NIS2 vs NIS1: What Changed and What It Means

Last updated: 12 October 2026

Quick answer: NIS2 vs NIS1 comes down to scope, rules and enforcement. NIS2 replaced NIS1 on 18 October 2024, expanded coverage from 7 to 18 sectors, swapped national designation for a size-cap rule, set minimum security measures, made management bodies accountable, introduced 24-hour, 72-hour and one-month reporting, and raised maximum fines to at least EUR 10 million or 2% of turnover.

The first EU cybersecurity directive, NIS1, was a milestone. It was also uneven. Member States identified very different numbers of operators, applied different security expectations and imposed very different penalties. NIS2 was written to fix that.

If your organisation was an operator of essential services under NIS1, much of your programme carries over. If it was never in scope before, NIS2 may be the first time you face binding cybersecurity law. This NIS2 vs NIS1 guide sets out what changed, why it matters to a CISO, and what to do about the gaps.

NIS2 vs NIS1: what is the difference in one table?

The short version: NIS2 keeps the same goal as NIS1, a high common level of cybersecurity across the Union, but with a much wider net, prescriptive measures and real enforcement tools. The table compares the two on the points that matter most in practice.

The rest of this guide takes each row in turn.

Why was NIS1 replaced?

Directive (EU) 2016/1148 required every Member State to adopt a national strategy, set up computer security incident response teams (CSIRTs) and identify operators of essential services. It worked as a foundation, but it left too much to national discretion. Two companies doing the same thing in neighbouring countries could face very different obligations, or none at all.

The threat picture also changed. Supply chain attacks, ransomware against hospitals and public bodies, and the growing dependence on cloud and managed services all showed that the narrow NIS1 perimeter no longer matched the risk. The European Commission describes NIS2 as raising the common level of ambition through a wider scope, clearer rules and stronger supervision tools on its NIS2 policy page.

Directive (EU) 2022/2555 repealed NIS1 with effect from 18 October 2024, the day after the transposition deadline.

How did the scope change?

This is the change that affects the most organisations. NIS2 widened both the sectors covered and the way entities fall into scope.

From 7 to 18 sectors

NIS1 covered energy, transport, banking, financial market infrastructures, health, drinking water and digital infrastructure, plus online marketplaces, online search engines and cloud computing services as digital service providers.

NIS2 keeps those and adds, among others, waste water, ICT service management (including managed service providers and managed security service providers), public administration, space, postal and courier services, waste management, chemicals, food, manufacturing of critical products such as medical devices and electronics, digital providers such as social networking platforms, and research organisations.

From designation to the size-cap rule

Under NIS1, national authorities decided who was an operator of essential services. Under NIS2, an entity is generally in scope if it operates in a listed sector and is at least a medium-sized enterprise. Certain entities, such as providers of public electronic communications networks, trust service providers, DNS service providers and top-level domain name registries, are covered regardless of size. Member States also had to draw up lists of essential and important entities by 17 April 2025.

Common mistake: assuming that because you were never designated under NIS1, NIS2 does not apply. Self-assessment is now the starting point. Our essential vs important entities decision guide walks through the tests.

What are essential and important entities?

NIS2 replaces the NIS1 split between operators of essential services and digital service providers with two categories. Both face the same substantive obligations; the difference lies in supervision and fine levels.

• Essential entities are generally large entities in Annex I sectors, plus some entities named directly in the directive or designated by Member States. They face proactive supervision, including audits and inspections without a prior incident.
• Important entities are the other in-scope entities, typically medium-sized entities in Annex I sectors and entities in Annex II sectors. Supervision is reactive, triggered by evidence of non-compliance.

What security measures does NIS2 require that NIS1 did not?

NIS1 asked for appropriate and proportionate technical and organisational measures without listing them. NIS2 Article 21(2) sets a minimum baseline based on an all-hazards approach, covering:

1. Risk analysis and information system security policies.
2. Incident handling.
3. Business continuity, backup management, disaster recovery and crisis management.
4. Supply chain security, including relationships with direct suppliers and service providers.
5. Security in acquisition, development and maintenance, including vulnerability handling and disclosure.
6. Policies and procedures to assess the effectiveness of measures.
7. Basic cyber hygiene practices and cybersecurity training.
8. Policies on cryptography and, where appropriate, encryption.
9. Human resources security, access control and asset management.
10. Multi-factor or continuous authentication, secured communications and secured emergency communications where appropriate.

For digital infrastructure and digital service providers, the Commission went further. Implementing Regulation (EU) 2024/2690, adopted on 17 October 2024, sets detailed technical requirements for entities such as DNS providers, cloud computing providers, data centre providers, managed service providers, managed security service providers, online marketplaces and trust service providers.

In practice: most of these measure areas map closely to ISO 27001 Annex A controls, so an existing ISMS is a strong head start. Supply chain security is usually the biggest gap, and a structured vendor and third-party risk management process is the most direct way to close it.

How did incident reporting change?

NIS1 required notification of incidents with a significant impact on service continuity without undue delay. NIS2 turns that into a staged timeline under Article 23 for significant incidents:

• Early warning within 24 hours of becoming aware, indicating whether the incident may be caused by unlawful or malicious acts or could have cross-border impact.
• Incident notification within 72 hours, updating the early warning with an initial assessment of severity and impact and, where available, indicators of compromise.
• Final report within one month of the incident notification, with a detailed description, root cause, mitigation measures and any cross-border impact.
• Intermediate reports on request, and a progress report if the incident is still ongoing at the one-month mark.

NIS2 also expects entities to inform recipients of their services, where appropriate, about significant incidents and cyber threats that could affect them. For a walk-through of each stage, see our NIS2 incident reporting guide. Running the timeline from a single incident and breach management workflow also helps when the same event triggers GDPR’s 72-hour breach notification.

