AI Compliance Vendors

What is NIS2?

Directive (EU) 2022/2555 (NIS2) is the EU's second-generation cybersecurity directive. It requires medium-sized and large entities across critical sectors — energy, transport, heal

Last updated September 21, 2026 · Every fact traceable to a public source

Directive (EU) 2022/2555 (NIS2) is the EU's second-generation cybersecurity directive. It requires medium-sized and large entities across critical sectors — energy, transport, healthcare, finance, water, digital infrastructure, digital service providers, waste, critical manufacturing, postal services, public administration, and space — to implement cybersecurity risk management measures and notify national authorities of significant incidents. Member States were required to transpose NIS2 into national law by 17 October 2024.

What does NIS2 actually require?

Key obligations include: Adopt cybersecurity risk-management measures appropriate to the risks posed to network and information systems; Notify the relevant competent authority or CSIRT of significant incidents without undue delay; Provide an early warning within 24 hours and a detailed incident notification within 72 hours of becoming aware; Address supply chain security in risk-management measures; Implement vulnerability handling and disclosure policies; Ensure top-management accountability for cybersecurity risk-management measure approval and oversight.

Who is in scope of NIS2?

NIS2 is in_force in European Union. Scope attaches based on jurisdiction and the role a company plays in the AI supply chain. See /frameworks/nis2 for the full scope note and source links.

When does NIS2 take effect?

The primary enforcement date is 2024-10-17. Some provisions may phase in earlier or later — see the framework brief for the full timeline.

What are the penalties?

Maximum penalties: For essential entities, administrative fines up to €10 million or 2% of total worldwide annual turnover (whichever is higher); for important entities, up to €7 million or 1.4% of worldwide annual turnover (Directive (EU) 2022/2555 Article 34).. Enforcement is carried out by the designated authorities in the jurisdiction.

Related

Keep reading

Framework
NIS2 framework brief

Editorial independence

This FAQ is editorial. No vendor can pay to be highlighted or ranked in answers, and the written commentary on this page is payment-free. Featured slots in directory listings are always labeled where they appear. Read our methodology for details.