Updated:
June 21, 2026
NIS2 Addresses EU Compliance Gaps
The European Commission’s proposed NIS2 amendments would revise the EU’s flagship cybersecurity directive before many member states have fully settled their national rules, seeking to clarify scope, ransomware reporting, cross-border supervision, and the role of ENISA. The proposal, published on January 20, 2026, remains subject to approval by the European Parliament and the Council of the EU.
What Are The Proposed NIS2 Amendments Announced On January 20, 2026?
The proposed NIS2 amendments are a European Commission package to revise Directive (EU) 2022/2555 for legal clarity, lower administrative burden, and closer alignment with the proposed Cybersecurity Act 2. The Commission said the changes would make EU cybersecurity compliance easier for companies operating across member states.
The proposal is listed as COM(2026) 13 final under procedure 2026/0012(COD). It is part of a wider cybersecurity package that includes a proposed replacement for the 2019 Cybersecurity Act and new rules on ICT supply-chain risk.
The Commission said the NIS2 changes would clarify scope and definitions, reduce compliance burden for 28,700 companies, including 6,200 micro and small-sized enterprises, and add a small mid-cap category expected to reduce compliance costs for 22,500 companies.
What Is The NIS2 Timeline From NIS1 To The 2026 Amendment Proposal?
NIS2 traces back to the first NIS Directive, adopted in 2016, which created the EU’s first broad cybersecurity law for network and information systems. NIS2 was adopted in 2022, entered into force in January 2023, and had to be transposed into national law by October 17, 2024.
The first major compliance problem came after the transposition deadline. On November 28, 2024, the Commission opened infringement procedures against 23 member states that had not fully transposed the directive. On May 7, 2025, it sent reasoned opinions to 19 member states.
The Commission then proposed targeted NIS2 changes on January 20, 2026, after a broader simplification drive and feedback on overlapping EU cyber laws. The European Parliament’s legislative train listed the proposal as tabled in March 2026. The latest available public status does not show final adoption as of June 18, 2026.
What NIS2 Requirements Would The 2026 Amendments Clarify?
The 2026 NIS2 amendments would clarify scope, definitions, jurisdiction rules, ransomware data collection, cross-border supervision, and links between NIS2 compliance and EU cybersecurity certification. The Commission said the proposal is meant to reduce uncertainty without replacing the core duty to manage cyber risk and report significant incidents.
The existing NIS2 framework covers 18 critical sectors across the EU. It requires essential and important entities to take cybersecurity risk-management measures, report significant incidents, support supply-chain security, and accept management accountability for compliance failures.
The proposed amendments would refine application in sectors such as electricity and chemicals, where the Commission said more precise legal drafting was needed. They would give submarine data cable infrastructure broader coverage and add more harmonized ransomware reporting data, including attack vectors and mitigation measures.
Which Companies And Sectors Are Affected By The NIS2 Amendments?
The NIS2 amendments affect essential and important entities across the directive’s sector list, including energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, space, postal services, waste management, chemicals, food, manufacturing, digital providers, and research.
The Commission said the targeted amendments would ease compliance for 28,700 companies and include 6,200 micro and small-sized enterprises. It said the new small mid-cap category would reduce compliance costs for 22,500 companies.
Companies outside the EU can be affected when they provide regulated services into the Union. Legal analyses of the proposal noted that representative appointment and cross-border supervision rules are part of the Commission’s reform package, which matters for cloud, managed services, online platforms, and other providers serving multiple EU markets.
What Penalties And Enforcement Tools Apply Under NIS2?
NIS2 penalties remain tied to national implementation, but the directive sets EU-level maximum fine structures. Essential entities can face administrative fines of at least up to €10 million or 2% of total worldwide annual turnover, whichever is higher. Important entities can face fines of at least up to €7 million or 1.4% of turnover.
NIS2 gives competent authorities supervisory powers, including inspections, audits, security scans, information requests, binding instructions, and orders to implement recommendations. It makes top management responsible for approving risk-management measures and overseeing implementation.
The 2026 amendments do not appear to create a separate EU fine schedule. Their enforcement significance lies in jurisdictional clarity, ENISA coordination, and more uniform data collection, especially for cross-border entities and ransomware incidents.
What Should Organizations Do Now To Prepare For The NIS2 Amendments?
Organizations should treat the NIS2 amendments as a clarification track, not a reason to pause compliance work. Practical steps include confirming national transposition status, mapping entity classification, reviewing incident reporting workflows, documenting ransomware response data, and testing cybersecurity controls against existing NIS2 duties.
Security teams should update asset inventories, supply-chain risk processes, vulnerability management, access control, logging, backup testing, incident response, and business continuity evidence. Legal and compliance teams should track whether national rules classify the organization as essential or important.
Cross-border providers should document which member state has jurisdiction, whether a local representative is required, and which authority receives notifications. Companies should prepare ransomware reporting fields covering detection, attack vector, mitigation measures, ransom demand, payment amount, and payment method where authorities request those details.
How Has Industry Reacted To The NIS2 Amendment Proposal?
Industry response has focused on legal certainty, national fragmentation, ransomware reporting burden, and whether EU cybersecurity certification can become credible compliance evidence. Trade and professional groups generally welcomed clearer rules while warning that overlapping EU cyber laws still create practical compliance pressure.
