← مقالات وأدلة عن الاحتيال والأمن السيبراني والخصوصية

NIS2 explained: scope, obligations, fines and transposition status

A guide to the EU NIS2 Directive: essential vs important entities, 24h/72h reporting, fines up to 2% of turnover and which countries still lag on transposition.

2026-10-10

Directive (EU) 2022/2555, known as NIS2, is the EU's main horizontal cybersecurity law. It replaced the original NIS Directive, broadened the sectors covered and introduced GDPR-style fines. Almost two years after the transposition deadline, implementation is still uneven and Brussels has already proposed changes.

For Brazilian and US companies that serve European customers, NIS2 is not a distant issue: it reaches entities that provide services in the EU, and the Commission now wants non-EU essential and important entities offering services in the Union to appoint an EU representative.

Who is covered

NIS2 splits organisations into two groups. According to Freshfields, essential entities operate in highly critical sectors such as energy, transport, banking, water, financial market infrastructure, health, digital infrastructure, B2B ICT service management, public administration and space. Important entities sit in other critical sectors, including food, manufacturing, chemicals and digital providers. Classification turns on sector, size and the criticality of the service, as McCann FitzGerald explains.

Essential entities face proactive (ex ante) supervision, including on-site inspections and audits. Important entities are supervised reactively (ex post), when there is evidence of non-compliance.

Core obligations

The directive requires "appropriate and proportionate" technical, operational and organisational measures. The minimum, non-exhaustive list covers:

Risk analysis and information system security policies.
Incident handling.
Business continuity and crisis management.
Supply chain security, including supplier due diligence.

Management bodies must approve these measures, oversee their implementation and can be held liable for infringements.

Incident reporting

Deadline	Report
24 hours	Early warning
72 hours	Incident notification
1 month	Final report

Fines

National laws set penalties, but maximums must be at least the higher of €10 million or 2% of worldwide turnover for essential entities, and €7 million or 1.4% for important entities.

Transposition status

The deadline was 17 October 2024. Wavestone reports that the Commission sent formal notices in November 2024 and reasoned opinions to 19 member states in May 2025. By January 2026, 20 of 27 had transposed; Ireland, Luxembourg, France, Spain, the Netherlands, Poland and Bulgaria had not. Germany's law took effect on 6 December 2025. By May 2026, Cullen International counted four member states still missing, with Luxembourg's law in force since 10 May 2026. Wikipedia also lists the Czech law (in force 1 November 2025) and Sweden's Cybersecurity Act (2025:1506).

NIS2, revised

On 20 January 2026 the Commission proposed targeted amendments, reported by Covington's Inside Privacy: a new "small mid-cap" category (fewer than 750 staff and under €150 million turnover) generally treated as important entities; richer ransomware reporting, including ransom amount and payment method on request; a bar on extra national technical requirements where Commission implementing acts exist; and scope tweaks for chemicals distribution and DNS providers. DLA Piper notes that submarine cable operators and European Digital Identity Wallet providers would become essential entities. Adoption is expected in late 2026 or, more likely, 2027, followed by 12 months for national implementation.

Checklist

Map every EU country where you provide services and check each national law.
Determine whether you are essential, important or out of scope.
Register with national authorities where required.
Get board sign-off on risk-management measures.
Rehearse the 24h/72h/one-month reporting workflow.
Add security clauses to critical supplier contracts.