EU enforces tougher cybersecurity rules under NIS2
Senior executives face direct accountability as NIS2 makes cybersecurity a legal duty across Europe.
The European Union’s NIS2 directive has officially come into force, imposing stricter cybersecurity duties on thousands of organisations.
Adopted in 2022 and implemented into national law by late 2024, the rules extend beyond critical infrastructure to cover more industries. Energy, healthcare, transport, ICT, and even waste management firms now face mandatory compliance.
Measures include multifactor authentication, encryption, backup systems, and stronger supply chain security. Senior executives are held directly responsible for failures, with penalties ranging from heavy fines to operational restrictions.
Companies must also report major incidents promptly to national authorities. Unlike ISO certifications, NIS2 requires organisations to prove compliance through internal processes or independent audits, depending on national enforcement.
Analysts warn that firms still reliant on legacy systems face a difficult transition. Yet experts agree the directive signals a decisive shift: cybersecurity is now a legal duty, not simply best practice.
Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!