Q-Secur Back to insights
June 2026 · updated November 2026

NIS 2, does it apply to you?

It depends on your sector, your size and a few exceptions people tend to forget. Here is how to settle it, and what follows if the answer is yes.

Three questions, in this order

The first is about your sector. The directive lists the highly critical sectors in Annex I, from energy to digital infrastructure by way of health and drinking water. It lists others in Annex II, among them chemicals, food, medical device manufacturing and waste management. Outside those annexes, the directive does not target you directly.

The second is about your size. The threshold is the European definition of a medium-sized enterprise, so fifty staff, or turnover and balance sheet above ten million euros. Below that, you fall outside the scope as a rule.

The third is about the exceptions, and it is the one people forget. Some entities are covered whatever their size. That holds for DNS service providers, domain name registries, trust service providers and parts of public administration. It also holds for an organisation that is the sole provider of an essential service in its country, or whose failure would have a significant effect on public safety.

Essential or important

The security obligations are the same for both categories. What differs is supervision and penalties.

An essential entity faces checks that can come at any time, with no incident to trigger them. An important entity is only checked after the fact, once something suggests it is falling short. The fine ceilings differ as well, ten million euros or two per cent of worldwide turnover for the first group, seven million or one point four per cent for the second.

What the directive asks for

Article 21 lists ten families of measures, to be scaled to the risk. Risk analysis and security policy, incident handling, business continuity, supply chain security, security in development and maintenance, assessing how well the measures work, cyber hygiene and training, cryptography, human resources security and access control, multi-factor authentication.

Nothing exotic for anyone who knows ISO 27001. The two map onto each other well, and an existing certificate is a solid base. It is not sufficient on its own, because the directive adds duties the standard does not carry.

Reporting, the most concrete part

Those deadlines assume an organisation that is ready, with people on call, criteria for grading an incident and templates prepared. It is where we find the widest gaps in audit, well before the technical measures.

Management liability is the other novelty. The management body approves the measures, oversees how they are implemented and can be held liable for failures. It also has to follow training. This is no longer a subject that can be delegated away entirely.

So which text applies

NIS 2 is a directive. What you apply is your own country's law, not the European text. Belgium transposed in October 2024 and Portugal in 2025, while France is still waiting for its own act. Thresholds, deadlines and competent authorities therefore vary from one country to the next.

We work through it country by country, across the French, Portuguese and Belgian transpositions. Get in touch.

Sources