Frequently Asked Questions

• When is the deadline for NIS 2 compliance?

  As of March 2026, transposition remained uneven across the EU, so organizations should track the national law, registration requirements and supervisory expectations in every country where they operate.

• Who needs to comply with the NIS 2 directive?

  NIS 2 applies broadly to entities designated as essential and important in covered sectors. Many medium and large organizations are in scope, and some entities may be covered regardless of size depending on their sector or national law. A country-by-country scope assessment is the safest approach.

• What are the incident reporting requirements under NIS 2?

  NIS 2 can require an early warning within 24 hours, incident notification within 72 hours and a final report within one month. Exact mechanics may vary under national implementation, so organizations should prepare playbooks and evidence capture processes in advance.

• What penalties does NIS 2 impose for noncompliance?

  NIS 2 can expose Essential entities to fines of up to at least €10 million or 2% of global annual turnover, whichever is higher, and Important entities to up to at least €7 million or 1.4%, whichever is higher. National authorities may also impose remediation orders, heightened supervision and other operational consequences.

• What are the main objectives of the NIS 2 directive?

  NIS 2 aims to raise cybersecurity maturity, reduce fragmentation, improve incident reporting and cross-border cooperation, and strengthen operational resilience across critical and important sectors.