NIS2

NIS2 Directive mandates corporate boards oversee cybersecurity as a governance issue, implementing duties for risk management, training, and incident response. Effective from 2024 in Italy, it holds boards accountable with fines up to €10M for non-compliance. The directive broadens its scope beyond critical infrastructure, imposing requirements on various sectors and emphasizing supplier cybersecurity scrutiny. Companies must integrate compliance strategies, adapt policies, and prepare for regulatory audits to safeguard trust and protect business integrity. Key deadlines include readiness for incident notifications by January 2026 and full compliance by October 2026.

https://www.hoganlovells.com/en/publications/nis2-cyber-governance-as-a-boardroom-matter

TLDR: As EU Member States implement NIS2, organizations must adapt to varying compliance obligations. Only 14 countries have completed transposition by the October 2024 deadline. NIS2 enhances cybersecurity across sectors, but national differences add complexity. Key compliance requirements include registration, appointing EU representatives, managing risks, reporting incidents, and audits. Non-compliance can lead to significant fines. Organizations should evaluate their operations relative to NIS2, track jurisdictional differences, and strengthen cybersecurity measures.

https://www.goodwinlaw.com/en/insights/publications/2025/10/insights-practices-dpc-navigating-nis2-what-organisations-need-to-know

One year after the NIS2 Directive’s transposition deadline, many EU countries have lagged on implementation, but firms cannot afford to wait for local laws. NIS2 applies to essential organizations in critical sectors, often based on size, regardless of where the companies are based or whether their activities are internal. Core obligations include entity registration, risk-based cybersecurity, detailed incident reporting, and strict supply chain controls, with boards personally accountable for compliance. Enforcement tools range from significant fines to bans on managers, and implementation challenges are heightened for multinationals because compliance is assessed per entity, not as a group. Organizations should proactively develop compliance strategies specific to each jurisdiction, as waiting could fail to meet obligations.

https://connectontech.bakermckenzie.com/nis2-one-year-on-whats-missing-whats-at-stake-and-whats-next/

NIS2 Directive mandates enhanced information security for around 29,500 German companies, impacting SMEs by shifting responsibility to top management. Key obligations include implementing an Information Security Management System (ISMS), risk management, compliance reporting, and business continuity plans with fines up to €10 million. The regulation integrates with existing laws like GDPR, creating a comprehensive governance framework essential for economic stability and supply chain security. Immediate actions for companies include assessing impact, establishing ISMS, embedding risk management, and ensuring management accountability.

https://morethandigital.info/en/nis2-in-detail-for-small-and-medium-sized-enterprises/

NIS2 aims to enhance cyber resilience among EU organizations, but many member states have yet to implement it into national law ahead of the October 2024 deadline. An expert roundtable highlighted the varied progress, with countries like the Netherlands facing challenges due to bureaucratic delays. Compliance is viewed as necessary for security, yet many organizations remain reactive rather than proactive. There’s concern about the capacity of CERTs to support compliance efforts. Overall, while NIS2 could foster better security practices, the path to complete implementation remains complex and costly.

https://www.techzine.eu/blogs/security/133821/nis2-is-intended-to-make-organizations-more-secure-but-will-it-succeed/

ENISA published technical guidance for NIS2 implementation, focusing on cybersecurity measures across 18 critical sectors such as digital infrastructure, energy, and health. The guidance supports organizations in aligning with the NIS2 Directive’s requirements, which aims to enhance cybersecurity in Europe. Key areas covered include risk management, incident handling, supply chain security, and skills development for cybersecurity roles. The guidance is non-binding and complements national regulations.

https://www.enisa.europa.eu/news/supporting-nis2-implementation-through-actionable-guidance