A directive, not a regulation
In this lesson
- Explain what it means that NIS2 is addressed to member states, and where an organisation's obligations actually come from.
- Separate what the directive fixes as a common floor from what it leaves, or expressly hands, to national law.
- Recognise the directly applicable regulations that sit beside NIS2: Implementing Regulation (EU) 2024/2690 and, for financial entities, Regulation (EU) 2022/2554.
- Organise a compliance programme so that the common part is built once and the national part has an owner in each country.
Two kinds of Union law
A regulation applies as it is written, in every member state, without any national act in between. Commission Implementing Regulation (EU) 2024/2690, which you will meet in modules 3 and 4, says so of itself in its final article: it “shall be binding in its entirety and directly applicable in all Member States.” An entity covered by it reads the same sentence in every capital.
A directive works differently. Article 46 of NIS2 states that the directive “is addressed to the Member States”, and Article 41(1) sets their task: “By 17 October 2024, Member States shall adopt and publish the measures necessary to comply with this Directive.” They had to apply those measures from 18 October 2024. Article 41(2) adds that the national measures must contain a reference to the directive or be accompanied by one when officially published, which is how you find your national law: it cites Directive (EU) 2022/2555.
The grammar of the directive shows the same structure. Its obligations on entities almost never begin with the entity. Article 21(1) begins “Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational and organisational measures”. Article 23(1) begins “Each Member State shall ensure that essential and important entities notify”. Article 20(1) begins “Member States shall ensure that the management bodies”. The duty that binds your organisation is the national provision that gives effect to each of those sentences.
A common floor, not a common text
Article 5 is headed “Minimum harmonisation” and reads: “This Directive shall not preclude Member States from adopting or maintaining provisions ensuring a higher level of cybersecurity, provided that such provisions are consistent with Member States’ obligations laid down in Union law.” So the right word for the directive's core is uniform minimum, not identical rule. The table sets out what the directive fixes for everyone and where national law can still move.
| Element | Fixed by the directive | Where national law can still move |
|---|---|---|
| Scope | The Annex I and II sectors and the size-cap rule (Art. 2(1)); size-independent categories (Art. 2(2) to (4)) | May extend to public administration at local level and to education institutions (Art. 2(5)); identifies entities under Art. 2(2)(b) to (e); may exempt certain national-security-related activities (Art. 2(8)) |
| Classes | Essential and important entities (Art. 3(1) and (2)) | May treat former operators of essential services as essential (Art. 3(1)(g)) |
| Risk-management measures | Ten measures that the national measures must include “at least” (Art. 21(2)) | May add to them (Art. 5); may require certified ICT products, services or processes (Art. 24(1)) |
| Incident reporting | The reporting stages, their content and their deadlines (Art. 23(4)) | Whether reports go to the CSIRT or to the competent authority, and through which channel (Art. 23(1)) |
| Management bodies | Approve, oversee, can be held liable, members follow training (Art. 20) | Who the management body is; liability rules for public institutions (Art. 20(1), second subparagraph) |
| Supervision and enforcement | A minimum list of powers (“at least”, Arts 32 and 33) | Risk-based prioritisation (Art. 31(2)); periodic penalty payments (Art. 34(6)); fines on public administration (Art. 34(7)); penalty rules (Art. 36) |
| Fines | Maxima of “at least” EUR 10 000 000 or 2 % (essential) and EUR 7 000 000 or 1,4 % (important) of the worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs, whichever is higher (Art. 34(4) and (5)) | Higher maxima, since the directive sets a floor for the national maximum |
The last row is the one most often misread. Article 34(4) requires member states to provide for fines “of a maximum of at least EUR 10 000 000 or of a maximum of at least 2 % of the total worldwide annual turnover in the preceding financial year of the undertaking to which the essential entity belongs, whichever is higher”. That is the lowest maximum a national law may set, not the only possible one. Module 5 comes back to it.
