, citable act. Confirm the publication date and entry-into-force provisions in the Official Journal version, because they determine when the Member State deadline begins.
Member States transpose the amendments
NIS2 is a directive, so each Member State must write the amended rules into its own national law. The Commission's 20 January 2026 press release states that Member States would have one year to implement the NIS2 amending Directive in national law once it is adopted. The output is a national bill or regulation that changes the existing NIS2 transposition law. Organizations should follow the bill in each Member State where they operate, since the timing and details of national texts may differ.
Authorities apply the amended rules
After national transposition takes effect, competent authorities apply the amended rules to entities in their territory. This includes how small mid-cap entities are treated, how jurisdiction is assigned and how supervision of cross-border entities is coordinated with ENISA. The output is a changed compliance position for affected entities. Ask each national competent authority, and the sector regulator where one exists, which guidance it will publish and how it will handle entities that moved between categories.
Run the Cybersecurity Act track separately
The revised Cybersecurity Act proposed on 20 January 2026 follows a different path. According to the Commission's press release, it would apply immediately after approval by the European Parliament and the Council, without waiting for national transposition. Its output is a trusted ICT supply chain security framework covering the 18 NIS2 critical sectors. Organizations should not assume that the one-year national window applies to it, and should check the Cybersecurity Act file separately.
Track the bill and your own readiness
No approval or transposition dates are set in the sources available, so this stage has no fixed deadline. The practical check is to confirm, with your legal team and national authority, the current legislative stage, the expected transposition bill and whether your entity classification would change under the small mid-cap category. The output is a dated watch list and a decision on whether to keep current NIS2 measures unchanged while the amendments are pending.
What to do now while the proposal is still moving
The January 2026 proposal is not law, so the obligations that apply today still come from Directive (EU) 2022/2555 and the national law that transposes it. The four actions below run in parallel: they keep current duties met, keep evidence portable, and track how the amendments change the picture.
Confirm current scope under national law
Scope is decided by the transposition law of the Member State that holds jurisdiction, not by the Commission proposal. Compliance, legal or the management body should confirm the entity's size, sector annex and essential or important classification under that law, and whether any sector-specific rule displaces NIS2. The proposal would add a small mid-cap category, so record the current classification with its reasoning so a later change can be assessed against it. External counsel or an advisor can prepare the analysis; the organization decides its scope.
Keep Article 21 and 23 running
The risk-management measures in Article 21 and the reporting process in Article 23 apply now and are not paused by a proposal. Security leadership should keep the risk assessment, access control, patching, backup and incident handling operating, and keep the 24-hour early warning, 72-hour notification and one-month final report workable. Any amendment to reporting routing, such as the ENISA single-entry point proposed in the Digital Omnibus, would change where reports go, not whether the organization must produce them.
Keep evidence portable across authorities
NIS2 creates no certificate, so an organization proves compliance through records that a supervisor can inspect. Record policies, risk assessments, access reviews, test results and incident logs in a consistent structure, with dates and owners, so the file still makes sense if a different national authority or Member State takes over supervision. The IT or platform team owns the evidence; an implementation partner can prepare the repositories and collection routines. Any formal report comes from an independent auditor or assessor, not from the implementation partner.
Watch the amendment and transposition files
The proposal, COM(2026) 13, must pass the European Parliament and the Council before it applies. Once adopted, Member States would have one year to implement the amending Directive in national law, so the national bill is the file that matters most for an entity in a given country. Assign one owner to track Parliament and Council positions, the national transposition bill and supervisor guidance, and to report changes to the management body. Plan for the amendment only after the final text is known.
Questions buyers ask about the NIS2 amendment proposal
Do we have to act on the NIS2 amendment proposal now?
No new obligation exists yet. The Commission's proposal of 20 January 2026 (COM(2026) 13) is not adopted law, so the duties you act on today are still those of NIS2 as transposed in your Member State. Parliament and the Council must approve the proposal before anything changes. Your planning should therefore start from the current national law, with the proposal tracked as a scenario. Confirm your current obligations with your national competent authority or counsel, and watch the Commission's NIS2 pages for updates.
Does the small mid-cap category apply to our company?
Only you can establish this against the final text, and the category does not yet exist in law. The Commission says the proposal would create a small mid-cap category and ease compliance for 28,700 companies, including 6,200 micro and small enterprises, according to press release IP/26/105. Whether your company falls into it depends on the size criteria in the adopted text and on your sector and entity classification under the current NIS2 rules. Ask your national authority how it would classify you under the amended wording, and get a written position from counsel before you change your program.
How would the single-entry point change our incident reporting?
