NIS2 in Europe: What Companies Must Do Now

Across Europe, the new NIS2 Directive is transforming cybersecurity into a board-level governance, resilience, and leadership responsibility.

Many companies still underestimate the scale of the new regulation. NIS2 significantly expands the number of affected companies and introduces far-reaching obligations around cyber risk management, governance, incident reporting, operational resilience, and executive accountability.

For many European companies, 2026 marks the beginning of a new era of mandatory cybersecurity governance.

What Is the NIS2 Directive?

The NIS2 Directive (“Network and Information Security Directive 2”) is the European Union’s updated cybersecurity framework designed to strengthen cyber resilience across critical and important sectors throughout Europe.

The directive applies to a much broader range of companies than previous cybersecurity regulations and impacts sectors including:

• digital services,
• cloud and IT providers,
• manufacturing,
• logistics,
• healthcare,
• energy,
• telecommunications,
• financial services,
• research organizations,
• and technology- and AI-driven businesses.

NIS2 requires companies to implement not only technical cybersecurity measures, but also organizational resilience, governance structures, and executive accountability.

Why NIS2 Is Becoming a Board-Level Issue

One of the most significant changes introduced by NIS2 is the increased responsibility placed on executive leadership and boards.

Under the directive, management bodies are expected to:

• approve cybersecurity risk-management measures,
• oversee implementation,
• participate in cybersecurity training,
• and ensure organizational readiness for cyber incidents.

Companies must increasingly demonstrate that they have:

• clear governance structures,
• documented risk-management processes,
• incident-response procedures,
• crisis escalation plans,
• employee awareness programs,
• and executive cyber resilience training.

In many EU countries, regulators are beginning to require documented evidence of cybersecurity awareness initiatives, board-level training, and incident preparedness exercises.

NIS2 therefore moves cybersecurity beyond technical compliance into operational leadership and organizational resilience.

Which EU Countries Have Already Implemented NIS2?

The implementation status of NIS2 differs across Europe. However, many EU member states have already transposed the directive into national law and established dedicated supervisory authorities.

Countries with active or advanced implementation include:

• Belgium
• Luxembourg
• Italy
• Germany
• Austria
• Croatia
• Portugal
• Lithuania
• Poland
• Finland
• Czech Republic
• Hungary

Additional countries are currently finalizing legislation or implementation frameworks.

National Authorities and Regulatory Bodies Across Europe

As part of NIS2 implementation, EU countries are establishing supervisory authorities, cybersecurity agencies, incident-reporting platforms, and regulatory oversight structures.

These authorities are responsible for:

• company registration,
• cybersecurity supervision,
• incident reporting,
• audits and compliance checks,
• governance oversight,
• and enforcement of organizational security obligations.

Below are some of the key national authorities currently involved in NIS2 enforcement.

Belgium

Belgium has already fully implemented the NIS2 Directive.

The responsible authority is the Centre for Cybersecurity Belgium (CCB).

Organizations falling under NIS2 must register via the national NIS2 portal and demonstrate implementation of:

• cybersecurity risk-management measures,
• governance structures,
• incident reporting processes,
• awareness and training programs,
• and organizational security controls.

Belgium is currently considered one of Europe’s most advanced and strict NIS2 regulatory environments.

Luxembourg

Luxembourg officially implemented NIS2 through the Law of 5 May 2026.

The responsible authority is the Institut Luxembourgeois de Régulation (ILR).

Affected companies must register with the ILR and document:

• cybersecurity risk-management measures,
• governance structures,
• incident-response capabilities,
• supply-chain risk management,
• crisis-management processes,
• and employee and executive awareness training.

Luxembourg is rapidly positioning itself as a European hub for cybersecurity governance, cyber resilience, and executive readiness programs.

The country is also developing standardized risk-management and regulatory reporting systems such as SERIMA to support NIS2 compliance.

Italy

In Italy, the Agenzia per la Cybersicurezza Nazionale (ACN) acts as the central NIS2 authority.

The ACN serves as:

• the national cybersecurity agency,
• the national coordination authority,
• and the national CSIRT for incident reporting.

Italian organizations are expected to provide increasingly detailed evidence of:

• governance structures,
• cybersecurity risk assessments,
• operational resilience,
• executive oversight,
• and documented compliance programs.

