The NIS2 Directive and Your Documents: What EU Businesses Need to Know
NIS2 is the biggest expansion of EU cybersecurity regulation in a decade. It covers 160,000+ entities across 18 sectors — and most of what it demands is documentation. Risk registers, incident records, policy approvals, supplier assessments, training logs. Here is what you actually need to do.
Last updated: April 2026
The Short Answer
- → NIS2 is primarily a documentation and governance challenge, not a technology one. Seven of the ten mandatory security measures under Article 21 are fundamentally about documented processes, approved policies, and auditable evidence.
- → If your organization operates in one of the 18 covered sectors and has 50 or more employees (or exceeds €10M in annual turnover), you are very likely in scope — either as an essential or important entity.
- Bottom line: A document management system does not make you NIS2 compliant on its own. But bad document management — missing policies, no version history, no approval trails — guarantees you will fail an audit.
What is NIS2 and why does it matter?
The Network and Information Security Directive 2 (NIS2) is Directive (EU) 2022/2555, adopted in December 2022 and in force since January 2023. It replaces the original NIS Directive from 2016. The jump in scope is enormous: NIS1 covered roughly 15,000 entities in 7 sectors. NIS2 covers over 160,000 entities across 18 sectors. That is a tenfold expansion.
Member States were required to transpose NIS2 into national law by October 17, 2024. As of April 2026, 21 of 27 Member States have done so. The European Commission sent reasoned opinions to 19 Member States in May 2025 for failing to notify full transposition. Germany completed its transposition in December 2025. France is expected to finalize its Loi Résilience in mid-2026. Enforcement has already begun.
| Aspect | NIS1 (2016) | NIS2 (2022) |
|---|---|---|
| Entities in scope | ~15,000 | ~160,000+ |
| Sectors covered | 7 | 18 |
| Maximum fine | Varied by Member State | €10M or 2% global turnover |
| Management liability | None | Personal liability (Art. 20) |
| Incident reporting | "Without undue delay" | 24h / 72h / 1 month (Art. 23) |
| Supply chain requirements | None | Mandatory (Art. 21(2)(d)) |
And yet, according to a CyberSmart survey of 670 business leaders across eight EU countries published in April 2026, only 16% of in-scope businesses are fully NIS2 compliant. The primary barriers are budgetary constraints and lack of guidance on how to implement the measures. This guide addresses the second problem.
Are you in scope?
NIS2 applies to entities that operate in one of the 18 designated sectors AND meet the size threshold. There are two entity classifications: essential (higher obligations, proactive supervision) and important (lighter supervision, but the same core security measures apply).
The general size threshold is medium-sized enterprise or larger: 50 or more employees, OR annual turnover exceeding €10 million, OR annual balance sheet exceeding €10 million. Some entities qualify regardless of size — including DNS providers, TLD registries, trust service providers, and public electronic communications providers.
The 18 sectors are split across two annexes. Both carry the same Article 21 security requirements. The difference is in how supervisory authorities engage with you:
| Classification | Sectors (Annex) | Supervision |
|---|---|---|
| Essential (Annex I) | Energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management (B2B), public administration, space | Proactive — authorities can audit, inspect, and request evidence at any time |
| Important (Annex II) | Postal services, waste management, chemicals, food production and distribution, manufacturing (medical devices, electronics, machinery, vehicles), digital providers (marketplaces, search engines, social networks), research | Reactive — authorities investigate after an incident or when evidence of non-compliance surfaces |
Note: the January 2026 Commission amendment proposal introduces a new "small mid-cap" category for entities with fewer than 750 employees and turnover under €150 million. Under this proposal, small mid-caps would be classified as important rather than essential, even if they operate in Annex I sectors. This is still in legislative negotiations and not yet in force.
The 10 mandatory security measures (Article 21)
Article 21(2) lists ten minimum security measures that every in-scope entity must implement. These are not suggestions — they are legal requirements, further detailed in the Commission Implementing Regulation (CIR) 2024/2690.
