NIS2 from 2026: These obligations are coming for SMEs.

Who is affected by NIS2?

NIS2 distinguishes between ‘essential’ and ‘important’ entities. The relevant factors are the sector and the size of the company. As a rule of thumb, medium-sized companies with at least 50 employees or annual turnover exceeding €10 million that operate in one of the covered sectors generally fall within its scope.

The covered sectors include:

- Energy, transport, banking and financial market infrastructure

- Healthcare, drinking water and wastewater

- Digital infrastructure, IT service providers and data centres

- Manufacturing (including machinery, vehicles and medical devices)

- Postal and courier services, waste management, chemicals and food

Important: even companies not directly subject to NIS2 may face obligations through the supply chain. Affected companies must assess the security of their suppliers and pass the corresponding requirements on.

The key obligations under Art. 21

Article 21 is at the heart of NIS2: affected entities must take ‘appropriate and proportionate technical, operational and organisational measures’ to manage risks to their network and information systems. Specifically, the Directive requires measures including:

- Policies on risk analysis and information system security

- Procedures for handling security incidents (incident response)

- Business continuity, backup management and crisis management

- Supply-chain and service-provider security

- Security in the acquisition, development and maintenance of systems, plus vulnerability management

- Procedures for assessing the effectiveness of measures

- Training, cyber hygiene and the use of cryptography and encryption

- Access control, asset management and multi-factor authentication

The risk-based approach is crucial: measures must match the company's actual risk. An off-the-shelf standard package will generally not meet the requirements.

Reporting and registration obligations

NIS2 introduces tight reporting deadlines for significant security incidents. They are staggered:

- Within 24 hours: an initial early warning to the competent authority or CSIRT;

- Within 72 hours: a more complete incident notification with an initial assessment;

- Within one month: a final report covering causes, measures and impact.

There is also a registration obligation: affected entities must register with the competent national body and keep their contact details up to date. Ignoring these obligations risks sanctions, regardless of whether an incident has occurred.

Management liability

One of the most important changes is that NIS2 expressly holds management accountable. Management must approve the risk-management measures, oversee their implementation and may be held personally responsible for infringements. Regular training for management bodies is also required.

The fines are substantial: essential entities face up to €10 million or 2% of worldwide annual turnover, while important entities face up to €7 million or 1.4%. There may also be reputational damage and, in serious cases, personal consequences for those responsible.

What you should do now

Although national implementation varies from country to country, there is no reason to wait. These steps will move you forward regardless of the exact effective date:

- Clarify applicability: use your sector and company size to determine whether and how NIS2 applies to you.

- Assess the current state: a gap analysis shows which Art. 21 measures are already in place and where gaps remain.

- Create a roadmap: prioritise measures by risk and effort instead of tackling everything at once.

- Establish processes: incident response, reporting channels and backup strategies must be documented and rehearsed.

- Involve management: obtain the necessary management decisions and training.

Conclusion

NIS2 is not a bureaucratic nuisance, but a justified response to a real threat. For SMEs, the key is to start early, proceed methodically and implement security technically rather than merely documenting it. Starting early spreads the workload, avoids costly last-minute projects and ensures the company can act effectively when an incident occurs.