> ## Content Index
> Fetch the complete content index at: https://www.aigl.blog/llms.txt
> Use this file to discover other available public pages before exploring further.

# EU NIS2 Directive: 101
- URL: https://www.aigl.blog/eu-nis2-directive-101/
- Published: 2026-09-19T09:11:16.000Z
- Updated: 2026-09-19T09:11:16.000Z
- Description: An IAPP one-page explainer on the EU NIS2 Directive: which organisations and sectors are in scope, the Article 21 cybersecurity requirements, Article 23 incident-reporting obligations and timeline, enforcement powers, penalties and key dates.
- Author: Jakub Szarmach
- Tags: Guidance, Compliance & Audit, Risk Management, AI Policy & Regulation, Supply Chain & Third-Party Risk, Privacy & Data Protection, #aigl-library

## ⚡ Quick Summary

Published by IAPP, this one-page explainer summarises the EU NIS2 Directive on measures for a high common level of cybersecurity across the EU, which replaces the NIS directive adopted in 2016\. It is credited to Anokhy Desai, CIPP/US, CIPT, described as an IAPP former Westin Fellow, and is marked as updated October 2024.

The document first defines the organisations within scope — medium and large entities with more than 50 employees and annual turnover above 10 million euros, plus entities of any size that meet listed public-interest criteria — and separates covered organisations into essential and important entities by sector, pointing to Annex I and II for further sector detail.

It then lists the Article 21 cybersecurity requirements, the Article 23 reporting obligations, a reporting timeline of an early warning within 24 hours, an incident notification within 72 hours and a final report within one month, and enforcement powers, including administrative fines of up to 10 million euros or 2% of the company's total annual worldwide turnover, whichever is higher.

## 🧩 What’s Covered

The chart is organised into labelled blocks, from scope through to further reading.

- **Organisations within scope**: medium and large entities (more than 50 employees, annual turnover above 10 million euros) and any-size entities that are public administration bodies, sole providers of a service in a member state in a way that affects public safety, security or health, sources of systemic or cross-border risk, critical at regional or national level, or providers of public electronic communications networks and services, trust services, top-level domain registries or DNS providers.
- **Sectors within scope**: essential entities in energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, public administration and space; important entities in postal and courier services, waste management, chemicals, food, manufacturing (medical devices and in vitro diagnostics, computer, electronic and optical products, electrical equipment, machinery, transport equipment) and digital providers such as online marketplaces, search engines and social networking platforms.
- **Key requirements**: the Article 21 measures, including risk analysis and information system security policies, incident handling, business continuity and disaster recovery, supply-chain security, vulnerability handling and disclosure, assessment of risk-management effectiveness, cyber hygiene and training, cryptography and encryption policies, human resources security, access control, asset management and multifactor authentication.
- **Reporting obligations**: Article 23 duties to notify the CSIRT or competent authority of significant incidents and cross-border impacts, and to notify service recipients of significant incidents and significant cyber threats.
- **Timeline of reporting an incident**: early warning within 24 hours, incident notification within 72 hours with an initial assessment, an intermediate report on request, and a progress or final report within one month of the incident notification.
- **Enforcement and penalties**: administrative fines of up to 10 million euros or 2% of worldwide turnover, publication of noncompliance, public statements naming those responsible, suspension of certifications and authorisations, temporary management bans, and supervision measures distinguishing essential entities (including random checks, ad hoc audits and security scans) from important entities (ex post supervision and targeted audits).
- **Overview, key changes and challenges**: the directive's aim, the new essential/important classification, expanded sectors, extended scope to all medium and large entities, modified breach notification, voluntary coordinated vulnerability disclosure, and challenges including NIS2/GDPR interplay and enforcement exposure.
- **Important dates and additional resources**: entry into force on 16 Jan. 2023, Commission guidelines by 17 July 2023, national transposition by 17 Oct. 2024, the entity list due by 17 April 2025, and links to implementing guidelines and related IAPP material.

## 💡 Why it matters?

For security, privacy and compliance functions, the chart gives a fast scoping check: whether an organisation is a medium or large entity or meets one of the special criteria, whether it is treated as essential or important, and therefore which supervisory treatment and penalty ceiling apply. It assembles the Article 21 measures and the 24-hour, 72-hour and one-month reporting clock in one place, and it flags the interplay with the GDPR on authority cooperation, legitimate interest as a legal basis for security processing and differing breach-notification timelines. It is a starting point for gap analysis rather than a substitute for the directive text or national law.

## ❓ What’s Missing

The chart is a high-level orientation tool, not an implementation guide. It does not explain how to meet the Article 21 measures, how to resolve borderline scoping or classification questions, or how national transpositions differ across member states; the Annex I and II sector detail is referenced but not reproduced. The GDPR interplay is listed as issues rather than resolved, including the differing notification timelines and processes. The document does not address AI systems, AI-specific risks or the EU AI Act, so its relevance to AI governance rests on its cybersecurity and incident-reporting content. Parts of the right-hand column are garbled in the text extraction, including a heading that cannot be read.

## 👥 Best For

Compliance and privacy leads mapping their organisation against NIS2 scope, entity classification, Article 21 measures and the reporting clock; security and incident-response teams that need the 24-hour, 72-hour and one-month deadlines in view; and advisers or executives who need a single-page orientation before turning to the directive text, Annex I and II, and national implementing law.

## 📄 Source Details

*EU NIS2 Directive: 101*, published by IAPP and written by Anokhy Desai, CIPP/US, CIPT, an IAPP former Westin Fellow; marked updated October 2024; one page; © 2024 IAPP. No URL for the document itself is printed beyond the publisher's site, iapp.org. The input was the text extraction of that single page, whose right-hand column overlaps in places and contains one unreadable heading, so only the layout and wording visible there could be assessed.