EU cybersecurity regulation

What Is NIS2? What Changed in EU Cybersecurity Requirements?

Understand the directive, risk-management duties, reporting rules and 2026 proposal status.

NIS2 is an EU law, not a new NIST publication

NIS2 is the European Union’s Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union. It replaces the first NIS directive, often called NIS1. NIS2 came into force in January 2023, and Member States were required to transpose it into national law by October 2024. National implementation is important because companies normally interact with their own country’s competent authority and reporting arrangements.

The European Commission explains that NIS2 now addresses 18 critical sectors and aims to strengthen the EU’s common approach through wider coverage, clearer cybersecurity requirements, stronger supervision and cooperation. It is not a software product standard and does not mean every factory must purchase the same technical tools.

What changed compared with NIS1?

NIS2 broadened coverage beyond the sectors emphasized by its predecessor. It includes additional digital services, public administration and categories of manufacturing, among other sectors. It also gives greater prominence to the accountability of senior management for cybersecurity risk management. Security is therefore not simply an engineering issue delegated without oversight.

The directive establishes minimum topics for appropriate and proportionate risk-management measures. These include policies for risk analysis and information-system security, incident handling, business continuity, supply-chain security, secure acquisition and development, vulnerability handling, assessment of controls, cyber hygiene and training, cryptography where appropriate, human-resource security, access control and asset management, and multi-factor authentication and secured communications where appropriate. Organizations should use the legal text and national legislation to determine exactly what applies to them.

Significant-incident reporting is structured in stages

For entities covered by the relevant provisions, NIS2 Article 23 sets out a staged notification process for significant incidents. It includes an early warning without undue delay and in any event within 24 hours of becoming aware of a significant incident, followed by an incident notification without undue delay and in any event within 72 hours. A final report is normally due no later than one month after the incident notification, with intermediate or progress reporting possible under the directive’s conditions.

These deadlines are not a reason to send every minor security alert to an authority. First the entity must assess whether an incident meets the relevant “significant” threshold and follow the procedures implemented in its Member State. Reporting should not delay operational safety measures or incident containment.

NIS2 significant-incident reporting: staged notifications

Explanatory figure
  • 24 hoursEarly warningInitial notification after awareness of a significant incident.
  • 72 hoursIncident notificationInitial assessment with relevant severity and impact information.
  • 1 monthFinal reportMore complete incident account, generally following the incident notification.

These are the directive’s staged reporting milestones for significant incidents. National implementation and the applicable Article 23 conditions must be checked.

Simplified reference to the framework in Article 23 of Directive (EU) 2022/2555; not every alert triggers reporting.

A practical example for a manufacturer

Suppose a manufacturer discovers unauthorized access to an OT-connected engineering system. The organization should first protect people and operations, preserve relevant evidence and activate its incident response process. At the same time, it should assess the event’s significance, affected services, impact, reporting duties and supply-chain implications. The correct regulatory response depends on whether the company is within scope and on its national law.

NIS2 does not require treating an unverified vulnerability scan result as a reportable incident. A published CVE and a cybersecurity incident are different things. A significant incident assessment requires facts about what happened and its consequences.

The 2026 proposed amendments are not automatically law

On 20 January 2026, the European Commission published a proposal for targeted NIS2 amendments as part of a cybersecurity package. The proposal seeks greater legal clarity, simpler jurisdictional arrangements, streamlined ransomware-related data collection and improved supervision of cross-border entities. A Commission proposal is not the same as an adopted directive, so guidance must keep the two separate until any legislative changes are formally enacted.

It was not the only proposal. On 19 November 2025, the Commission’s Digital Omnibus package proposed, among other changes, a single entry point for incident reporting operated by ENISA, so that one notification could serve several EU regimes, including NIS2 and the GDPR. This is also still a proposal; until it is adopted, current reporting duties and channels continue to apply.

Why national rules matter

In Germany, the Federal Office for Information Security (BSI) states that the NIS2 Implementation Act entered into force on 6 December 2025. BSI directs covered entities to its portal for applicable registration and reporting duties. Registration with BSI was originally due by 6 March 2026. Because many entities had not yet registered, BSI asked them to complete registration by 31 July 2026. That date has passed, so an organization that is in scope and not yet registered should register without further delay. Organizations with establishments in different EU countries should check applicable national rules and competent authorities rather than assume identical operational procedures everywhere.

Preparing without reducing compliance to a checklist

A sound starting point is to determine whether the organization is within scope, identify management responsibility, document essential services and assets, assess OT and IT risks, review supplier connections, establish incident reporting decisions, and test continuity arrangements. The documented evidence should show decisions and controls that exist in practice.

NIS2 makes cybersecurity a business governance responsibility with operational consequences. For manufacturers, the goal is not merely to create another regulatory document, but to manage cyber risks that can affect production, employees, customers and critical services.

Official sources and further reading

The resources below support the technical and regulatory information discussed. Review current vendor advisories and applicable national law before making operational or compliance decisions.

DTSecLabs / Industrial cybersecurity knowledge

Educational resource | Published Aug 11, 2026

Back to all blogs