The NIS 2 Directive (EU 2022/2555) entered into force in January 2023 with a transposition deadline of 17 October 2024. As of early 2026, the majority of EU member states have completed their national transposition, and regulators — particularly National Competent Authorities (NCAs) — are moving from guidance to enforcement.
What's Changed Since October 2024
While the directive itself hasn't changed, the enforcement landscape has shifted dramatically:
- Fines are real. Article 34 penalties of up to €10M or 2% of global turnover are now being applied. Early enforcement actions in Germany, the Netherlands, and France have targeted organizations that failed to report incidents within the 24-hour early warning window.
- Self-identification is mandatory. If your organization falls within one of the 18 critical or important sectors and meets the size thresholds (50+ employees or €10M+ turnover), you must register with your NCA. "We didn't know" is not a defense.
- Supply chain scrutiny is increasing. Article 21(2)(d) requires organizations to assess and manage ICT supply chain security. NCAs are asking for documented supplier risk assessments.
The SMB Challenge
For small and medium businesses, the biggest challenge isn't understanding the regulation — it's operationalizing it. NIS 2 requires:
- A documented risk management framework
- Incident detection, response, and reporting procedures
- Business continuity and crisis management plans
- Supply chain security assessments
- Management body accountability (Article 20)
Most SMBs don't have a CISO or a dedicated compliance team. They need a structured path from "we know we need to comply" to "we can prove we comply."
What Regulators Are Looking For
Based on early enforcement patterns and published NCA guidance, regulators are prioritizing:
- Evidence of proportionate measures. You don't need enterprise-grade security — but you need documented, proportionate controls.
- Incident reporting readiness. Can you detect and report a significant incident within 24 hours? Do you have a process?
- Management engagement. Article 20 requires management bodies to approve cybersecurity measures and undergo training. Board minutes matter.
How to Get Ahead
The organizations faring best are those that started with a gap analysis, built a risk register, and documented their controls — not perfectly, but consistently. Compliance is a journey, not a checkbox. Start where you are, document what you do, and improve continuously.