Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (“NIS2 Directive“) entered into force on January 16, 2023. It had to be transposed into national law by October 17, 2024. Only 9 Member States have transposed the provisions of the NIS2 Directive into national law so far, and it is likely that a significant number of Member States will need some time – see our post EU NIS2 implementation: where are we now? for a more detailed timeline. Nevertheless, companies are well advised to familiarize themselves with the new requirements and to provide for their implementation.
The NIS2 Directive extends the scope of application of security requirements for networks and information systems (“NIS”) to include numerous additional sectors compared to the previous NIS Directive (Directive (EU) 2016/1148). It also extends the range of obligations for public and private institutions. This means that companies that fall within the scope of the NIS2 Directive are subject to extensive new obligations. You can see a summary of the scope of application of NIS2 below; click here for a more detailed breakdown of which companies are covered by the NIS2 Directive, the obligations it imposes, sector-specific rules and possible effects of minimum harmonization, the sanctions in the event of a breach, and jurisdiction and territoriality under NIS2.
