NIS2 Explained: Who It Applies To and What It Requires

NIS2 is the EU directive that sets minimum cybersecurity rules for medium and large organisations in 18 critical sectors, including health. Its full name is Directive (EU) 2022/2555. It requires covered organisations to manage cyber risk with concrete measures, including the security of their suppliers, to report significant incidents within 24 hours, and it makes management personally accountable. Member states had to turn it into national law by 17 October 2024.

An everyday example

"Example Hospital Group" (a made-up example) runs three private clinics with 400 staff. Health is a sector of high criticality under NIS2, and the group is well above the size threshold, so it is an essential entity.

In practice that means its board must approve a cybersecurity risk plan and take training. IT must cover backups, access control, multi-factor authentication and incident handling. Every supplier with access to its systems, from the patient booking software to the AI tool doctors use for letters, becomes part of its supply-chain risk. And if ransomware takes down a clinic system, the group has 24 hours to send an early warning to the national authority.

The details, simply

A directive, not a regulation

Unlike GDPR, NIS2 is a directive. It does not apply directly: each member state passes its own law. NIS2 replaced the first NIS Directive (2016/1148) and member states had to apply their national rules from 18 October 2024. Many were late. The European Commission opened infringement proceedings against 23 member states in November 2024, and in July 2026 referred four of them to the EU Court of Justice. So the exact rules, authority and start date depend on your country's law.

Who it applies to

NIS2 covers organisations in 18 sectors listed in two annexes:

Annex I, sectors of high criticality: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure (including cloud computing and data centre providers), ICT service management (managed IT and security service providers), public administration and space.
Annex II, other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing (including medical devices), digital providers (online marketplaces, search engines, social networks) and research.

In health, Annex I covers healthcare providers, EU reference laboratories, research and development of medicinal products, manufacturers of basic pharmaceutical products, and manufacturers of medical devices considered critical during a public health emergency.

The size threshold

As a rule, NIS2 applies to medium-sized and larger organisations (Art. 2(1)), using the EU SME definition:

Medium-sized: from 50 employees, or more than €10 million in both annual turnover and balance sheet total.
Large: 250 or more employees, or more than €50 million turnover and €43 million balance sheet total.

Smaller organisations are usually outside, with exceptions: some providers, such as telecoms, DNS and trust service providers, are covered regardless of size, and member states can designate a small entity if it is the only provider of an essential service or if its disruption could affect public safety, security or health (Art. 2(2)).

Essential vs important entities

Essential entities (Art. 3(1)): mainly large organisations in Annex I sectors, plus some providers regardless of size. They face proactive supervision, such as audits and inspections.
Important entities (Art. 3(2)): everything else in scope, typically medium-sized Annex I organisations and medium and large Annex II organisations. They are mainly supervised after the fact, for example following an incident.

The security duties are the same for both. The difference is supervision and the size of fines.

The ten minimum measures (Art. 21)

Organisations must take "appropriate and proportionate" technical, operational and organisational measures, including at least:

Risk analysis and information system security policies
Incident handling
Business continuity: backups, disaster recovery, crisis management
Supply-chain security, including the security of direct suppliers and service providers
Security in acquiring, developing and maintaining systems, including vulnerability handling
Policies to assess whether the measures work
Basic cyber hygiene and cybersecurity training
Cryptography and, where appropriate, encryption
Human resources security, access control and asset management
Multi-factor authentication and secured communications where appropriate

Incident reporting (Art. 23)

For a significant incident, one that causes or could cause severe disruption or financial loss, or affect other people:

Within 24 hours: early warning to the national CSIRT or authority.
Within 72 hours: incident notification with an initial assessment.
Within one month of that notification: a final report.

If personal data is affected, GDPR's separate 72-hour breach notification can apply as well.

Management liability (Art. 20)

Management bodies must approve the cybersecurity measures, oversee their implementation and can be held liable for breaches. Members of management must take cybersecurity training. For essential entities, authorities can in serious cases seek a temporary ban on a manager exercising managerial functions (Art. 32(5)).

Fines (Art. 34)

Essential entities: at least up to €10 million or 2% of worldwide annual turnover, whichever is higher.
Important entities: at least up to €7 million or 1.4% of worldwide annual turnover, whichever is higher.

These are minimum maximums: national law can set higher caps.

This is general information, not legal advice.

What NIS2 does not cover

NIS2 is about keeping systems secure and available. It asks whether your suppliers could be breached, not whether they are allowed to reuse your data. A provider can have excellent security, certified and audited, and still have terms that let it use, analyse or anonymise what you upload. That is a contract question, and anonymised data is outside data protection law altogether (GDPR Recital 26). We show what can happen to data once reuse is allowed on the data trail.

What it means when choosing IT and AI providers

Because of the supply-chain duty, every AI tool your staff use is part of your NIS2 risk picture. When you assess one, ask:

Where does the data go? Which subprocessors and model providers see it, and in which region?
What is kept? Prompts, files and outputs: retained, logged, or deleted after processing?
Is it encrypted in transit and at rest?
Can the provider reuse it? Training, "service improvement" or anonymisation rights in the terms.
Will the provider support your incident reporting, with notification commitments in the contract?

Wysor is built to keep that answer short. Data is encrypted in transit and at rest and hosted in the EU. Every connected AI model provider runs with zero data retention: processed, then deleted. We act only as your processor under Art. 28 GDPR, take no licence to reuse your content, and never train on it or sell it, with those commitments in the contract. One workspace gives your team GPT, Claude, Gemini and more, which also helps keep unapproved tools out of the picture.

FAQ

What is NIS2? NIS2 is Directive (EU) 2022/2555, the EU's updated law on network and information security. It sets cybersecurity and incident reporting duties for medium and large organisations in 18 critical sectors.

Does NIS2 apply to small businesses? Usually not. It generally applies from medium-sized organisations upward (50 or more employees, or turnover and balance sheet above €10 million). Some providers are covered regardless of size, and member states can designate small entities that are critical.

Does NIS2 apply to hospitals and medical practices? Healthcare providers are in an Annex I sector, so hospitals and larger clinic groups are typically covered. A small single practice is usually below the size threshold, unless national law designates it.

What is the NIS2 reporting deadline? An early warning within 24 hours of becoming aware of a significant incident, a notification within 72 hours, and a final report within one month after that notification.

When did NIS2 come into force? It entered into force in January 2023. Member states had to transpose it by 17 October 2024 and apply it from 18 October 2024, but several transposed it late, so check your national law.