By SenseOn Team · 2026-03-28
The NIS2 Directive (Directive (EU) 2022/2555) is the European Union's updated cybersecurity legislation, which replaced the original NIS Directive of 2016 and is now in enforcement. It applies to essential and important entities across 18 sectors, establishes a higher baseline of cybersecurity measures, requires an early warning within 24 hours of a significant incident, and carries fines of up to EUR 10 million.
The eleven checks, the three stages and the questions to put to a vendor, on one page you can forward to a board or a supplier without an account or a login.
The CISO AI Accountability Blueprint
One-page PDF
Every AI and analyst action, including AI agent governance decisions, writes to the append-only, immutable Decision Trace.
NIS2 is EU law and does not apply to organisations that operate only in the UK. It does apply to UK firms that provide in-scope services in the EU, and a UK digital provider such as a managed service, managed security, cloud or data centre provider with no EU establishment must appoint a representative in an EU member state where it offers services; in the UK itself, organisations fall under the NIS Regulations 2018, which the Cyber Security and Resilience Bill will reform.
The legal basis, from the text of Directive (EU) 2022/2555:
| Your situation | Which rules apply |
|---|---|
| UK-only organisation, no services in the EU | Not NIS2. The UK NIS Regulations 2018 apply if you are an operator of essential services or a relevant digital service provider. The Cyber Security and Resilience Bill will widen the UK regime once it becomes law. |
| UK group with a subsidiary established in an EU member state | NIS2, as transposed by that member state, for the EU subsidiary (Article 26(1)). UK rules for the UK operations. |
| UK managed service, managed security, cloud, data centre, CDN, DNS, TLD or domain registration provider, online marketplace, search engine or social platform offering services in the EU with no EU establishment | NIS2. Appoint an EU representative in a member state where you offer services (Article 26(3)) and register with that state for the ENISA registry (Article 27). |
| Other UK firm of an Annex I or II type serving EU customers without an EU establishment | Take legal advice. Article 2(1) covers entities that provide services in the EU, but Article 26(1) ties most sectors to the member state of establishment. |
| UK supplier to an EU organisation that is in scope | Not directly regulated by NIS2. Your customer must manage supply chain security, including its relationships with direct suppliers (Article 21(2)(d)), so expect security clauses in contracts. |
The UK position as of 23 September 2026: the NIS Regulations 2018 (SI 2018/506) came into force on 10 May 2018 and cover operators of essential services and relevant digital service providers. The government introduced the Cyber Security and Resilience Bill on 12 November 2025. It will reform and add to the 2018 Regulations. The government's summary says it brings data centres and medium and large managed service providers into scope, and requires an initial incident notification within 24 hours and a fuller report within 72 hours. The Bill is in the House of Lords, with report stage listed for 26 October 2026 (UK Parliament). It is not yet law, so its detail may still change. This section is general information, not legal advice.
The NIS2 Directive (formally Directive (EU) 2022/2555) was adopted by the European Parliament and Council in December 2022. Member states were required to transpose it into national law by 17 October 2024, and enforcement is now active.
NIS2 exists because the original NIS Directive (2016) proved insufficient. The original directive covered a narrow set of sectors and allowed member states significant discretion in implementation. An organisation operating across multiple EU member states could face different requirements in each jurisdiction.
NIS2 addresses these shortcomings by:
NIS2 classifies regulated organisations into two categories: essential entities and important entities. The distinction affects the intensity of regulatory supervision and the maximum penalties, but the core security requirements apply to both.
Essential entities are organisations in high-criticality sectors that meet the size threshold (250+ employees or EUR 50M+ turnover). These sectors include:
Important entities operate in additional sectors and may be medium-sized (50+ employees or EUR 10M+ turnover):
NIS2 applies to medium-sized and large organisations as defined by EU criteria: 50 or more employees, or annual turnover (or balance sheet total) of EUR 10 million or more. Some entities are covered regardless of size, including DNS service providers, TLD registries, and public electronic communications providers.
