NIS2 Directive
The EU's landmark cybersecurity directive requiring essential and important entities across 18 sectors to implement risk management, incident reporting, and supply chain security measures -- with board-level accountability and fines up to EUR 10 million or 2% of global turnover.
The NIS2 Directive is an EU law that forces companies running critical services -- from hospitals and power grids to cloud providers and food distributors -- to take cybersecurity seriously. If your organisation has more than 50 employees or turns over more than EUR 10 million and operates in one of 18 listed sectors, this law almost certainly applies to you.
Before NIS2, each EU country could decide for itself which companies had to follow cybersecurity rules, and enforcement was inconsistent. NIS2 replaces that patchwork with a single set of obligations that apply across all 27 member states: you must manage cyber risks, report serious incidents quickly, and secure your supply chain. The directive also makes company boards personally responsible for ensuring these measures are in place.
Most member states have now written NIS2 into their own national laws, meaning the obligations are legally binding and enforceable today. The penalties are significant -- up to EUR 10 million or 2% of worldwide revenue for the most critical organisations. Supervisory authorities are already conducting compliance assessments in countries that transposed early.
In short: if your company keeps essential services running or handles sensitive digital infrastructure, NIS2 sets the baseline for how you must protect it -- and your board is on the hook if you do not.
Switzerland is not an EU member state and is not required to transpose NIS2 into national law. However, Swiss companies that provide services to customers in the EU, operate subsidiaries in EU member states, or form part of the supply chain of an EU-regulated entity may fall within NIS2's scope indirectly. EU-based clients will increasingly require contractual cybersecurity commitments aligned with NIS2 from their Swiss suppliers.
Switzerland's own cybersecurity framework -- anchored in the revised Information Security Act (ISG) and the National Cyber Strategy 2025 -- covers some of the same ground but does not match NIS2's incident reporting timelines or its sector-specific scope thresholds. Swiss organisations serving EU markets should conduct a gap analysis between their current posture and NIS2 requirements, particularly around the 24-hour early warning obligation and supply chain due diligence.
The deadline was 17 October 2024. As of April 2026, 24 of 27 member states have transposed NIS2 into national law. The European Commission sent reasoned opinions to lagging states in May 2025, accelerating adoption through 2025.
NIS2 replaces the NIS1 distinction between "operators of essential services" and "digital service providers" with a new two-tier system based on sector criticality and organisation size.
NIS2 introduces the most demanding incident reporting requirements in EU law. The clock starts the moment a significant incident is detected.
Select your company type for tailored compliance guidance.