NIS1 vs NIS2: the key differences, side by side

NIS2 (Directive (EU) 2022/2555) replaced NIS1 (Directive (EU) 2016/1148) on 18 October 2024. The biggest difference is scope. Under NIS1, each Member State picked its “operators of essential services” in 7 sectors. NIS2 applies automatically to medium-sized and larger entities in 18 sectors. It also adds ten minimum security measures, management body liability, a 24-hour first report and minimum fine ceilings.

This guide covers the comparison table, who is covered, what changed in security measures, reporting, management and fines, the timeline, the 2026 amendment proposal, and what a former NIS1 operator should do now.

Topic	NIS1, Directive (EU) 2016/1148	NIS2, Directive (EU) 2022/2555
In force / applied	In force 8 August 2016, applied from 10 May 2018	In force 16 January 2023, applied from 18 October 2024
Who is covered	Operators of essential services identified by each Member State, plus digital service providers	Entities of the types in Annex I and II that are medium-sized or larger, plus some regardless of size
Sectors	7 for operators, plus 3 digital service types	18 (11 in Annex I, 7 in Annex II)
Categories	Operators of essential services, digital service providers	Essential and important entities
Security measures	“Appropriate and proportionate” measures	The same principle, plus ten minimum measures (Article 21(2))
Management	No specific obligation	Management bodies approve, oversee, can be held liable, and must be trained (Article 20)
Incident reporting	“Without undue delay”	Early warning in 24 hours, notification in 72 hours, final report in one month (Article 23)
Supply chain	Not named	An explicit measure (Article 21(2)(d)), plus EU coordinated assessments (Article 22)
Fines	Set by each Member State, no amounts	Maximum of at least €10M or 2% (essential) and €7M or 1.4% (important), whichever is higher (Article 34)
Telecoms and trust services	Outside NIS1 security and notification rules	In scope regardless of size

What is the main difference between NIS1 and NIS2?

How you end up in scope. Under NIS1, a Member State had to identify, by 9 November 2018, the operators of essential services established on its territory. The test was whether an entity provided a service essential for critical societal or economic activities, depended on network and information systems for it, and would suffer significant disruptive effects from an incident. Each country applied that test its own way, so the same type of company could be in scope in one country and out in another.

NIS2 replaced that with a size rule. Article 2(1) applies the directive to entities of a type listed in Annex I or II that qualify as medium-sized enterprises or exceed that size, under the EU SME definition (Recommendation 2003/361/EC). Some entities are in scope regardless of size, including public electronic communications providers, trust service providers, TLD name registries, DNS service providers and domain name registration services. Member States can still add entities on criteria such as being the sole provider of an essential service.

Whether you are essential or important then follows mostly from sector and size, as explained in essential vs important entities. To check your own position, use the NIS2 scope checker.

Which sectors did NIS1 cover, and which does NIS2 cover?

NIS1 had 7 sectors for operators of essential services (Annex II of NIS1): energy (electricity, oil, gas), transport (air, rail, water, road), banking, financial market infrastructures, health care settings, drinking water supply and distribution, and digital infrastructure (internet exchange points, DNS service providers, TLD name registries). Separately, it covered three types of digital service provider (Annex III): online marketplaces, online search engines and cloud computing services.

NIS2 has 18 sectors.

• Annex I, sectors of high criticality (11): energy (now including district heating and cooling, hydrogen and recharging points), transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business-to-business), public administration, and space.
• Annex II, other critical sectors (7): postal and courier services, waste management, chemicals, food, manufacturing (including medical devices, computers and electronics, electrical equipment, machinery, and vehicles), digital providers (online marketplaces, search engines, social networking platforms), and research.

The new arrivals matter most for mid-sized companies that never dealt with NIS1: managed service providers, data centres, manufacturers, food companies and research organisations. Cloud computing services were already covered by NIS1 as digital service providers. If you are a managed service provider, see NIS2 for MSPs and MSSPs.

How did the security requirements change?

NIS1 asked operators of essential services for “appropriate and proportionate technical and organisational measures” having regard to the state of the art (Article 14). For digital service providers it listed five elements to consider, such as incident handling, business continuity and compliance with international standards (Article 16).

NIS2 keeps the proportionality principle but makes three things explicit. The measures follow an all-hazards approach, which covers the physical environment of your systems as well. There are ten minimum measures in Article 21(2), from risk analysis and incident handling to supply chain security, cryptography and multi-factor authentication where appropriate. And for cloud, data centre, DNS, managed service and several other digital providers, Implementing Regulation (EU) 2024/2690 sets detailed technical requirements. The ten measures are explained in NIS2 Article 21.

Supervision changed less than people think. NIS1 already let authorities require operators of essential services to provide documented security policies and security audit results (Article 15), and it supervised digital service providers after the fact (Article 17). NIS2 keeps that split: full supervision for essential entities, supervision after the fact for important entities.