Article 21 of NIS2 specifies the cybersecurity risk management measures that all regulated entities must implement. These are principle-based rather than prescriptive, giving organisations flexibility in implementation while requiring demonstrable compliance.
Organisations must establish and maintain risk management frameworks that identify, assess, and treat cybersecurity risks. This includes documented security policies, regular risk assessments, and evidence that risk treatment decisions are informed by current threat intelligence.
Organisations must have processes and capabilities for detecting, managing, and responding to cybersecurity incidents. NIS2's incident reporting requirements are among its most prescriptive elements:
The 24-hour clock runs from the moment you become aware of a significant incident (Article 23(4)(a)), not from the moment the attack began. The early warning should also say, where applicable, whether the incident is suspected of being caused by unlawful or malicious acts or could have a cross-border impact. So the hard part is not the form. It is reaching a defensible judgement fast: is this incident significant, is it malicious, and what evidence supports that? Slow detection does not stop the clock, but it lets an attacker run for longer before the clock starts.
This is where detection speed and a record of decisions matter. Across SenseOn's managed-service customer environments, for example, mean time to detect and respond is under 20 minutes over a rolling 30-day window, and every AI and analyst action is written to an append-only record that the report can draw on. The section on where SenseOn fits sets out the detail and the limits.
Organisations must maintain business continuity plans, disaster recovery procedures, and crisis management frameworks. This includes backup management, system redundancy, and regular testing of continuity procedures.
Organisations must assess and manage cybersecurity risks arising from their supply chain and third-party service providers. This requires due diligence on supplier security practices, contractual security requirements, and ongoing monitoring of supply chain risk.
Organisations must integrate security throughout the lifecycle of their network and information systems, from procurement through development, deployment, and decommissioning. This includes vulnerability management, patch management, and secure configuration practices.
Organisations must regularly assess the effectiveness of their cybersecurity measures through audits, testing, and review. Penetration testing, vulnerability assessments, and security architecture reviews are all relevant practices.
Basic cybersecurity hygiene practices and regular security awareness training for all staff, including senior management, are mandatory requirements.
Organisations must implement policies and procedures for the use of cryptography and, where appropriate, encryption to protect sensitive data.
Access control policies, identity management, and the principle of least privilege must be implemented and maintained.
The use of multi-factor authentication (MFA), continuous authentication solutions, and secured voice, video, and text communications is required where appropriate.
NIS2 introduces a tiered penalty framework:
Critically, NIS2 introduces personal accountability for senior management. Article 20 requires management bodies to approve and oversee cybersecurity risk management measures, undergo training, and bear personal responsibility for non-compliance. National authorities can impose temporary bans on individuals exercising managerial functions in cases of serious non-compliance.
Regulatory authorities can:
The NIS2 Directive is EU legislation. Post-Brexit, the UK is not bound by it. However, UK organisations should not dismiss NIS2 as irrelevant. There are three important reasons:
UK companies that provide services to EU customers or operate subsidiaries in EU member states may fall within NIS2's scope for those activities. NIS2 covers entities that provide services or carry out activities in the EU (Article 2(1)). An EU subsidiary falls under the member state where it is established. A UK-based managed service provider offering services in the EU without an EU establishment must appoint an EU representative (Article 26(3)); whether it is an essential or an important entity depends on its size and on how the member state applies Article 3. Processing personal data of EU residents is a GDPR question, not a NIS2 trigger in itself. The table under "Does NIS2 apply in the UK?" above sets out each case.
The UK government introduced the Cyber Security and Resilience Bill on 12 November 2025 to reform and add to the NIS Regulations 2018, which implemented the original NIS Directive before Brexit. The Bill moves in the same direction as NIS2 in key areas: wider scope (data centres and managed service providers), faster incident reporting (24 hours, then 72 hours) and powers over critical suppliers. As of 23 September 2026 it is before the House of Lords and not yet law. UK organisations that prepare for NIS2 will be well placed for the UK's own changes.
