NIS2

in English: NIS2 Directive (Network and Information Security Directive 2)

advancedwidespread

The European Union's cybersecurity rule that obliges companies and institutions in important sectors to protect their systems and report serious incidents quickly.

In plain terms

NIS2 in the digital world is like fire safety regulations in buildings. It does not tell you what your business should be like, but that there must be a fire alarm, an evacuation plan, and a person responsible for keeping everything in order.

It applies to organizations whose failure would hurt many people: energy providers, hospitals, transport, water utilities, banks, digital service providers, the food and chemical industries, postal services, waste management and public administration. It typically affects medium-sized and large companies, but also some key service providers regardless of size, and smaller firms through their supply chains.

Compared to its predecessor, the novelty is that it covers many more sectors and holds leaders personally accountable. Cybersecurity is thus no longer just an IT issue but a management one.

In the AI era, this is particularly important because the AI tools and agents used by companies are also part of the protected IT system. If an agent accesses email or customer data, its risk must be assessed just like any other software.

How it works

Classification: the organization checks whether it falls under the regulation based on its sector and size, and if so, registers itself with the authority.
Risk assessment: it inventories your systems, data, and suppliers, and analyzes what would happen if they went down or fell into unauthorized hands.
Protective measures: it introduces mandatory basics, such as backup, access management, encryption, multi-factor authentication, employee training, and supplier checks.
Incident reporting: in case of a significant attack or outage, an early warning must be sent within 24 hours, a detailed report within 72 hours, and a final report within one month.
Monitoring and sanctions: the authority supervises compliance. In case of non-compliance, the most important (essential) entities can be fined up to at least 10 million euros or 2 percent of annual global turnover, whichever is higher. For other affected (important) entities, the limit is 7 million euros or 1.4 percent of turnover.

An everyday example

You work at a food industry company, and overnight two-step login becomes mandatory, you are sent to phishing training, and uploading company documents to unauthorized AI tools is prohibited. Behind this, the NIS2 directive is likely at play: your company must prove it keeps digital risks under control.

Who is affected

entrepreneur, executiveManagement is responsible for compliance; negligence may result in fines and personal liability.

employeeStricter access rules, mandatory training, and usage limits for AI tools will appear in your daily work. → Work & HR

developerIf you deliver software or an agent to an affected company, the client will request security requirements and evidence from you. → Code

everyoneIt ensures that power, water, hospitals, and banks continue to function during a cyberattack.

A common misconception

MythNIS2 applies only to large energy companies and banks; smaller businesses have no dealings with it.

In realityMany medium-sized companies are also directly affected, such as food manufacturers, machinery producers, or waste management firms. Smaller ones encounter it as suppliers because their clients must also verify the security of their supply chains.

Limits and risks

A directive, not a regulation: each member state transposed it into its own law, so details, deadlines, and authorities differ by country.
Compliance on paper does not guarantee actual protection: an organization can still be attacked after a successful audit.
Preparing costs money and expertise, which can be a heavy burden for medium-sized companies.
It does not go into the specific risks of AI systems, such as manipulated inputs or the poisoning of training data. The EU AI Act sets out separate requirements for these, in part.

Similar, but not the same

GDPR – The GDPR protects personal data, while the NIS2 Directive ensures the functionality and security of services and IT systems.
EU MI-rendelet (AI Act) – The AI Act regulates what AI systems can be brought to market and how they can be used, while NIS2 covers the entire IT security of an organization.
DORA – DORA is an EU regulation specifically on digital resilience in the financial sector, providing more detailed, priority rules than NIS2.

Related concepts

Broader

Cybersecurity, EU digital regulation, Compliance

Narrower

Incident reporting, Risk management, Supply chain security, cybersecurity audit

On the edge

EU MI-rendelet (AI Act), GDPR, DORA, Kiberreziliencia-rendelet (CRA), Critical Infrastructure

A brief history

The first EU cybersecurity directive (NIS) was adopted in 2016. It was replaced by NIS2, adopted in December 2022, which entered into force in January 2023 and had to be transposed into national law by member states by October 17, 2024.

Where things stand

As of late 2026, NIS2 is in force as national law in most member states, including Hungary, where registration, audits and regulatory inspections are part of daily practice for the organizations concerned. The quality of transposition and the strictness of enforcement still vary by country.

Status: 2026 November

Also known as

NIS2 · NIS 2 · NIS2 Directive · NIS2 Directive · Directive (EU) 2022/2555 · Directive (EU) 2022/2555 · Network and Information Security Directive · cybersecurity directive

Sources

European Commission: NIS2 Directive

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.