European Union. Cybersecurity. Directive (EU)
NIS2Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2 Directive)
§1Summary
- Synopsis
Requires essential and important entities in listed sectors, including cloud computing, data centres, managed service providers and digital providers, to take cybersecurity risk-management measures and report significant incidents. It makes management bodies accountable and sets supervision and fines.
- Key themes
- Unique features
Size-cap rule (medium and large entities in scope), with some digital infrastructure entities caught whatever their size. Management bodies can be held personally liable.
- SaaS relevance
Medium or large SaaS, cloud and managed service providers fall in scope as 'ICT service management' or 'digital infrastructure' entities, and NIS2 duties also flow down to SaaS suppliers through customers' supply chain requirements.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- CSIRT/authority: early warning 24h; incident notification 72h; final report 1 month
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Essential: €10m or 2% turnover; Important: €7m or 1.4%
§3Dates
- Key dates
- Adopted
- In force
- Transposition deadline 2024-10-17; applies from 2024-10-18 (many member states transposed late); Implementing Regulation (EU) 2024/2690 covers digital providers. A further targeted amendment was proposed in the 2025–26 digital simplification package.
§4Text and authority
- Text
- Authoritative text eur-lex.europa.eu
- Authority
- National competent authorities and CSIRTs; ENISA; NIS Cooperation Group
§5Where it applies
§6Sources and verification
- Sources consulted
- Verification
High confidence.
National transposition status varies; check member-state rows. Non-EU providers of certain digital services must appoint an EU representative.