For financial services firms, the Financial Conduct Authority (FCA) and Prudential Regulation Authority (PRA) impose cybersecurity requirements that parallel many NIS2 obligations. The operational resilience framework (PS21/3) requires firms to identify important business services, set impact tolerances, and test their ability to remain within those tolerances during severe but plausible scenarios. These requirements are substantively aligned with NIS2's risk management and business continuity provisions.
The following steps provide a practical roadmap for achieving and demonstrating NIS2 compliance:
SenseOn helps with three parts of NIS2: detecting and handling incidents (Article 21(2)(b)), assembling the evidence behind the three-stage report, and keeping the audit trail that supervisors ask for. It does not cover business continuity, supply chain due diligence, cryptography, training or MFA; those stay with your own policies and tools, and the checklist above still applies. It also does not decide whether an incident is significant or file the report. Your named people do that, with the evidence in one place.
NIS2 asks you to manage risk across your network and information systems. Per-GB pricing works against that, because every new source becomes a budget decision. SenseOn is priced as an annual pool of Flex Intelligence Credits. You pay for outcomes: detection and response across your data, analytics included, and the investigations its AI completes. Data volume is one meter, not the whole bill. Edge processing removes about 40% of data volume before the pipeline.
If you supply an organisation that is in scope, expect its supply chain duties (Article 21(2)(d)) to reach you as contract clauses and questionnaires. SenseOn holds ISO/IEC 27001:2022 certification from British Assessment Bureau (UKAS-accredited) and Cyber Essentials Plus, offers UK and EU data residency, and the Decision Trace gives you a record to show a customer how an incident on your side was handled.
The NIS2 Directive (Directive (EU) 2022/2555) is the EU's updated cybersecurity legislation that replaced the original NIS Directive. It expands the scope of regulated sectors, introduces stricter security requirements, mandates 24-hour incident reporting, and establishes significant penalties for non-compliance. NIS2 entered enforcement in October 2024 and applies to essential and important entities across 18 sectors.
Not to UK-only organisations: NIS2 is EU law. It applies to UK firms for services they provide in the EU, for example through an EU subsidiary, and UK managed service, managed security, cloud, data centre and similar digital providers that offer services in the EU without an EU establishment must appoint an EU representative (Article 26(3)). In the UK, the NIS Regulations 2018 apply, and the Cyber Security and Resilience Bill will reform them once it becomes law. The FCA's operational resilience requirements for financial services firms cover similar ground to NIS2.
Essential entities face fines of up to EUR 10 million or 2% of global annual turnover, whichever is higher. Important entities face fines of up to EUR 7 million or 1.4% of global annual turnover. Beyond financial penalties, NIS2 introduces personal liability for senior management, potential temporary suspension of services, and mandatory public disclosure of compliance failures.
NIS2 mandates a three-stage incident reporting process: an early warning within 24 hours of becoming aware of a significant incident, an incident notification with initial assessment within 72 hours, and a final report with root cause analysis and remediation measures within one month of the notification. The clock starts when you become aware of a significant incident, so organisations that cannot classify incidents quickly, and back the judgement with evidence, will struggle to meet these deadlines.
NIS2 significantly expands the original NIS Directive in several ways: it covers 18 sectors compared to the original 7, removes the option for member states to set their own scope, introduces harmonised penalties across the EU, adds supply chain security requirements, mandates board-level accountability for cybersecurity, and requires 24-hour initial incident reporting compared to the original's less prescriptive timeline.
Related reading:
How SenseOn writes, checks and corrects its content: editorial standards.
A board AI risk assessment is five decisions with named owners, evidence and an escalation route, not a policy document. Here's the template.
industryJudge AI pentesting on four measures: run repeatability, validation effort, escalation path, and whether findings reach remediation.
industryAI moves SOC work, it does not remove it, unless you govern and measure the decisions it makes: queue compression, escalation rate, cost per case.
We will walk one case from first signal to decision, show the Decision Trace record behind it, and show how SenseOn runs alongside the tools you keep while you close the rest of your Article 21 gaps.
