NIS2 is the EU directive that expands cybersecurity requirements to a much wider range of essential and important entities than its predecessor.

Who does NIS2 apply to?

Medium and large organisations in 18 critical sectors including energy, health, transport, banking, and digital infrastructure.

What's the difference between essential and important entities under NIS2?

Essential entities face stricter supervision and higher fines; important entities have somewhat lighter oversight but still face mandatory obligations.

🇪🇺 Europe

NIS2 Directive Compliance

Q: What are the penalties for NIS2 non-compliance?

Up to €10 million or 2% of global turnover for essential entities, and up to €7 million or 1.4% for important entities.

Meet the EU's expanded cybersecurity obligations

NIS2 (Directive (EU) 2022/2555) is the EU's expanded cybersecurity law, covering medium and large 'essential' and 'important' entities across 18 sectors. It requires risk-management measures, fast incident reporting, and holds management personally accountable, with fines of up to €10 million or 2% of global turnover.

EU-27

Territorial scope

Security measures

6-12m

Typical compliance timeline

Medium+

Entity size

2024

Transposition deadline

What is NIS2?

Directive (EU) 2022/2555 replaces the original NIS Directive with
stronger, more harmonised cybersecurity requirements for
'essential' and 'important' entities. Each EU member state
transposes NIS2 into national law, so exact deadlines and
enforcement details vary by country.

Who needs to comply with NIS2?

Medium and large entities operating in sectors such as energy,
transport, banking, health, digital infrastructure, public
administration, and manufacturing - plus certain smaller entities
that are critical to their sector.

What are the key requirements
of NIS2?

Implement risk-management measures covering supply chain security, access control, and incident handling

Report significant incidents: an early warning within 24 hours, a notification within 72 hours, and a final report within a month

Establish business continuity and crisis management plans

Ensure management bodies approve and oversee cybersecurity measures - with personal accountability for failures

What are the penalties for NIS2 non-compliance?

Essential entities face fines of up to €10 million or 2% of global annual turnover; important entities face up to €7 million or 1.4%. Management can also face personal liability and temporary bans from managerial roles.

€10M

Max fine (essential entities)

2%

Global annual turnover

€7M

Max fine (important entities)

How does GDPRLocal help with NIS2?

GDPRLocal supports you with everything NIS2 requires: entity classification, risk-management and supply-chain gap assessment, incident-reporting process design, governance advisory for management accountability, and support meeting your national transposition deadlines.

Get started free