NIS2 Directive Transposition Deadline Passes as Commission Adopts Implementing Rules

On the same day, the Commission adopted the first implementing rules under the Directive. The implementing regulation details cybersecurity risk management measures and sets out when an incident should be considered significant and reported to national authorities by companies providing digital infrastructure and services.

Who the implementing rules cover

The implementing regulation applies to specific categories of digital service providers, including cloud computing service providers, data centre service providers, online marketplaces, online search engines and social networking platforms. For each category, it specifies when an incident counts as significant. It will be published in the Official Journal and enter into force 20 days later.

What NIS2 requires

NIS2 covers entities in sectors that are critical for the economy and society, including providers of public electronic communications services, ICT service management, digital services, wastewater and waste management, space, health, energy, transport, manufacturing of critical products, postal and courier services and public administration.

The Directive strengthens security requirements, addresses the security of supply chains and supplier relationships, streamlines reporting obligations and introduces more stringent supervisory measures and stricter enforcement, with the aim of harmonising sanctions regimes across Member States. It also seeks to increase information sharing and cooperation on cyber crisis management.

Background

The first EU-wide cybersecurity law, the NIS Directive, came into force in 2016. The Commission proposed its revision in December 2020 as part of a new EU Cybersecurity Strategy, and NIS2 entered into force in January 2023.

What it means for businesses

Organisations in the covered sectors should check how their Member State has transposed the Directive, including registration, risk management and incident reporting duties, and whether national legislation is in place. Digital infrastructure providers should also review the thresholds for significant incidents in the new implementing regulation.

Sources

• European Commission: New rules to boost cybersecurity of EU's critical entities and networks
• European Commission: New EU Cybersecurity Strategy and new rules to make physical and digital critical entities more resilient