What Is NIS2? EU Rules and What They Mean for UK Businesses

NIS2 is the European Union's revised Network and Information Security Directive. It sets minimum cyber security and incident reporting duties for medium and large organisations in a defined list of sectors, and each EU Member State turns it into its own national law. If you are asking what is NIS2 because a customer has sent you a security questionnaire, the answer is usually about contracts and supply chains rather than direct legal liability.

The UK left the EU before NIS2 was adopted, so it does not apply to a UK-only business. The UK has its own regime, and that regime is being reformed. Where NIS2 does bite on UK firms is at the edges: EU subsidiaries, EU customers and services sold into the EU.

This guide sets out the directive in plain terms, the UK position as at October 2026, and a short set of practical steps for decision makers.

What is NIS2?

NIS2 is formally Directive (EU) 2022/2555. It replaced the original NIS Directive, with Member States required to transpose it into national law by 17 October 2024. The original directive was repealed from 18 October 2024. The European Commission describes the aim as raising the baseline of cyber security across sectors the economy depends on. You can read the Commission's own summary on its NIS2 policy page.

Because it is a directive rather than a regulation, it does not apply uniformly. Each country writes its own law, with its own regulator, registration process and local detail. Transposition has been uneven across the EU, and the Commission proposed targeted amendments on 20 January 2026 to improve legal clarity and simplify compliance. Anyone relying on NIS2 for a decision should check the national law of the country concerned.

Who is in scope of NIS2

The starting rule is size and sector. Medium-sized and large organisations operating in the covered sectors fall within scope. The directive lists 18 sectors, which keep the original ones (energy, transport, healthcare, finance, water and digital infrastructure) and add others such as public electronic communications, social platforms, waste and wastewater, postal and courier services, public administration, space and the manufacture of certain critical products.

Size is measured against the EU definition of a medium-sized enterprise, so very small organisations are generally outside the rules. Some entities are caught whatever their size, and Member States can designate smaller organisations they consider high risk.

Providers of digital services, including cloud, data centres, managed service providers and DNS services, are a particular focus. That is relevant to many UK technology companies.

Essential versus important entities

NIS2 sorts in-scope organisations into two categories, and the split controls how closely they are supervised.

The security duties are broadly the same for both categories. The difference is supervision intensity and the level of maximum penalty.

What NIS2 requires of organisations

The directive asks for appropriate and proportionate cyber security risk-management measures, and it makes senior management accountable for approving and overseeing them. In practice, that tends to mean the following:

• Risk analysis and security policies covering information systems.
• Incident handling with defined roles and a tested plan.
• Business continuity, including backup and recovery.
• Supply chain security, meaning you assess the security of suppliers and service providers.
• Access control, multi-factor authentication and encryption where appropriate.
• Staff training and basic cyber hygiene.

Incident reporting is the most time-sensitive duty. A significant incident requires an early warning to the national authority within 24 hours of becoming aware of it, a fuller incident notification within 72 hours, and a later final report. The supply chain point is why large EU customers are now asking suppliers, including UK ones, to evidence their controls. Our article on supply chain breaches affecting UK retailers shows why that scrutiny is growing.

NIS2 penalties and enforcement

Member States set penalties in national law, but the directive sets a floor for the maximum. Essential entities face administrative fines of up to at least EUR 10 million or 2% of worldwide annual turnover, whichever is higher. Important entities face up to at least EUR 7 million or 1.4% of worldwide annual turnover.

Fines are not the only lever. Authorities can issue binding instructions, order audits, and require organisations to tell affected customers. Some national laws also let regulators act against individual managers who are responsible for failures. The accountability of the board is a deliberate feature, so cyber security can no longer be treated as an IT-only matter.

Penalty levels and enforcement style will differ by country, because each Member State chooses how to apply the directive's maximums. Check the regulator in each country where you operate.

The UK position as at October 2026

The UK is not subject to NIS2. Its framework remains the Network and Information Systems Regulations 2018, which apply to operators of essential services and certain relevant digital service providers. Under those regulations, operators of essential services must notify their competent authority of an incident without undue delay and no later than 72 hours after becoming aware of it. The full text is on legislation.gov.uk.

The government is reforming that regime through the Cyber Security and Resilience (Network and Information Systems) Bill, introduced on 12 November 2025. As at 20 October 2026, according to the Parliament bill page, the Commons stages are complete and the Bill is in the House of Lords, after Grand Committee. It had not received Royal Assent.

As introduced, the Bill would bring medium and large managed service providers, certain data centres and designated critical suppliers into scope, and move to a 24-hour initial incident notification followed by a full report within 72 hours. It also proposes higher maximum penalties than the current regulations. Amendments in the Lords could alter the detail, so treat those provisions as proposals until the Act is passed. The government's own Bill collection explains the purpose.

When NIS2 matters to UK firms

A UK-only business with no EU presence has no direct NIS2 duty. These are the common routes by which it still becomes relevant:

• EU subsidiaries or branches. An entity established in a Member State and meeting the size and sector tests is covered by that country's law.
• Services sold into the EU. Providers of certain digital services that are not established in the EU but offer services there must appoint an EU representative, and fall under that Member State's jurisdiction.
• Customer contracts. An in-scope EU customer must manage supplier risk, so it may require security evidence, audit rights and fast incident notification from you. Contract clauses often mirror the 24-hour and 72-hour reporting steps.
• Managed service and cloud providers. If you provide IT services to EU organisations, expect NIS2-driven questions in tenders.

For UK firms in finance, health, energy, transport or digital infrastructure, the UK reforms are the more immediate concern, so both regimes are worth tracking. Financial firms may also be subject to separate sector rules, and our page on IT support for financial services covers that context.

Practical steps for UK decision makers

You do not need to overreact, but you do need a clear view of exposure. A sensible sequence:

1. Establish exposure. List EU entities, EU customers and any regulated sectors, and ask your legal adviser whether you fall under a national NIS2 law.
2. Review customer requests. Collect the security clauses and questionnaires you have received and look for common themes.
3. Assess your controls. A cyber security audit identifies gaps against recognised good practice.
4. Anchor on a baseline. Cyber Essentials covers the technical basics that NIS2-style questionnaires ask about, and our certification guide explains the process.
5. Test incident response. Be able to detect and report within 24 hours, supported by monitoring such as managed EDR.
6. Brief the board. Directors should understand the risks and approve the approach.

Cyber Essentials is not NIS2 compliance, and it does not replace national legal advice. It does give you a recognised, evidenced starting point.

Conclusion

So, what is NIS2? It is the EU's law setting cyber security and reporting duties for medium and large organisations in critical sectors, enforced nationally with substantial fines. UK firms are not covered directly, and the UK's own reform Bill was still before the House of Lords as at October 2026. The practical risk for most UK businesses is indirect, through EU operations and supply chain demands, so the best step is to confirm your exposure and strengthen your controls now. If you want help working out where you stand, speak to the NetMonkeys team.

Frequently Asked Questions (FAQs)