It would not change your reporting duties on its own, because the Commission says the Digital Omnibus single-entry point would not modify existing obligations. Under the November 2025 proposal, ENISA would run one entry point for incident reports under NIS2, GDPR, DORA and other laws, but that remains a proposal. Your Article 23 timelines still apply today: an early warning within 24 hours, a notification within 72 hours and a final report within one month. Keep your reporting runbooks able to reach the authorities you already notify, and review them once the single-entry point is defined in law.
What does the one-year transposition period mean for our planning?
If the amending Directive is adopted, Member States would have one year to implement it in national law, according to the Commission's press release of 20 January 2026. That period starts only after adoption, so no deadline can be calculated yet. For planning, separate the work into two tracks: controls and evidence that NIS2 already requires, and changes that depend on the final text. Build a change register now so you can absorb amendments quickly. Confirm the actual transposition dates with your national authority once the text is final.
Will the Cybersecurity Act changes affect our suppliers?
They could, and the effect would reach your supply chain before the NIS2 amendments take effect. The revised Cybersecurity Act proposed on 20 January 2026 would set a trusted ICT supply chain security framework covering the 18 NIS2 critical sectors, including mandatory de-risking of mobile networks from high-risk suppliers. The Commission says that act would apply immediately after approval by Parliament and Council. Review your supplier inventory now, identify third-country ICT suppliers and critical dependencies, and ask your national authority which obligations would apply to your sector.
Can a consultant confirm whether we are in scope?
A consultant can analyze your facts and prepare a written view, but the legal position belongs to your national competent authority and to counsel who can rely on it. Scope depends on sector, size, the entity classification and the national transposition law, and the amendments are not yet adopted. Ask any consultant for a written scope analysis that names the law version it relies on, lists the assumptions, and recommends confirmation from the authority. Be cautious of any firm that promises a status it cannot document. DeployOpen does not issue legal opinions or compliance determinations.
What would the amendments require from our internal staff?
The work sits with your management body and with the teams that own systems, incidents and suppliers, because NIS2 holds the organization accountable for its controls. Effort depends on how mature your current risk management, asset inventory and reporting processes already are, and on how many systems and suppliers fall in scope. Expect the largest demands in evidence collection, supplier reviews and reporting exercises. Ask your team to name an accountable owner for each duty, and confirm with your authority which records it expects to see.
What can a partner do to prepare us for the amendments?
A partner can prepare systems, controls and evidence so your team can respond quickly when the final text is known. DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, and runs security testing that produces evidence for your reviews. It works under a written, fixed scope, and it does not issue reports, attestations or certifications, nor can it guarantee a regulatory outcome. Ask any partner to state in writing which deliverables it provides and which decisions remain with you and your authority.
How DeployOpen helps you prepare for NIS2 while the amendments are pending
The January 2026 proposal to amend NIS2 is not adopted law, so the obligations you prepare for today remain those of the directive and its national transposition laws. DeployOpen plans and builds self-hosted open-source platforms and evidence in your own environment, so the work holds whichever version of the rules applies.
How we scope
- We agree a written scope before work starts, covering the systems, entities and Article 21 measures in question.
- We record which obligations depend on the pending proposal, such as the small mid-cap category, so you can see what would change.
- Engagements are fixed-scope, with deliverables and timelines confirmed in writing before any work begins.
How we build
- We implement and harden self-hosted open-source platforms inside your cloud accounts, data centers or air-gapped networks.
- We configure logging, access control and backup so the evidence your supervisor may request is produced by the systems themselves.
- We test controls and incident reporting workflows, and we keep them flexible so reporting paths can follow any future single-entry point.
How we hand over
- We document configurations, procedures and evidence locations so your own staff can operate and explain them.
- We prepare controls and evidence for assessment, while your management body keeps ownership of its decisions and accountability.
- Independent auditors and competent authorities, not DeployOpen, issue reports, certificates and any compliance conclusions.
How we support
- Ongoing support, upgrades and continuous security testing are available as a retainer after handover.
- We can revisit the scope when Parliament and the Council act on the proposal and the national transposition timeline becomes clear.
- Confirm the current status of COM(2026) 13 and your national law with your legal advisers before changing your program.
Sources and further reading
- Proposal for a Directive as regards simplification measures and alignment with the Cybersecurity Act, COM(2026) 13 ↗
- Commission strengthens EU cybersecurity resilience and capabilities, press release IP/26/105 ↗
- Directive (EU) 2022/2555 (NIS2), EUR-Lex ↗
- NIS2 Directive: securing network and information systems, European Commission ↗
- Simpler EU digital rules and new digital wallets, press release IP/25/2718 ↗