What is left to the member state entirely
Several things that matter on a working day are not in the directive at all, because the directive tells member states to create them:
- The authorities. Each member state designates or establishes one or more competent authorities and a single point of contact (Article 8) and one or more CSIRTs (Article 10). Their names, portals and procedures are national.
- Registration. Article 3(4) lets member states “establish national mechanisms for entities to register themselves”. The form, the portal and the deadline for entities are national.
- The reporting channel. Article 23(1) sends notifications to the CSIRT “or, where applicable,” the competent authority. Which one, and how, is national.
- The management body. Article 6 defines dozens of terms, but management bodies are not among them. Which corporate organ approves the measures follows national company law.
- Penalties beyond Article 34. Article 36 requires member states to lay down rules on penalties for infringements of the national measures, and recital 131 accepts that they may include criminal penalties.
None of these can be answered from the directive. The transposition pages track them country by country, and a lesson that hard-coded them would be out of date the day a national law changed.
Two regulations that sit beside NIS2
Implementing Regulation (EU) 2024/2690 applies to DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, providers of online marketplaces, of online search engines and of social networking services platforms, and trust service providers. For them it lays down the technical and methodological requirements of the Article 21(2) measures and specifies when an incident is significant. For those entity types, a large part of how the measures are implemented is set by uniform Union text, not national law.
Article 4 provides that where a sector-specific Union act requires risk-management measures or incident notification that are at least equivalent in effect, the relevant provisions of NIS2, including supervision and enforcement, do not apply to the entities it covers. Recital 28 names Regulation (EU) 2022/2554 on digital operational resilience for the financial sector as such an act for financial entities: member states “should therefore not apply the provisions of this Directive on cybersecurity risk-management and reporting obligations, and supervision and enforcement, to financial entities covered by Regulation (EU) 2022/2554.” Two limits matter. The carve-out concerns the relevant provisions, not the directive as a whole. And under the last sentence of Article 4(1), entities in the same sector that the sector-specific act does not cover stay under NIS2.
Organising the work accordingly
Jurisdiction decides which national law applies. Under Article 26(1), an entity falls under the jurisdiction of the member state in which it is established, with three exceptions: providers of public electronic communications networks or services fall under each member state where they provide their services; listed digital providers fall under the member state of their main establishment in the Union; and public administration entities fall under the member state that established them. Article 26(3) adds that a listed digital provider not established in the Union but offering services in it must designate a representative established in one of the member states where it offers services, and falls under the jurisdiction of that member state. A group with in-scope subsidiaries in several countries therefore deals with several national laws, one per subsidiary.
The practical design that follows is simple to state. Build the security programme once, against the common floor: the ten measures of Article 21(2), the reporting chain of Article 23(4) and the governance of Article 20. Then keep, for each member state, a short national file with a named owner: the national provision that carries each measure, any national addition, the registration mechanism, the reporting channel, the supervisor and the penalty rules. One control set and several mapping tables is cheaper to run, and easier to defend, than several parallel programmes that drift apart.
What a supervisor will ask
- Which national provisions apply to you? The national file: the law that transposes the directive, the article carrying the risk-management measures and any national additions.
- How do your measures cover our national requirements, not just the directive? The mapping table from the national article to your controls, kept current.
- Which entity in your group is under our jurisdiction, and why? The Article 26 analysis: establishment, or main establishment for the listed digital providers.
- If you are a financial entity, which obligations do you consider displaced? The Article 4 analysis, provision by provision.
Key points
- NIS2 is addressed to member states (Article 46). Your obligations come from the national measures adopted under Article 41.
- The directive is a floor (Article 5): uniform minimum content, not identical national text. Even for fines, Article 34 sets a floor for the national maximum.
- Authorities, registration, reporting channel, the identity of the management body and penalty rules are national. Check the transposition pages.
- Implementing Regulation (EU) 2024/2690 is directly applicable to the listed digital entity types. Regulation (EU) 2022/2554 displaces the relevant NIS2 provisions for the financial entities it covers.
- Build one programme against the directive and keep one national file per jurisdiction.