NIS2 Directive.

What Is the NIS2 Directive?

The NIS2 Directive is a European Union law on cybersecurity. Its formal name is Directive (EU) 2022/2555. The European Commission says it establishes a unified legal framework to uphold cybersecurity in 18 critical sectors across the EU. The text of the Directive says it lays down measures for a high common level of cybersecurity across the Union. The aim is to improve the functioning of the internal market.

Who Adopted NIS2?

The official title names the European Parliament and the Council as the adopters. It is dated 14 December 2022. The Commission says the Directive replaced the earlier NIS Directive, also called NIS1 (Directive 2016/1148). The Commission also says Member States have to transpose it into national law, so each country writes its own rules to put it into effect.

Which Organizations Does NIS2 Cover?

The Directive applies to public or private entities of a type listed in its Annex I or Annex II. They must meet the medium-sized enterprise threshold and provide their services within the Union. The Commission says that, as a rule, medium-sized and large entities in the covered sectors have to take appropriate cybersecurity risk-management measures.

The Directive sorts these organizations into two groups:

• Essential entities. These include entities in Annex I that exceed the medium-sized thresholds, qualified trust service providers, DNS providers, certain public administration entities and certain electronic communications providers.
• Important entities. These are entities in Annex I or Annex II that do not qualify as essential.

The Commission lists sectors such as energy, transport, healthcare, finance, water management and digital infrastructure. It also names postal and courier services, waste and wastewater management, public administration and the space sector.

What Does NIS2 Ask for?

The Commission page describes these main parts.

• Risk management. Covered entities have to take appropriate cybersecurity risk-management measures.
• Incident reporting. Entities have to notify the relevant national authorities of significant incidents.
• Supervision. The Directive includes provisions for supervision, enforcement and voluntary peer reviews.
• Cooperation. The Directive sets up networks such as the CSIRTs network (CSIRT stands for computer security incident response team) and EU-CyCLONe for coordinated incident response and information exchange.

The Directive also asks each Member State to adopt a national cybersecurity strategy and to designate or establish CSIRTs covering the sectors in its annexes.

How Did NIS2 Get from Proposal to National Law?

The European Commission describes the path on its NIS2 policy page. NIS1 was revised first, then NIS2 had to be written into each country’s law.

All dates come from the Commission NIS2 page. Each country sets its own national rules, so check the law where you operate.

Is NIS2 the Same as NIS1?

No. NIS1 was the earlier Directive (EU) 2016/1148. The official text of NIS2 repeals it, and the Commission says NIS2 replaced it.

Will This Page Tell You If NIS2 Covers You?

No. This page is not legal advice. Whether an organization is covered depends on the annexes of the Directive and on the national law of the Member State. The official texts linked below are the place to check.

Which Terms Are Close to NIS2?

Related glossary terms include third-party risk, incident response plan and supply chain attack. For the financial sector rule, see DORA. Our blog covers the NIS2 Directive, transposition status in 2026 and incident reporting deadlines. For essential services, see critical infrastructure and supply chain and vendor risk.