NIS2 and UK Businesses: Does the Directive Apply to You?

NIS2 is the EU’s main cyber security law for organisations, and it does not apply in the UK itself. A UK company comes into scope only through an EU establishment in a covered sector, by offering certain digital infrastructure and managed services in the EU (in which case it must appoint an EU representative), or by providing public telecoms services in a member state. Having EU customers is not enough on its own, but NIS2 often reaches UK suppliers through their customers’ contracts.

This guide is based on Directive (EU) 2022/2555. It is not legal advice: NIS2 is a directive, so the detailed rules come from each member state’s national law.

What is NIS2?

NIS2 (sometimes written NIS 2) is Directive (EU) 2022/2555, the NIS2 directive on measures for a high common level of cyber security across the Union. It replaced the 2016 NIS Directive and widened its reach from a limited set of operators to most medium and large organisations in 18 sectors. It entered into force on 16 January 2023, and member states had to transpose it by 17 October 2024 and apply it from 18 October 2024. Many missed that deadline and the European Commission opened infringement proceedings, so national laws arrived at different times.

NIS2 does three things: it sets minimum cyber security risk-management measures, imposes incident reporting deadlines and makes management bodies accountable, with supervision and fines behind them. For cloud, data centre, managed service and other digital providers, Implementing Regulation (EU) 2024/2690 adds the technical detail of the security measures.

NIS2 scope: who does the directive cover?

NIS2 covers public and private entities in the sectors listed in its two annexes that are medium-sized or larger under the EU SME definition: at least 50 staff, or annual turnover and balance sheet total both above €10 million. Some are covered whatever their size, including providers of public electronic communications networks or services, trust service providers, DNS service providers, TLD name registries and central government bodies.

Sectors of high criticality (Annex I):

• Energy, transport, banking, financial market infrastructures
• Health, drinking water, waste water
• Digital infrastructure: internet exchange points, DNS, TLD registries, cloud, data centres, CDNs, trust services, public telecoms
• ICT service management (business to business): managed service and managed security service providers
• Public administration, space

Other critical sectors (Annex II):

• Postal and courier services
• Waste management
• Manufacture and distribution of chemicals; production, processing and distribution of food
• Manufacturing of medical devices, electronics, electrical equipment, machinery, vehicles and other transport equipment
• Digital providers (online marketplaces, search engines, social networks) and research

In-scope organisations are either essential or important entities. The difference is how they are supervised and the size of the maximum fine.

Banks and other financial entities follow the ICT risk and reporting rules of DORA instead, which NIS2 treats as sector-specific law; see our DORA guide. If you make connected products, the EU Cyber Resilience Act regulates the products themselves.

Does NIS2 apply to UK companies?

Not in the UK. The UK’s own regime is the NIS Regulations 2018, which the Cyber Security and Resilience Bill is set to update; that guide compares the UK bill with NIS2. A UK company falls under NIS2 in one of three ways:

The size threshold still applies to these routes, except for services covered at any size, such as public telecoms, DNS services and TLD registries.

Which UK companies need an EU representative under NIS2?

Under Article 26, a company with no EU establishment needs an EU representative if it offers any of these services in the EU: DNS services, TLD name registries, domain name registration, cloud computing, data centre services, content delivery networks, managed services, managed security services, online marketplaces, online search engines or social networking platforms.

The representative must be established in one of the member states where you offer those services, and that state then has jurisdiction over you. If you do not appoint one, any member state where you provide the services can take enforcement action, and appointing one does not shield the company itself. These providers must also register details with the competent authority for the registry ENISA keeps under Article 27.

For UK managed service and managed security service providers with EU clients, this is the most common route into NIS2, so check it first.

What are the NIS2 requirements?

NIS2 requirements fall into three groups: governance, security measures and incident reporting.

Governance (Article 20). The management body must approve the cyber security risk-management measures, oversee their implementation and can be held liable for breaches. Its members must take training.

Security measures (Article 21). Measures must be appropriate and proportionate to the risk, take an all-hazards approach and include at least:

1. risk analysis and information system security policies;
2. incident handling;
3. business continuity, including backup management, disaster recovery and crisis management;
4. supply chain security, including security in relationships with direct suppliers;
5. security in acquiring, developing and maintaining systems, including vulnerability handling and disclosure;
6. policies and procedures to assess whether the measures are effective;
7. basic cyber hygiene and cyber security training;
8. policies on cryptography and, where appropriate, encryption;
9. human resources security, access control and asset management;
10. multi-factor or continuous authentication, and secured voice, video, text and emergency communications where appropriate.

Incident reporting (Article 23). A significant incident is one that has caused, or could cause, severe operational disruption or financial loss, or considerable damage to others. It must be reported to the national CSIRT or competent authority:

Our incident response plan template has a notification section you can adapt to these deadlines.

How does NIS2 reach UK suppliers?

Through contracts. Article 21 requires in-scope entities to manage supply chain security and to consider each direct supplier’s vulnerabilities, product quality and security practices, including secure development. EU customers pass this down as security questionnaires (our vendor risk assessment guide shows what they typically ask), minimum controls, incident notification clauses, audit rights and requests for evidence such as an ISO 27001 certificate, Cyber Essentials Plus or recent penetration test reports. How often to test is covered in our guide to penetration testing frequency.

How does NIS2 map to ISO 27001?

Closely. ISO/IEC 27001:2022 does not prove NIS2 compliance, but an ISMS covering your in-scope services delivers most of the Article 21 measures and the evidence to show them.

Where ISO 27001 falls short: your certificate scope may not cover every service NIS2 applies to; ISO 27001 sets no 24-hour or 72-hour reporting deadlines; management training and liability are legal duties under NIS2; and national laws, or Implementing Regulation 2024/2690 for digital providers, can be more prescriptive.

NIS2 compliance checklist for UK companies

NIS2 compliance for a UK company starts with scope: work out which entities and services are caught, then close the gaps against Article 21 and the reporting rules. Work through these eight steps in order, and keep the evidence in the right-hand column, because a regulator or an EU customer will ask for it.

If you already hold ISO 27001, steps 4 and 6 are mostly a mapping exercise using the table above; if you do not, an ISMS is the most practical way to deliver Article 21 as a whole.

Why Sovereign Secure

• ISO 27001 certified ourselves, with ISO 27001 consultancy from gap analysis to certification (certification audits by our partner, MQA International). An ISMS is the most practical base for Article 21.
• Penetration testing and vulnerability scanning that give evidence for vulnerability handling and for assessing whether your measures work.
• IASME-licensed Cyber Essentials certification body, issuing Cyber Essentials and Cyber Essentials Plus, independent evidence of basic cyber hygiene controls.
• PCI SSC-approved QSA, QPA, CPSA, P2PE Assessor and 3DS Assessor company and GEAR member 2026 to 2028, for payment and financial firms whose ICT rules also come from DORA.
• UK company since 2012, headquartered in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka. We are not lawyers: for scope questions under a member state’s law, take legal advice.

Talk to us about NIS2 readiness

Tell us which EU entities, services and customers you have, and we will suggest where an ISO 27001 programme, testing or Cyber Essentials Plus would close your gaps. A practical first step is an ISO 27001 gap analysis, because it measures you against most of the Article 21 measures at once. Browse our cyber security consultancy or call +44 161 523 5276.