The key insight: look at the "Document required" column. Seven of the ten measures are fundamentally about having documented, approved, and auditable policies or procedures. This is where document management becomes directly relevant.
| # | Requirement | What it means | Document required |
|---|---|---|---|
| (a) | Risk analysis and information security policies | Identify your risks, assess them, and document how you treat them | Risk register, risk assessment methodology, security policy |
| (b) | Incident handling | Detect, respond to, and learn from security incidents | Incident response plan, escalation matrix, post-incident review template |
| (c) | Business continuity and crisis management | Backup management, disaster recovery, and crisis response | Business continuity plan, disaster recovery plan, backup policy |
| (d) | Supply chain security | Assess and manage cybersecurity risks from your suppliers | Supplier security policy, vendor assessment records |
| (e) | Security in acquisition, development, maintenance | Vulnerability handling and secure development practices | Patch management procedure, vulnerability disclosure policy |
| (f) | Effectiveness testing | Assess whether your security measures actually work | Internal audit schedule, test reports, KPI dashboard |
| (g) | Basic cyber hygiene and training | Train staff and establish security practices as routine | Training plan, attendance records, awareness materials |
| (h) | Cryptography and encryption | Policies for encryption of data at rest and in transit | Cryptography policy, key management procedure |
| (i) | Human resources security and access control | Manage who has access to what, from onboarding to offboarding | Access control policy, joiners/movers/leavers procedure |
| (j) | Multi-factor authentication and secure communications | MFA on critical systems, secured voice/video/text | MFA enforcement policy, secure communications standards |
NIS2 is a documentation problem
This is where most NIS2 guides fall short. They explain the 10 measures, list the sectors, and move on. But the actual compliance challenge is not implementing a firewall or enabling MFA — most mid-sized businesses already have those. The challenge is proving it.
Auditors do not check your firewall rules. They check your documentation. They want to see that policies exist, are current (reviewed within the last 12 months), have documented management approval, and are versioned with change history. Under NIS2, the evidence is the compliance.
The Commission Implementing Regulation (CIR 2024/2690) translates Article 21 into approximately 30 specific documents that entities must produce and maintain. These are not optional — they are what supervisory authorities will request during an audit or after an incident.
| Evidence type | What auditors check | How a DMS helps |
|---|---|---|
| Policy documents | Current version, management sign-off, review date, version history | Version control, approval workflows, audit trail on every change |
| Risk register | Asset-risk-control mapping, named owners, treatment status, review logs | Structured storage with metadata, search by owner or status |
| Incident records | Timeline, classification, response actions, post-incident review, minimum 5-year retention | Immutable audit logs, retention policies, full-text search |
| Supplier assessments | Vendor questionnaires completed, security clauses in contracts, periodic reviews | Contract storage, tagging by vendor, renewal reminders |
| Training records | Attendance logs, completion dates, management training proof | Document archiving, date-based search, organized by category |
| Management decisions | Board minutes showing cybersecurity discussion, risk acceptance sign-off | Approval workflows with timestamps and named approvers |
The recurring theme is traceability. Every document must answer: who created it, when, who approved it, when was it last reviewed, and what changed since the previous version. A folder on a shared drive does not provide this. A DMS with version history and approval workflows does.
Incident reporting: the 24-72-1 rule
Article 23 mandates a three-stage incident reporting process for significant incidents. Missing these deadlines is itself a compliance violation. Every stage requires documented evidence — which means the quality of your incident records is directly tied to your regulatory exposure.
Early warning
Notify your national CSIRT within 24 hours of becoming aware of a significant incident. This is a preliminary alert — not a full analysis.
Incident notification
Submit an initial assessment of the incident: severity, impact, indicators of compromise, and cross-border effects.
Final report
Deliver a comprehensive report: root cause analysis, remediation measures taken, and cross-border impact. If the incident is still ongoing, submit a progress report instead.
In practice, organizations that lack structured document management scramble to assemble incident evidence under time pressure. Those that maintain organized records — with timestamps, version history, and searchable archives — can produce what regulators need within hours, not weeks.
