1What is it?
NIS2 (Network and Information Security Directive 2) is a sweeping EU cybersecurity law that entered into force in January 2023 and which EU member states had to transpose into national law by October 2024. It forces thousands of organisations — from hospitals and water utilities to cloud providers and food manufacturers — to meet strict cybersecurity standards or face heavy fines. Concretely, it requires risk management measures, incident reporting within tight deadlines (24 hours for initial alert, 72 hours for full report), supply-chain security checks, and personal liability for top executives. It dramatically expands the scope of its predecessor NIS1, bringing an estimated 160,000 new entities under mandatory regulation across Europe.
2What is it officially for?
The official objective is to raise the overall level of cybersecurity across the EU by ensuring critical and important sectors are resilient against cyberattacks, which have multiplied in frequency and severity. The European Commission presents NIS2 as a response to the fragmentation exposed by NIS1, where member states applied rules inconsistently, leaving dangerous gaps. It aims to harmonise national cybersecurity capacities, strengthen cross-border cooperation via ENISA (the EU cybersecurity agency) and the NIS Cooperation Group, and ensure faster, more coordinated responses to major incidents. Civil society and digital rights groups broadly support the security goals but warn that the directive's compliance burden is enormous for smaller entities, and that 'security' mandates can become vectors for surveillance infrastructure if poorly overseen.
3What it can change for citizens
For citizens, NIS2 is mostly invisible but consequential: it is designed to protect the hospitals, energy grids, water systems and digital platforms they depend on daily from paralysing cyberattacks. When it works well, citizens experience fewer ransomware-caused hospital shutdowns, fewer data breaches exposing personal health or financial records, and more resilient public services. However, critics raise legitimate concerns: the directive can push organisations toward centralised, auditable IT architectures that make mass surveillance technically easier; incident reporting obligations could normalise large-scale data sharing with governments and intelligence-adjacent bodies; and fines of up to €10 million or 2% of global turnover could accelerate market consolidation, squeezing out smaller, more privacy-respecting providers. Citizens have no direct rights or redress mechanisms under NIS2 — it regulates organisations, not individual rights.