Nandini Roy Choudhury, writer
techsunnews.com | Updated October 12, 2026 | 4 min read
The new EU cyber law, known as NIS 2, is no longer something companies can leave for later. Countries had to turn it into national law by October 17, 2024, and it has applied since the next day. Many countries were late, which is why it is still in the news in 2026. Here is what the rules say, what the penalties are, and what they could mean for you.
What is NIS 2, the new EU cyber law?
NIS 2 is short for Network and Information Security 2. It is an EU directive that sets common cybersecurity standards for companies providing important services, such as energy, transport, banking, healthcare, water, digital infrastructure and waste management. It replaced an older 2016 law and covers many more sectors.
Because it is a directive, each EU country passes its own national version. The details can differ from one country to the next.
What companies must do
The new EU cyber law asks companies to do three main things:
- Manage risk: put proper security measures in place and check the risks from suppliers and technology partners.
- Report problems quickly: send an early warning within 24 hours of a serious incident, a fuller report within 72 hours, and a final report within a month.
- Make management responsible: senior leaders are accountable for cybersecurity, not just the IT team.
What are the penalties?
Companies classed as “essential” can face fines of up to €10 million or 2% of worldwide annual turnover, whichever is higher. Companies classed as “important” can face fines of up to €7 million or 1.4%. Authorities can also inspect companies more closely and order them to fix problems.
Where things stand in 2026
Most EU countries now have their own NIS 2 law in force, but a few were still behind. In July 2026 the European Commission took several countries to the EU’s Court of Justice over missing or incomplete laws. For the latest list, see the European Commission’s NIS 2 page.
Does it affect you?
Most readers will never deal with NIS 2 directly. Whether a company is covered depends on its size, its sector and the national law where it operates. For everyday users, the likely effect is faster and clearer notices when a service you use is hacked. This article is general information, not legal advice.
Frequently asked questions
What does NIS 2 stand for?
It stands for Network and Information Security 2. It is the EU’s updated cybersecurity law.
Is NIS 2 in force yet?
Yes. It has applied since October 18, 2024, although some countries were slow to pass their national laws.
This article was first based on CNBC reporting and has been updated with current information.