Where does your country stand?
NIS2 should have been transposed into national law by October 17, 2024. In reality, implementation has been slow. As of April 2026, 21 of 27 Member States have completed transposition according to the ECSO tracker. The European Commission sent reasoned opinions to 19 states in May 2025, giving them two months to complete transposition or face Court of Justice proceedings.
Here is the status of the six largest EU economies:
| Country | Status | Details |
|---|---|---|
| Germany | Transposed | BSI Act adopted December 6, 2025. In force without transitional period. First penalty issued: €850,000 against a cloud provider (February 2026). |
| France | In progress | Loi Résilience passed first National Assembly reading. Final adoption expected Q1/Q2 2026. ANSSI opened investigations into 14 entities. |
| Italy | Transposed | Legislative Decree 138/2024 in force since October 2024. ACN reports 4,800+ registered entities; ~2,000 still unregistered. |
| Spain | Stalled | No legislative progress expected in the near term. |
| Netherlands | In progress | Cybersecurity Act (Cbw) in preparation. Self-assessment deadline for entities set for June 2026. |
| Poland | In progress | Amendment to the National Cybersecurity System Act nearing completion. |
Even if your country has not yet transposed NIS2, the directive applies.
NIS2 has been in effect as EU law since October 18, 2024. National authorities will enforce requirements retroactively once transposition is complete. Starting compliance now — rather than waiting for national legislation — is the only defensible position.
The penalties are real
NIS2 introduces two tiers of administrative fines, modeled after GDPR’s penalty structure. Member States can set maximums above these floors but not below them.
| Entity type | Maximum fine | Turnover alternative | Additional powers |
|---|---|---|---|
| Essential | €10,000,000 | or 2% of global annual turnover (whichever is higher) | Binding instructions, security audits at entity’s expense, temporary management bans |
| Important | €7,000,000 | or 1.4% of global annual turnover (whichever is higher) | Binding instructions, security audits at entity’s expense |
Article 20 adds personal liability: management bodies must approve cybersecurity risk-management measures and oversee their implementation. Members of management can be held personally liable for non-compliance. In some Member States, including Germany, this extends to temporary bans from holding management positions.
Enforcement is following the early GDPR pattern. Germany’s BSI issued 47 formal notices in Q4 2025 and its first financial penalty (€850,000 against a cloud service provider) in February 2026. France’s ANSSI has opened 14 investigations. Italy’s ACN has focused on registration enforcement. Significant financial penalties are expected to increase through 2026–2027 as national enforcement matures.
The January 2026 simplification proposal
On January 20, 2026, the European Commission published a proposal for targeted amendments to NIS2 as part of a broader cybersecurity package. The stated goal is to simplify compliance, increase legal certainty, and harmonize implementation. The proposal will go through the ordinary legislative procedure, with a political agreement targeted for early 2027.
Here is what may change — and what will not:
Will NOT change
- ×The 10 mandatory security measures (Article 21)
- ×Documentation and evidence requirements
- ×Incident reporting timelines (24h/72h/1 month)
- ×Penalty structure and management liability
May change (proposal stage)
- ✓New "small mid-cap" category (<750 employees, <€150M turnover) — reclassified as important instead of essential
- ✓Certification-based compliance pathway via the EU Cybersecurity Certification Framework
- ✓Micro and small DNS providers removed from scope
- ✓Maximum harmonization for implementing acts — less national divergence
The direction is clear: NIS2 is getting simpler to comply with, not weaker. The core obligations remain. If you delay compliance hoping the amendments will exempt you, you are taking a legal risk. The proposal narrows the scope at the edges but does not reduce the requirements for entities that remain in scope.
Practical checklist for SMBs
If you are reading this because your compliance officer said "we might be in scope" — here is the minimum viable path forward. This is not a comprehensive NIS2 implementation plan. It is the set of actions that will get you from zero to audit-ready for the documentation requirements.
Determine if you are in scope
Check your sector against Annexes I and II. Apply the size threshold (50+ employees or €10M+ turnover). If you are unsure, consult your national authority’s registry — several Member States have published entity lists or self-assessment tools.
