From NIS1 to NIS2

In this lesson

• Explain why Directive (EU) 2016/1148 was repealed, using the reasons the legislator itself recorded in the recitals of NIS2.
• Name the structural changes NIS2 made, and point to the article that carries each one.
• Tell apart the entities that are in scope on their own facts and those whose status depends on identification by a member state.
• Refuse the inference that an organisation is out of scope because no authority has contacted it.

What NIS1 set out to do, and where it fell short

Recitals 1 and 2

Directive (EU) 2016/1148, now called NIS1, aimed, in the words of recital 1 of NIS2, to build cybersecurity capabilities across the Union, mitigate threats to the network and information systems used to provide essential services in key sectors, and ensure the continuity of those services when facing incidents. Recital 2 gives it real credit. NIS1 ensured the completion of national frameworks, through national strategies, national capabilities and regulatory measures covering essential infrastructures, and it created the two cooperation structures that NIS2 keeps: the Cooperation Group and the network of national computer security incident response teams (CSIRTs). The same recital then delivers the verdict that justified a new text: “Notwithstanding those achievements, the review of Directive (EU) 2016/1148 has revealed inherent shortcomings that prevent it from addressing effectively current and emerging cybersecurity challenges.”

Recital 4

Recital 4 names those shortcomings. Each one explains a design choice you will meet later in this course.

• Scope. NIS1 had a scope “the delimitation of which was very largely left to the discretion of the Member States”. Two organisations doing the same thing could be regulated on one side of a border and unregulated on the other.
• Obligations. Member states had “very wide discretion as regards the implementation of the security and incident reporting obligations”, so the same duty was implemented in significantly different ways in different capitals.
• Enforcement. The recital records “similar divergences” in supervision and enforcement.

Because both directives rest on Article 114 of the Treaty on the Functioning of the European Union, the internal-market legal basis, those divergences were not only a security weakness. Recital 4 notes that they “entail additional costs and create difficulties for entities that offer goods or services across borders.” Recital 5 draws the conclusion that Directive (EU) 2016/1148 “should be repealed and replaced by this Directive”, and Article 44 repeals it with effect from 18 October 2024.

The decisive change: who decides that you are in scope

Recital 7

Under NIS1, recital 7 recalls, “Member States were responsible for identifying the entities which met the criteria to qualify as operators of essential services.” Being regulated followed from a national identification decision. NIS2 abandons that model. To eliminate divergences and ensure legal certainty, “a uniform criterion should be established that determines the entities falling within the scope of this Directive”: the size-cap rule. Recital 6 adds that the old distinction between operators of essential services and digital service providers “has been proven to be obsolete”.

Art. 2(1)

Article 2(1) applies that criterion directly. The directive covers public or private entities of a type referred to in Annex I or II which qualify as medium-sized enterprises under Commission Recommendation 2003/361/EC, or exceed the ceilings for medium-sized enterprises, and which provide their services or carry out their activities within the Union. There is no designation step in that sentence. If the facts are met, the entity is in scope, whether or not anyone has written to it. Module 2 works through the sector test and the size test in detail.

Art. 3(1)(e) and (g)

Identification by a member state has not disappeared. It has become the exception, and it still decides the outcome in four situations:

• the size-independent cases of Article 2(2), points (b) to (e): a sole provider in a member state of a service essential for critical societal or economic activities, an entity whose disruption could have a significant impact on public safety, public security or public health, an entity whose disruption could induce a significant systemic risk, and an entity critical because of its specific importance at national or regional level. Article 3 speaks of entities “identified by a Member State” in these cases;
• public administration entities, whose coverage Article 2(2)(f) ties to definitions in national law and, at regional level, to a risk-based assessment;
• entities identified as critical entities under Directive (EU) 2022/2557 on the resilience of critical entities, which Article 2(3) brings into scope regardless of size;
• former operators of essential services: under Article 3(1)(g), a member state may provide that entities it identified before 16 January 2023 as operators of essential services are essential entities.

