NIS2 Directive

NIS2 Directive — EU Cybersecurity Rules for Essential and Important Entities

The NIS2 Directive (Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union) is the European Union’s most comprehensive and far-reaching cybersecurity law to date. Adopted in December 2022 and transposed into national law by 17 October 2024, NIS2 replaced the 2016 NIS Directive with dramatically expanded scope, significantly stricter obligations, and — for the first time in EU history — liability of management bodies, which must approve and oversee their organization’s cybersecurity measures.

NIS2 operates on the organisation side of the EU cybersecurity framework: it mandates how companies must manage their own cybersecurity. Its counterpart, the EU Cyber Resilience Act (CRA), operates on the product side — mandating how products must be built. Together, they form the backbone of the EU’s 2030 cybersecurity strategy.

Key Facts

What Changed from NIS to NIS2?

NIS2 is not a minor update — it fundamentally restructured the EU’s approach to organizational cybersecurity:

Who Must Comply? The Entity Classification

NIS2 uses a size-based approach combined with sector classification, moving away from the designation model of the original NIS Directive. This means the vast majority of medium and large organisations in covered sectors must comply — without waiting to be individually designated by national authorities.

Annex I — Sectors of High Criticality

Large entities in these sectors are essential entities and face ex ante and ex post supervision — authorities can audit and inspect without waiting for an incident. Medium-sized entities in these sectors are important entities (Article 3):

Eleven sectors:

1. Energy (electricity generation, distribution, transmission; oil; gas; hydrogen; district heating/cooling)
2. Transport (air, rail, water, road — including operators, infrastructure managers)
3. Banking (credit institutions)
4. Financial market infrastructures (trading venues, central counterparties)
5. Health (hospitals, healthcare providers, reference labs, pharmaceutical manufacturers, medical device manufacturers covered by critical device categories)
6. Drinking water (suppliers and distributors)
7. Wastewater (collection, disposal, treatment)
8. Digital infrastructure (IXPs, DNS providers, TLD registries, cloud computing, data centres, CDN providers, trust service providers, electronic communication networks)
9. ICT service management (B2B managed service providers, managed security service providers)
10. Public administration (central government bodies)
11. Space (operators of ground-based infrastructure supporting space-based services)

Annex II — Other Critical Sectors

Medium-sized and larger entities in these sectors are important entities and face ex post supervision — authorities act on evidence or indications of non-compliance:

Seven sectors:

1. Postal and courier services
2. Waste management
3. Chemical manufacturing, production, and distribution
4. Food production, processing, and distribution
5. Manufacturing of medical devices, electronic/electrical equipment, machinery, motor vehicles, other transport equipment
6. Digital providers (online marketplaces, online search engines, social networking platforms)
7. Research organizations (public and private)

Critical for hardware manufacturers: Electronics manufacturers and medical device manufacturers fall into the Important Entities category. A medium or large electronics or IoT hardware manufacturer supplying to sectors covered by NIS2 must assess whether they are directly in scope — and if they supply to Essential Entities, they face significant supply chain security requirements imposed by their customers.

Core Requirements: What NIS2 Demands

1. Risk Management Measures (Article 21)

NIS2 mandates a minimum baseline of cybersecurity risk management measures that all covered entities must implement. These are not optional — they are legal minimums:

Technical and organisational measures:

The measures must be proportionate to the entity’s size, risk exposure, and the cost of implementation relative to the risk — but proportionality does not excuse non-compliance with the listed minimum measures.

2. Incident Reporting (Article 23)

NIS2 tightens incident reporting with a staged obligation:

A significant incident is one that:

• Has caused or could cause severe operational disruption or financial loss to the entity, or
• Has affected or could affect other natural or legal persons by causing considerable material or non-material damage.

Special provisions for ICT service providers and trust service providers may shorten reporting windows further.

3. Supply Chain Security (Article 21(2)(d))

NIS2 makes supply chain security a first-class legal obligation for covered entities:

• Entities must assess the cybersecurity practices of direct suppliers and service providers.
• Contracts with suppliers must include cybersecurity clauses specifying required security standards.
• Entities must conduct periodic supplier security risk assessments.
• ENISA and national authorities may issue guidance or requirements on specific supplier categories.

