OT Governance Radar

NIS2 Directive (EU) 2022/2555

active EU · Directive (transposed into national law) · Last verified 28 Oct 2026

Status: In force; national transposition largely complete, 4 Member States referred to CJEU

EU-wide cybersecurity baseline for "essential" and "important" entities across 18 sectors, including energy, transport, drinking water, wastewater, health, manufacturing of critical products, chemicals and food. Member States had to transpose it by 17 October 2024. Obligations (risk-management measures, incident reporting, management-body accountability, registration) apply via each country's national law — see the country tracker.

Open the NIS2 country-by-country tracker → NIS2 obligations by country →

Who it applies to

  • Medium and large entities in Annex I (high-criticality) and Annex II (other critical) sectors, per national transposition
  • OT-heavy sectors in scope include energy (electricity, oil, gas, hydrogen, district heating), transport, drinking water, wastewater, manufacturing, chemicals, food

Why it matters for OT

Incident reporting (24h early warning / 72h notification / 1-month final report) and Article 21 risk-management measures apply to OT environments of in-scope operators. Several national laws reference IEC 62443 or require IT/OT risk assessments.

Controls affected & IEC 62443 mapping

RequirementIndicative IEC 62443 reference
Art. 21 risk-management measures (risk analysis, incident handling, business continuity, supply chain, secure acquisition/development, vulnerability handling, crypto, access control, MFA)IEC 62443-2-1 (security program), 62443-3-2 (risk assessment & zoning), 62443-3-3 (system requirements SR 1–7), 62443-2-4 (service provider requirements), 62443-4-1 (secure development)
Art. 23 incident reporting (24h / 72h / 1 month)IEC 62443-2-1 incident response elements; 62443-3-3 SR 6 (timely response to events)
Art. 20 management body approval, oversight and trainingIEC 62443-2-1 governance / organisational security elements

IEC 62443 mappings are editorial and indicative, not an official crosswalk.

Recent changes

  1. Four Member States referred to the Court of Justice

    Ireland, Spain, France and the Netherlands referred for failing to notify transposition; Commission requests lump sum and daily penalties.

    Source: digital-strategy.ec.europa.eu

  2. Targeted NIS2 amendments proposed

    Proposal COM(2026) 13: simplification, alignment with Cybersecurity Act 2, scope/definition clarifications, small mid-cap category, streamlined ransomware reporting. Subject to Parliament/Council negotiation.

    Source: eur-lex.europa.eu

Sources

Monitored for changes: digital-strategy.ec.europa.eu, ecs-org.eu, eur-lex.europa.eu. Data file: data/regulations/nis2.yaml. Not legal advice.