Art. 3(4)

Everything else is self-assessment, and Article 3(4) completes the logic. Member states must require entities to submit at least their name, their address and up-to-date contact details including email addresses, IP ranges and telephone numbers, their sector and subsector, and the member states where they provide services. The information travels from the entity to the authority. An organisation that waits to be asked has the direction of travel backwards.

Five structural changes, and how to verify them

Annex III

Annex III of NIS2 is a correlation table. For each provision of NIS1 it gives the corresponding provision of NIS2. Read in reverse, it shows which NIS2 provisions have no NIS1 counterpart at all, which is a reliable way to see what is genuinely new without relying on memory of the old text.

Change	NIS2 provision	What the correlation table shows
Two classes of entity, essential and important, supervised differently	Art. 3; Arts 32 and 33	No NIS1 provision corresponds to Article 3; only a few points of Articles 32 and 33 have NIS1 counterparts
Management bodies approve the measures, oversee them, follow training and can be held liable	Art. 20	No NIS1 provision corresponds to Article 20
A minimum list of ten risk-management measures on an all-hazards basis	Art. 21(2)	NIS1 provisions correspond to Article 21(1) to (4) as a whole, so the table does not single out the list
Staged incident reporting with 24-hour, 72-hour and one-month deadlines	Art. 23(4)	NIS1 provisions correspond to several paragraphs of Article 23, but none to Article 23(4)
Fine maxima expressed both in euros and as a share of worldwide turnover	Art. 34	NIS1's Article 21 corresponds to Article 36 on penalties; nothing corresponds to Article 34

Two further changes complete the picture. First, NIS2 absorbs regimes that used to sit in other acts. Article 42 deletes Article 19 of Regulation (EU) No 910/2014 on trust services, and Article 43 deletes Articles 40 and 41 of Directive (EU) 2018/1972 on electronic communications. Recital 92 explains why: providers in both groups should fall within the scope of NIS2 and take their security and notification duties from it. Second, coverage widened. Recital 6 says the scope “should be extended to a larger part of the economy”, and the correlation table maps nothing from NIS1 onto Annex II points 1 to 5 and 7: postal and courier services, waste management, chemicals, food, manufacturing and research.

What did not change

Art. 46

NIS2 is still a directive, and Article 46 states that it “is addressed to the Member States.” What binds an organisation is the national law that transposes it. The next lesson explains why that single fact should shape how a compliance programme is organised.

Art. 5

NIS2 is also a floor rather than a ceiling. Article 5 allows member states to adopt or maintain provisions ensuring a higher level of cybersecurity, provided they are consistent with Union law. Expect national laws to contain things the directive does not, and check the transposition pages before treating the text of the directive as the whole of your obligation.

Finally, the directive itself does not prescribe technical controls. Article 21 states outcomes. Article 21(5) required the Commission to lay down technical and methodological requirements for a defined list of digital entity types, which it did in Implementing Regulation (EU) 2024/2690, and allows it to do so for other entities. Module 3 covers both texts.

What a supervisor will ask

• How did you conclude that you are in scope, or not? A dated scope assessment naming the Annex entry relied on, the size data used and the person who approved it.
• When did you give us the information Article 3(4) requires, and what has changed since? The submission receipt, and a change log showing that changes were notified within the two weeks Article 3(4) allows.
• Were you identified as an operator of essential services under the previous regime? The old designation, if any, and the national provision that does or does not carry it over under Article 3(1)(g).
• Who approved your measures, and when? The management body decision required by Article 20(1).

Key points

• NIS1 was repealed because its scope, its obligations and their enforcement diverged widely between member states (recital 4).
• NIS2 replaces identification case by case with a uniform criterion, sector plus size (recital 7, Article 2(1)). Most entities are in scope on their own facts.
• Identification by a member state survives for Article 2(2)(b) to (e), public administration, critical entities under Directive (EU) 2022/2557 and, optionally, former operators of essential services.
• Annex III shows what is new: nothing in NIS1 corresponds to Article 20, Article 23(4) or Article 34.
• NIS2 is a minimum-harmonisation directive addressed to member states. National law can add to it.