Classify as essential or important
Annex I sectors are generally essential; Annex II sectors are generally important. The distinction affects supervisory intensity but not the core Article 21 requirements. Document your classification rationale.
Run a gap assessment against the 10 measures
For each of the 10 Article 21 measures, answer: do we have a documented policy? Is it approved by management? Has it been reviewed in the last 12 months? Do we have evidence of implementation? Note the gaps.
Build your evidence pack
Start with the three core registers: risk, incident, and supplier. Add an information security policy, a business continuity plan, and a training log. Each document needs an owner, a review date, version control, and management approval.
Set up document lifecycle management
Every NIS2 policy document needs a creation date, approval record, review schedule, and version history. If you are managing this in a shared folder, you will lose track within months. A DMS with approval workflows and audit trails makes this sustainable.
Schedule management reviews and training
Article 20 requires management bodies to approve cybersecurity measures and undergo training. Schedule quarterly reviews, document attendance, and keep records of decisions. This is the evidence that auditors check first.
How Veluvanto helps with NIS2 documentation
Veluvanto is not a GRC platform. It does not replace your risk assessment methodology or your incident response procedures. What it does is provide the document management layer that makes NIS2 evidence sustainable — the part most businesses struggle with after the initial compliance push.
- ✓Version-controlled document storage: every edit is logged with timestamp, user, and previous version. You can reconstruct the state of any document at any point in time — exactly what auditors require.
- ✓Approval workflows: route policy documents through management sign-off with tracked status. The approval chain creates the evidence trail that Article 20 demands.
- ✓Full audit trail: every document action (upload, view, edit, approve, archive) is logged. No manual tracking required — compliance evidence is generated automatically.
- ✓AI-powered search and organization: find any document in seconds using natural language queries. When an auditor asks for your supplier security assessments from Q3, you can retrieve them immediately rather than searching through folders.
- ✓EU data residency and encryption: documents are stored in the EU with AES-256 encryption at rest and in transit. No data leaves the EU Data Boundary — unlike certain AI-powered tools that route processing through US data centers during peak demand.
- ✓GDPR-compliant by design: per-tenant isolation, SSE-C encryption, and data lifecycle management. NIS2 and GDPR overlap significantly in their documentation requirements — a system that satisfies one gets you most of the way to the other.
The hardest part of NIS2 compliance is not the initial setup — it is maintaining evidence over time. Policies go stale, reviews get skipped, training records disappear. A DMS that enforces version control, tracks approvals, and logs every action turns compliance from a quarterly scramble into a background process.
Sources and further reading
This guide is based on the following primary sources. Dates in parentheses indicate the publication or last-update date of each source.
- Directive (EU) 2022/2555 (NIS2 Directive) — Full text on EUR-Lex (December 2022)
- Commission Implementing Regulation (EU) 2024/2690 — Technical measures for NIS2 compliance (October 2024)
- COM(2026) 13 — Proposal for targeted NIS2 amendments and alignment with the Cybersecurity Act (January 2026)
- ECSO NIS2 Transposition Tracker — 21/27 Member States transposed as of April 2026
- European Commission, Reasoned opinion to 19 Member States on NIS2 transposition (May 2025)
- CyberSmart, "Only 16% of Businesses Are Fully Compliant with NIS2" — Survey of 670 business leaders (April 2026)
- ENISA, NIS2 Technical Implementation Guidance (2025)
- Germany BSI — First NIS2 penalty: €850,000 against cloud service provider (February 2026)
- European Commission Impact Assessment — NIS2 scope: ~160,000 entities across 18 sectors
Related Guides
GDPR Document Management
How to store, organize, and protect personal data in your DMS — NIS2 and GDPR share significant documentation overlap
EU AI Act & Document Management
The other major EU compliance deadline in 2026 — transparency obligations for AI features in your DMS
Document Approval Workflows
How to set up approval chains for policy documents — the foundation of NIS2 governance evidence