What does NIS2 expect from management bodies?

This is arguably the biggest cultural change. Article 20 requires management bodies of essential and important entities to approve the cybersecurity risk management measures, oversee their implementation and be held liable for infringements. Members of management bodies must follow training, and entities are encouraged to offer similar training to employees.

For essential entities, NIS2 goes further. As a last resort, authorities can request a temporary prohibition on a person exercising managerial functions where enforcement measures have not been effective. Nothing comparable existed under NIS1.

If you need to show the board where the organisation stands against Article 21 and other frameworks at once, Enactia’s Compliance Universe maps controls across NIS2, ISO 27001 and DORA in one view. You can start your 14-day free trial without a credit card.

How do fines and supervision compare?

NIS1 left penalties entirely to Member States, which led to wide variation. NIS2 Article 34 sets minimum levels for the maximum administrative fines that national law must allow for breaches of Articles 21 and 23:

• Essential entities: a maximum of at least EUR 10 million or 2% of total worldwide annual turnover, whichever is higher.
• Important entities: a maximum of at least EUR 7 million or 1.4% of total worldwide annual turnover, whichever is higher.

Supervisory powers were also strengthened, including on-site inspections, security audits, security scans, information requests and binding instructions. Essential entities can be supervised proactively; important entities are supervised after the fact, when there are indications of non-compliance.

What changed at EU level?

NIS2 also strengthened cooperation between Member States and the role of the EU Agency for Cybersecurity. According to ENISA, its new tasks include a European vulnerability database, support for the European cyber crisis liaison organisation network (EU-CyCLONe), peer reviews between Member States and a registry of certain cross-border digital providers. The Cooperation Group and the CSIRTs network, both created under NIS1, continue with broader mandates.

In January 2026 the Commission also proposed targeted amendments to NIS2, alongside a revised Cybersecurity Act. Proposals can change before adoption, so keep planning against the directive as transposed in your Member State.

How does this affect organisations in the UK?

NIS2 does not apply in the UK. The UK kept its own NIS Regulations 2018, based on NIS1, and in November 2025 the government introduced the Cyber Security and Resilience Bill to update them. By September 2026 the Bill had reached report stage in the House of Lords but had not yet received Royal Assent. UK organisations that provide services into the EU, or have EU establishments, may still fall under NIS2 through national transposition laws.

What should former NIS1 operators do now?

If you were an operator of essential services under NIS1, use this checklist to move to NIS2:

• Confirm your NIS2 classification and registration in each Member State where you operate. Transposition status varies, as our NIS2 transposition tracker shows.
• Map your current controls against the ten Article 21(2) areas and record gaps.
• Extend risk management to suppliers and service providers, not just your own systems.
• Rewrite incident procedures around the 24-hour, 72-hour and one-month stages.
• Brief and train the management body, and record its approval of measures.
• Prepare evidence for proactive supervision if you are an essential entity.
• Review scope for group entities that were outside NIS1 but fall into new NIS2 sectors.

Key takeaways

• NIS2 repealed NIS1 with effect from 18 October 2024 and applies through national transposition laws.
• Scope jumped from 7 sectors to 18, and a size-cap rule replaced national designation.
• Article 21 sets ten minimum measure areas, with supply chain security the most common gap.
• Reporting moved to a 24-hour, 72-hour and one-month cascade.
• Management bodies are now accountable, and fines have harmonised minimum maximums.

Frequently asked questions

Is NIS1 still in force?
No. NIS2 repealed Directive (EU) 2016/1148 with effect from 18 October 2024. National laws transposing NIS1 remain relevant only until each Member State replaces them with its NIS2 transposition law. Where a country is late, check with the national authority which rules currently apply, because some older national provisions may continue in the meantime.

If we were an operator of essential services under NIS1, are we automatically an essential entity?
Not automatically. NIS2 uses its own criteria based on sector and size, and Member States can also designate entities. Many former operators of essential services will be essential entities, but you should reassess against the NIS2 annexes and your national law. Registration with the competent authority is usually required either way.

What are the NIS2 fines compared with NIS1?
NIS1 left fines to Member States, so amounts varied widely. NIS2 requires national law to allow maximum fines of at least EUR 10 million or 2% of worldwide annual turnover for essential entities, and at least EUR 7 million or 1.4% for important entities, whichever is higher. Member States can set higher maximums.

Does NIS2 apply to small companies?
Generally no. The size-cap rule means NIS2 mainly applies to medium and large entities in the listed sectors. However, some entities are covered regardless of size, including trust service providers, DNS service providers, top-level domain name registries and public electronic communications providers, and Member States can designate smaller entities that are critical.

Can an ISO 27001 certification show NIS2 compliance?
An ISO 27001 certified ISMS covers much of Article 21, but it does not automatically demonstrate NIS2 compliance. NIS2 adds specific reporting deadlines, management body obligations, registration duties and, for some digital providers, detailed technical rules in Implementing Regulation 2024/2690. Use ISO 27001 as a base and close the specific gaps.

From NIS1 compliance to NIS2 readiness

NIS2 is not a fresh start for organisations that took NIS1 seriously, but it is a substantial step up. The biggest changes are who is in scope, how clearly the security baseline is defined, how quickly incidents must be reported and how directly leadership is held to account. Start with classification, run a gap analysis against Article 21 and rebuild incident procedures around the new timelines. Our NIS2 compliance roadmap sets out the steps in more detail.

If you would like help mapping NIS2 alongside ISO 27001, DORA or GDPR, contact us or book a demo or start your 14-day free trial of Enactia’s AI-powered GRC platform.

This article is for general information and is not legal advice.