How did incident reporting change?

NIS1 required notification “without undue delay” of incidents with a significant impact on the continuity of an essential service, or a substantial impact for digital service providers. It set no hour count.

NIS2 Article 23 sets a three-stage clock for significant incidents:

1. An early warning within 24 hours of becoming aware of the incident.
2. An incident notification within 72 hours, with an initial assessment of severity and impact.
3. A final report no later than one month after the incident notification.

Trust service providers must send the incident notification within 24 hours. NIS2 also defines what “significant” means: an incident that causes or can cause severe operational disruption or financial loss for the entity, or considerable material or non-material damage to others. The deadlines in practice are covered in the NIS2 incident reporting timeline.

What changed for management and fines?

NIS1 said nothing specific about boards. NIS2 Article 20 requires management bodies to approve the cybersecurity risk-management measures and oversee their implementation, and they can be held liable for the entity’s infringements of Article 21. Members of management bodies must follow training.

NIS1 left penalties entirely to Member States (Article 21 of NIS1), requiring only that they be “effective, proportionate and dissuasive”. NIS2 Article 34 sets minimum maximums for infringements of Article 21 or 23: at least €10,000,000 or 2% of total worldwide annual turnover for essential entities, and €7,000,000 or 1.4% for important entities, whichever is higher. There is no higher tier. National laws can set higher ceilings, and they set the procedure. The detail is in NIS2 enforcement and penalties.

When did NIS2 replace NIS1?

Date	What happened
19 July 2016	NIS1 published in the Official Journal
9 May 2018	Deadline to transpose NIS1, applied from 10 May 2018
27 December 2022	NIS2 published in the Official Journal
16 January 2023	NIS2 entered into force
17 October 2024	Deadline for Member States to adopt NIS2 laws
18 October 2024	NIS2 national laws apply, NIS1 repealed
17 April 2025	Member States’ lists of essential and important entities due

Many Member States were late. On 8 July 2026 the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice for failing to notify their transposition measures. Where a country has not yet adopted its NIS2 law, check with its national authority which rules apply in the meantime. National examples: Germany, Belgium and Luxembourg.

Is NIS2 changing again?

A change has been proposed, not adopted. On 20 January 2026 the Commission proposed targeted amendments to NIS2 (COM(2026) 13). They include a new category of “small mid-cap” enterprises intended to reduce compliance costs, scope adjustments in sectors such as electricity and chemicals, streamlined ransomware data collection, simpler jurisdiction rules, and certification of an entity’s cyber posture as a way to show compliance. The Commission says the package would simplify compliance for about 28,700 companies.

Until the European Parliament and the Council adopt it and Member States transpose it, the current NIS2 text and your national law are what apply.

If you were under NIS1, what should you do now?

You are almost certainly still in scope, so the question is the gap. Five things usually need work:

1. Registration. NIS2 asks every entity in scope to give its authority its name, contacts, IP ranges, sector and the countries where it operates, and to report changes within two weeks. Under NIS1 the authority identified operators; under NIS2 many countries expect entities to register themselves.
2. Management body. Board approval of the measures, oversight on record, and training for its members.
3. Supply chain. A supplier register, security criteria in contracts, and an assessment of each critical direct supplier.
4. Reporting clock. An on-call path that can produce a 24-hour early warning, including at weekends.
5. Evidence. NIS1 compliance was often shown with documents. NIS2 authorities ask for evidence that the measures are implemented.

The last point is where most programmes stall. A policy that says “MFA for all administrative access” is easy to write. Showing that it is true for every administrative account today is not, unless the evidence comes from the systems themselves. That is what the CloudSoul platform collects, with a person reviewing what the data does not settle. The wider NIS2 programme is on the NIS2 compliance page.

NIS1 to NIS2 checklist

• Confirm your NIS2 category, essential or important, under your national law.
• Register with your competent authority, or check that your registration is current.
• Run a gap analysis of your NIS1 measures against the ten Article 21 measures.
• Get management body approval of the measures, on record, and schedule training.
• Build a supplier register and add security clauses to critical contracts.
• Test that you can send a 24-hour early warning.
• Replace documents with evidence where the authority will ask for proof.

Sources

• Directive (EU) 2016/1148 (NIS1), Articles 1, 5, 14 to 17, 21, 25 and 26, Annexes II and III, EUR-Lex.
• Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 20 to 23, 34, 41, 44 and 45, Annexes I and II, EUR-Lex.
• European Commission, NIS2 Directive policy page (infringement referrals of 8 July 2026, January 2026 proposal), Shaping Europe’s digital future.
• European Commission, Cybersecurity package questions and answers, 20 January 2026, Shaping Europe’s digital future.

Frequently asked questions