What is NIS2 and when did it come into force?

Directive EU 2022/2555 (NIS2) was adopted on 14 December 2022, replacing the original NIS1 Directive (2016/1148). NIS2 substantially expanded the scope of regulated sectors, introduced stricter obligations, and created clearer liability for senior management. Member states were required to transpose NIS2 into national law by 17 October 2024.

Which sectors are covered?

NIS2 uses two annexes to define scope. Annex I covers sectors of high criticality, where large operators are classified as Essential Entities: Energy (electricity, district heating, oil, gas, hydrogen), Transport (air, rail, water, road), Banking, Financial market infrastructure, Health, Drinking water, Wastewater, Digital infrastructure (IXPs, DNS, TLD registries, cloud computing, data centres, CDNs, trust services, electronic communications), ICT service management (managed services, managed security services), Space, and Public administration.

If my organisation was regulated under NIS1, does it automatically become an Essential Entity under NIS2?

Not automatically. Former Operators of Essential Services (OES) under NIS1 are a strong candidate for Essential Entity designation, and many member states have designated them as such by default. However, the final classification depends on the size thresholds and sector definitions in NIS2 plus any additional designations by the national competent authority. You should proactively verify your classification with CCN-CERT (Spain) or your relevant sectoral authority (UK).

What is the deadline to comply with Art. 21 NIS2 risk management measures?

The obligation to implement Art. 21 measures applied from the date of national transposition — 17 October 2024 in member states that transposed on time, and in Spain from the entry into force of RDL 3/2025 in March 2025. There is no formal grace period. National authorities have discretion over enforcement timelines, but organisations that have not begun implementing Art. 21 measures are already in breach. Immediate action is required.

Can a CEO be held personally liable for a NIS2 cybersecurity breach?

Yes. Art. 20 NIS2 explicitly provides that the governing bodies of Essential and Important Entities can be held personally liable for compliance failures. This includes CEOs and board members. Member states may go further: some (including Germany and the Netherlands) have implemented provisions allowing national authorities to temporarily ban specific management individuals from exercising managerial functions in entities that are repeat or serious NIS2 offenders.

Does NIS2 apply to non-EU companies serving EU customers?

NIS2 has extraterritorial reach in limited circumstances. Non-EU digital service providers (online marketplaces, search engines, social networks, cloud providers, managed service providers) that offer services within the EU and meet the size thresholds must comply with NIS2 and must designate an EU representative. They must register with the competent authority in the member state where their EU representative is established. Non-EU entities in non-digital sectors are generally not directly caught by NIS2.

What is the difference between NIS2 compliance in Spain (RDL 3/2025) and in the UK?

Spain's RDL 3/2025 transposes NIS2 directly, applying the EE/IE classification, Art. 21 measures, Art. 20 management liability and Art. 23 incident reporting. The UK's NIS Regulations 2018 (as amended) predate NIS2 and follow the NIS1 model — they cover operators of essential services and relevant digital service providers but do not use the EE/IE two-tier structure. The UK Government has consulted on expanding the NIS Regulations to bring them closer to NIS2 standards, but as of July 2026 no equivalent legislation has been enacted. UK organisations with EU operations must comply with both regimes.

How does IgeraRegTech help organisations manage NIS2 ongoing compliance?

IgeraRegTech provides a continuously updated regulatory intelligence layer that maps your organisation's profile against NIS2 requirements, tracks changes in national transpositions and ENISA guidance, and generates evidence documentation for Art. 21 measures. When regulatory text changes — such as a national implementing act or new ENISA guidelines — IgeraRegTech automatically flags the impact on your compliance posture and updates your obligation register. Compliance officers receive deadline alerts for incident reporting windows and registration renewals, removing the risk of procedural breaches.

RegTech

NIS2 Entidades Esenciales vs Importantes: Lo Que Tu Organización Debe Saber (2026)

Gerard Maymó

14 de junio de 2026

8 min read

Compliance officer reviewing NIS2 essential entity obligations on screen

#NIS2 essential entities#NIS2 important entities#NIS2 compliance 2026#NIS2 Spain RDL 3/2025#NIS2 cybersecurity obligations

Comparte el conocimiento con tu red

Productos relacionados

IgeraRegTech

Explora esta solución relacionada con el contenido que acabas de leer

NIS2 Entidades Esenciales vs Importantes: Lo Que Tu Organización Debe Saber (2026)

COMPARTIR

Productos relacionados

IgeraRegTech

Artículos relacionados

NIS2: guía para entidades esenciales e importantes — qué exige la directiva en 2026

Alternativas a Wolters Kluwer Compliance 2026: RAG con IA vs Herramientas Tradicionales

Plazos de Reporte DORA 2026: Guía Completa para Entidades Financieras