Become a Member

Regulation TrackerLaws, orders and treaties read for their security duties and clocks Standards & FrameworksAttack taxonomies, control catalogues and frontier frameworks AI Incident DatabaseThe security incident record, with mechanism and lesson Research Paper LibraryThe papers that define the field, summarised OSS DirectoryRed teaming, guardrail, supply chain and evaluation tools Case StudiesProgrammes built, with measured outcomes AI Vulnerability TrackerCVEs and advisories for the components AI systems are built from

Latest in the tracker

New York Stop Addictive Feeds Exploitation (SAFE) for Kids Act and implementing rulesNew York's law restricting algorithmic feeds for minors takes effect on 25 January 2027 under final rules published in July 2026, with certified age assurance and $5,000-per-violation penalties.

Knowledge Base Regulation Tracker Standards & Frameworks OSS Directory AI Incident Database Research Paper Library Case Studies Society Articles News Jobs About Charter Become a Member

Home/Regulation Tracker/Directive (EU) 2022/2555 on measures for a high common level of cybersecurity (NIS2)

Directive (EU) 2022/2555 on measures for a high common level of cybersecurity (NIS2)

The EU cybersecurity baseline for critical sectors, applied since October 2024, whose risk-management and 24-hour incident-reporting duties extend to AI systems used in energy, health, transport, finance and digital infrastructure.

nis2cybersecurityincident reportingcritical infrastructure

At a glance

Acronym: NIS2
Country or region: European Union, European Economic Area
Extraterritorial reach: Yes
Current status: In force
Legally binding: Legally binding
Instrument: Directive requiring transposition
Official text: Read the official text

All details 17

Applies to: Industry: Energy and utilities, Transport and logistics, Banking, Healthcare, Cloud and infrastructure, Telecom, Public sector, Manufacturing
Applies to: Type of AI: Industrial control and critical infrastructure AI, AI platforms, APIs and cloud services, Cybersecurity AI
Who must comply: All organisations, Boards and executives
Proposed: 16 Dec 2020
Effective: 16 Jan 2023
Compliance deadline: 17 Oct 2024
Company-size thresholds: Medium and large entities in listed sectors (50+ staff or €10 million turnover), plus some regardless of size
Enforced by: National competent authorities and CSIRTs; ENISA coordination
Penalty type: Administrative fine, Revenue-based fine, Injunction or order
Penalties: Essential entities: up to €10 million or 2% of worldwide turnover; important entities: up to €7 million or 1.4%; management liability and temporary bans on managers.

Required actions

Adopt risk-management measures covering supply chain, incident handling, business continuity and cryptography, including for AI systems in essential services - Report significant incidents: early warning within 24 hours, notification within 72 hours, final report within one month - Management bodies must approve and oversee measures and can be held personally liable

Sources

eur-lex.europa.euhttps://eur-lex.europa.eu/eli/dir/2022/2555/oj

Contribute

Spot an error, or know a record we should add? Members can propose additions and submit corrections.

Add regulation Report a correction or request removal

Directive (EU) 2022/2555 on measures for a high common level of cybersecurity (NIS2)

Required actions

Sources

Contribute

Related in Regulation Tracker

Regulation (EU) 2023/1230 on machinery — safety of AI-driven and self-evolving machinery

Regulation (EU) 2026/1744 amending the AI Act (Digital Omnibus on AI)

Regulation (EU) 2023/988 on general product safety (GPSR)