Overview of the NIS2 Directive
The NIS2 Directive, formally Directive (EU) 2022/2555, is an update to the EU’s cybersecurity framework, replacing the original NIS Directive (NIS1) to strengthen protections for digital and critical infrastructure across member states. Its primary objective is to enhance the resilience of essential sectors against cyber threats by introducing stricter risk management requirements, supply chain security obligations, and mandatory incident reporting within 24 hours of detection. Unlike its predecessor, NIS2 expands the scope of regulated entities to include AI providers and operators whose services rely on AI systems, recognizing the growing dependency on artificial intelligence in critical infrastructure.
The directive was adopted on January 16, 2023, and required member states to transpose its provisions into national law by October 17, 2024. The earlier NIS Directive was officially repealed on October 18, 2024, marking a complete transition to the new regulatory framework. However, as of the directive’s enforcement date, only 23 of the 27 EU member states had fully implemented the necessary measures, leading to inconsistencies in cybersecurity standards and enforcement practices across the bloc.
Key Requirements and Scope
NIS2 introduces several mandatory obligations for entities operating within its scope, including AI providers and operators dependent on AI systems. Essential entities face stricter compliance requirements, including regular risk assessments, supply chain security measures, and the implementation of incident response plans.
One of the most significant changes under NIS2 is the introduction of a 24-hour deadline for reporting significant cybersecurity incidents to national competent authorities.
The directive also broadens the sectors covered under its provisions. AI providers, in particular, are now subject to these rules if their systems are deemed essential to the functioning of these sectors.
Implementation Challenges and Fragmentation
Despite the directive’s comprehensive framework, its implementation has faced significant challenges, particularly in ensuring uniform adoption across member states. As of April 2026, only 23 EU member states had fully transposed NIS2 into national law, with Spain being a notable exception that had not yet implemented the directive. This fragmentation has resulted in varying standards for incident reporting, risk management, and enforcement, undermining the directive’s goal of creating a cohesive cybersecurity ecosystem within the EU.
Among the member states that have implemented NIS2, approaches to transposition differ markedly. For example, the Czech Republic enacted Act No. 264/2025 Coll., known as the Cybersecurity Law, alongside five additional implementing regulations, which came into force on November 1, 2025. Germany adopted the Gesetz zur Umsetzung der NIS-2-Richtlinie, focusing on both private sector compliance and the establishment of baseline security requirements for federal administration. Ireland introduced the National Cyber Security Bill, while the Netherlands implemented the Cyberbeveiligingswet (Cbw). Slovakia amended its existing cybersecurity law (Act No. 69/2018 Coll.) to align with NIS2, with the updated legislation taking effect on November 1, 2025. Sweden, meanwhile, introduced the Cybersäkerhetslag (2025:1506) to meet the directive’s requirements.
The European Free Trade Association (EFTA) countries have also taken varied approaches. As of April 2026, only Liechtenstein had fully transposed NIS2 into its national legislation. Other EFTA members, including Norway, Iceland, and Switzerland, were in the process of aligning their laws with the directive, with the EFTA Commission coordinating these efforts. The lack of full implementation in some member states has created disparities in cybersecurity capabilities, complicating cross-border incident response and cooperation.
AI Providers and Operators Under NIS2
NIS2 explicitly includes AI providers and operators whose services are dependent on AI systems within its regulatory scope. AI providers are now required to conduct regular risk assessments, implement supply chain security measures, and ensure their systems comply with EU cybersecurity standards. Operators using AI systems must also adhere to these requirements if their services fall under the directive’s categories of essential or important entities.
For instance, an AI system managing critical energy grids or financial transactions would be subject to NIS2’s incident reporting and risk management obligations, ensuring that any cybersecurity incident is addressed promptly and transparently.
NIS2 requires entities to map their AI dependencies, including cloud services, open-source components, and external data providers, to identify potential vulnerabilities.
Enforcement and Future Outlook
While the directive establishes minimum requirements, member states retain the flexibility to introduce stricter measures if necessary. However, the lack of uniform implementation has led to inconsistencies in enforcement, with some states adopting more rigorous oversight than others.
Looking ahead, the success of NIS2 will depend on the EU’s ability to address implementation gaps and foster greater cooperation among member states. Additionally, ongoing research, such as the study Digital Sovereignty in Practice: Analyzing the EU’s NIS2 Directive published in the International Journal of Information Security (2025), highlights the importance of balancing regulatory requirements with practical feasibility for entities operating in highly technical sectors like AI.
For AI providers and operators, compliance with NIS2 will require investment in cybersecurity infrastructure, employee training, and continuous monitoring of AI systems. The directive’s emphasis on supply chain security and incident reporting underscores the need for proactive risk management, particularly as AI systems become more integrated into critical infrastructure.
Key dates
- 16 Jan 2023Entry into force
- 17 Oct 2024Transposition deadline for member states
- 18 Oct 2024Repeal of the NIS Directive