For hardware manufacturers: If your customers include Essential or Important entities under NIS2, they are now legally required to assess your cybersecurity posture as part of their supply chain security obligations. This creates strong market demand for hardware manufacturers to demonstrate auditable security practices — SBOM documentation, vulnerability management programs, and secure development lifecycle evidence. Companies that can provide this evidence as a standard deliverable will have a significant competitive advantage.

4. Management Accountability (Article 20)

NIS2 introduces the most significant governance requirement in EU cybersecurity law history: accountability and liability of management bodies:

• Management bodies (boards of directors, executive officers) must approve the cybersecurity risk management measures.
• Management bodies must oversee implementation.
• Management body members must undergo cybersecurity training to gain sufficient knowledge to assess cybersecurity risks.
• Where these duties are infringed, national law and authorities can:
  • Hold members of management bodies liable, as provided for in national law
  • For essential entities, as a last resort, request a temporary ban on a person from exercising managerial functions (Article 32(5))

This is a fundamental shift: cybersecurity is no longer purely an IT department responsibility. It is now a board-level legal obligation, and management bodies can be held liable for infringements.

NIS2 and Hardware Manufacturers: The Supply Chain Effect

Even if a hardware manufacturer is not directly in scope of NIS2 (e.g., a small company below the size thresholds), NIS2 creates significant market-driven requirements through the supply chain:

Customer-Driven Security Requirements

NIS2-regulated customers are legally required to assess supplier cybersecurity. This means hardware manufacturers will increasingly face:

• Security questionnaires and audits from major customers
• Contractual cybersecurity requirements in supply agreements
• Requirements to provide SBOMs, vulnerability disclosure policies, and security certifications
• Potential loss of contracts if they cannot demonstrate adequate security posture

Harmonised Demand Signal

As NIS2 is harmonised across all 27 EU member states, these requirements apply uniformly — a hardware manufacturer supplying across the EU faces consistent requirements regardless of which country their customer is in.

Medical Device and Electronics Manufacturers

Large manufacturers of medical devices and electronics are directly classified as Important Entities under NIS2. For these companies, compliance is not optional — they are directly regulated.

NIS2 vs. CRA — Different but Complementary

The two most important EU cybersecurity regulations address different dimensions of the same problem:

NIS2 secures organisations. CRA secures the products those organisations build and sell. A company that manufactures connected hardware is simultaneously subject to NIS2 (how it runs its own security) and the CRA (how it designs its products).

Enforcement and Penalties

NIS2 establishes a harmonised enforcement framework across all member states for the first time:

Essential Entities

• Maximum fine set by national law at at least €10,000,000 or 2% of worldwide annual turnover — whichever is higher
• Ex ante and ex post supervision: authorities can audit without an incident trigger

Important Entities

• Maximum fine set by national law at at least €7,000,000 or 1.4% of worldwide annual turnover — whichever is higher
• Ex post supervision: authorities act on evidence or indications of non-compliance

Management Liability and Other Measures

• Liability of members of management bodies, as provided for in national law
• Order to make aspects of the infringement public in a specified manner (Articles 32(4)(h) and 33(4)(g))
• For essential entities, as a last resort: temporary ban from exercising managerial functions (Article 32(5))

Timeline and Current Status

Related Terms

• CRA — The product-focused counterpart to NIS2; hardware manufacturers must comply with both.
• NIS2 — Short-form glossary overview of NIS2.
• ENISA — EU Agency for Cybersecurity, supporting NIS2 implementation and cooperation between member states.
• SBOM — Software Bill of Materials; increasingly required as evidence of supply chain security under NIS2.
• Post-Market Surveillance — Overlaps with NIS2 Article 21 continuous monitoring obligations.
• IoT — Connected IoT devices in supply chains of NIS2-regulated entities face growing security scrutiny.

Hardware manufacturers supplying to NIS2-regulated entities face growing pressure to demonstrate auditable cybersecurity practices. Inovasense helps manufacturers establish the security program evidence that NIS2-regulated customers require: vulnerability management processes, SBOM generation, secure development lifecycle documentation, and embedded security implementations that provide technically verifiable evidence of security measures. Our EU compliance consulting covers the full picture — NIS2 supply chain obligations alongside CRA product requirements.

Official References

• Directive (EU) 2022/2555 (NIS2) — Full text — EUR-Lex, Official Journal of the European Union