Italy is currently developing some of the most operationally detailed NIS2 compliance requirements in Europe.

Germany

In Germany, the Federal Office for Information Security (BSI – Bundesamt für Sicherheit in der Informationstechnik) will become the primary supervisory and reporting authority.

Organizations will be expected to establish:

• cybersecurity risk-management frameworks,
• incident-reporting procedures,
• governance documentation,
• and awareness and executive training programs.

Germany is expected to significantly expand cybersecurity oversight obligations under the upcoming NIS2 implementation framework.

Austria

In Austria, implementation is coordinated by the Austrian Federal Chancellery together with the national cybersecurity ecosystem and GovCERT Austria.

Organizations are expected to:

• report security incidents,
• document organizational security measures,
• and demonstrate governance and risk-management processes.

Croatia

In Croatia, the Croatian National CERT (CERT.hr) plays a central role in NIS2 implementation and incident management.

The focus increasingly includes:

• governance,
• operational resilience,
• incident reporting,
• and awareness training documentation.

Portugal

Portugal’s central authority is the Centro Nacional de Cibersegurança (CNCS).

Companies must register and demonstrate implementation of cybersecurity and governance measures aligned with NIS2 obligations.

Lithuania

In Lithuania, the National Cyber Security Centre (NCSC) coordinates NIS2 implementation.

The authority oversees:

• incident reporting,
• cybersecurity controls,
• governance measures,
• and compliance documentation.

Poland

Poland’s implementation is coordinated through national cybersecurity structures and CERT systems, particularly CSIRT NASK.

Further operational requirements are currently being expanded.

Finland

In Finland, the responsible authority is the Finnish Transport and Communications Agency Traficom and its National Cyber Security Centre Finland (NCSC-FI).

Organizations are required to report incidents and demonstrate cybersecurity preparedness measures.

Czech Republic

The Czech Republic is supervised by the National Cyber and Information Security Agency (NÚKIB).

NÚKIB is considered one of Europe’s most advanced cybersecurity regulators and follows a strongly governance-oriented approach.

What Companies Across Europe Must Now Prepare For

Although national implementation differs slightly, regulatory expectations across Europe are becoming increasingly aligned.

Organizations are expected to demonstrate:

• cybersecurity governance,
• board-level awareness,
• documented risk management,
• incident preparedness,
• crisis escalation procedures,
• business continuity planning,
• employee awareness programs,
• and executive cyber resilience training.

Increasingly, authorities and auditors are requesting evidence of:

• executive training,
• cybersecurity simulations,
• phishing and deepfake awareness,
• incident-response exercises,
• and scenario-based decision-making programs.

This means cybersecurity is evolving into a strategic leadership capability — not simply a technical function.

Why NIS2 and AI Governance Are Converging

As organizations increasingly adopt AI technologies, new cyber and governance risks are emerging:

• AI-powered cyberattacks,
• deepfake fraud,
• social engineering attacks,
• automated disinformation,
• reputational manipulation,
• and AI-driven operational risks.

As a result, NIS2, AI Governance, and Cyber Resilience are increasingly converging into a single executive governance challenge.

EU based Companies now require:

• executive readiness,
• crisis leadership,
• resilient decision-making structures,
• AI governance frameworks,
• and scenario-based resilience capabilities.

NIS2 Is Ultimately About Organizational Resilience

NIS2 is not merely a cybersecurity compliance framework.

It fundamentally changes how organizations must think about:

• leadership,
• operational resilience,
• governance,
• crisis readiness,
• and decision-making under pressure.

Companies that act early will not only reduce regulatory risk — they will strengthen resilience, trust, leadership capability, and long-term competitiveness in an increasingly volatile digital environment.

Innovation Lux Executive NIS2 & Cyber Resilience Programs

Innovation Lux supports companies across Europe with:

• Executive NIS2 Briefings,
• NIS2 Checklists
• Cybersecurity Risk Management Programs,
• AI Governance Workshops,
• Deepfake Risk Trainings,
• Cyber Crisis Simulations,
• Scenario-Based Decision Trainings,
• Company Readiness Programs,
• and organization-wide awareness and resilience initiatives.

Our corporate training programs are designed to support regulatory readiness and to prepare leadership teams and international companies for real-world cyber, AI, operational, and reputational crisis scenarios.

Have a look at our event calendar and register for your NIS2 Executive Training!