The EU's NIS2 directive widened cyber duties and made managers liable

What the document says

Directive (EU) 2022/2555, known as NIS2, was adopted on 14 December 2022 and published in the Official Journal of the European Union shortly after. It replaces the original 2016 NIS Directive and extends mandatory cybersecurity duties to a much longer list of sectors: energy, transport, health, water and waste water, digital infrastructure, postal and courier services, public administration, space, and manufacturing of critical products, among others. Member states were required to transpose the directive into national law by 17 October 2024, the date this entry treats as the operative event, since that is when the wider duties took legal effect inside each country.

The directive's substance sets it apart from earlier EU cybersecurity rules in two ways. First, it requires covered entities to adopt specific risk-management measures, including incident handling, supply chain security and access control, rather than leaving the standard undefined. Second, per the European Commission's own explanatory guidance, it makes an entity's management body personally accountable for approving those measures, exposing members to sanctions, including a temporary bar from managerial roles at essential entities, for non-compliance. Reporting follows a staged timeline: an early warning within 24 hours, a fuller notification within 72 hours, and a final report within a month.

Confidence and limits

The transposition deadline and sector list are established directly by the directive's own text. The 24-hour, 72-hour and one-month reporting stages and the management liability provision are described in the Commission's own guidance rather than quoted here at length. This entry does not assess how any single member state implemented the directive, nor how any national regulator has applied it to a particular company.

Why it mattered

Transposition deadlines govern states, not companies directly, which is why the first enforcement action after 17 October 2024 targeted governments. The Commission's own policy page records that by July 2026 it had referred Ireland, Spain, France and the Netherlands to the Court of Justice for failing to notify their transposing measures. Only once a member state's law is in force can its regulators supervise and sanction companies in their jurisdiction, which is why many organisations experienced NIS2 as a staggered, country-by-country obligation.

Defensive takeaway

Check whether your national transposition law has entered into force, which category, essential or important, your organisation falls into, and whether your board has formally assigned approval of cybersecurity risk-management measures to a named individual, since that assignment is what personal liability now attaches to.

• Does your organisation operate in one of the eighteen sectors NIS2 now covers, including ones not regulated under the original NIS Directive?
• Has your management body formally approved your cybersecurity risk-management measures, and is that approval documented?
• Do your incident response procedures support a 24-hour early warning and a 72-hour notification to your national authority?

NIS2 does not itself make any organisation secure; it sets a floor of required practice and reporting, and puts a specific person's name against the decision to meet it or not. Its early enforcement history shows that floor arriving unevenly across the EU, one national transposition at a time.