ISC2 said in June 2026 that the package updates existing EU cyber instruments rather than creating a new regime. It described the proposal as part of a broader effort to make the cyber rulebook more usable for professionals and regulated entities.
Cybersecurity sector group ECSO said in March 2026 that the Cybersecurity Act revision and NIS2 amendments support legal certainty and reduce fragmentation. Technology industry group DigitalEurope warned that supply-chain and certification reforms must work in practice and avoid excessive burden.
What Government Actions Are Driving The NIS2 Amendments?
The main government actions are the original NIS2 Directive, national transposition work, Commission infringement proceedings, the Digital Omnibus, and the January 20, 2026 cybersecurity package. The Commission said the amendments form part of the EU’s regulatory simplification and cybersecurity resilience agenda.
The Commission sent letters of formal notice to 23 member states on November 28, 2024, after the October 17, 2024 transposition deadline passed. It sent reasoned opinions to 19 member states on May 7, 2025, giving them 2 months to act before possible referral to the Court of Justice of the EU.
The European Parliament and Council must now review the amendment proposal through the ordinary legislative procedure. Once adopted, member states would need to transpose the final changes into national law.
What Are The Business Costs And Operational Risks From NIS2 Uncertainty?
NIS2 uncertainty increases costs because companies must comply across uneven national laws while watching for EU-level amendments. The biggest risks are duplicate reporting, unclear jurisdiction, inconsistent scope, different registration portals, conflicting supervisory practices, and vendor contract demands tied to NIS2 status.
The operational burden is highest for companies active in several EU member states. Those businesses may need multiple local filings, different incident contacts, and country-specific interpretations of essential or important entity status.
The proposed amendments could reduce some costs through clearer scope, small mid-cap rules, and EU certification paths. The proposal could increase reporting work where ransomware incidents require more structured details.
What Questions Remain About The NIS2 Amendments In 2026?
The main open question is whether the European Parliament and Council will adopt the Commission’s NIS2 amendments as proposed. The final scope, small mid-cap treatment, ransomware reporting fields, ENISA coordination role, and links to EU cybersecurity certificates may change during negotiations.
A second question is how member states will manage transposition timing. Several national NIS2 regimes were still settling after the original October 17, 2024 deadline, and the proposal could require further legislative changes once adopted.
The broader significance is that the EU is trying to reduce cyber compliance fragmentation while still expanding its cyber rulebook. NIS2, DORA, the Cyber Resilience Act, the Cyber Solidarity Act, and the proposed Cybersecurity Act 2 now form a dense compliance system for companies operating in Europe.
How Bright Defense Helps Organizations Prepare For NIS2 Amendments
Bright Defense helps organizations strengthen the cybersecurity practices commonly associated with NIS2 requirements through penetration testing, continuous compliance, security assessments, and vulnerability management. Our services help teams identify security gaps, validate controls, improve incident readiness, and gain greater visibility into risks across critical systems, cloud environments, and third-party relationships.
Sources Cited In This NIS2 Amendments Report
- European Commission — New Measures To Strengthen Cybersecurity Resilience And Capabilities (January 20, 2026)
https://commission.europa.eu/news-and-media/news/new-measures-strengthen-cybersecurity-resilience-and-capabilities-2026-01-20_en - European Commission — Proposal For A Directive As Regards Simplification Measures And Alignment With The Cybersecurity Act (January 20, 2026)
https://digital-strategy.ec.europa.eu/en/library/proposal-directive-regards-simplification-measures-and-alignment-cybersecurity-act - EUR-Lex — COM(2026) 13 Final, Proposal Amending Directive (EU) 2022/2555 (January 20, 2026)
https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=COM%3A2026%3A13%3AFIN - European Commission — Cybersecurity Package Questions And Answers (January 20, 2026)
https://digital-strategy.ec.europa.eu/en/faqs/cybersecurity-package-questions-answers - European Commission — NIS2 Directive: Securing Network And Information Systems (Accessed June 18, 2026)
https://digital-strategy.ec.europa.eu/en/policies/nis2-directive - European Commission — The Commission Calls On 23 Member States To Fully Transpose The NIS2 Directive (November 28, 2024)
https://digital-strategy.ec.europa.eu/en/news/commission-calls-23-member-states-fully-transpose-nis2-directive - European Commission — Commission Calls On 19 Member States To Fully Transpose The NIS2 Directive (May 7, 2025)
https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive - European Commission — NIS2 Directive Transposition In EU Countries (July 1, 2025)
https://digital-strategy.ec.europa.eu/en/policies/nis-transposition - EUR-Lex — Commission Implementing Regulation (EU) 2024/2690 (October 17, 2024)
https://eur-lex.europa.eu/legal-content/EN/PIN/?uri=oj%3AL_202402690 - European Parliament — Legislative Train: Targeted Amendments To The NIS2 Directive (March 2026)
https://www.europarl.europa.eu/legislative-train/carriage/targeted-amendments-to-the-nis2-directive/report?sid=10101 - ISC2 — EU CSA2 And NIS2 Updates: The Proposals And The ISC2 Response (June 5, 2026)
https://www.isc2.org/Insights/2026/06/EU-CSA2-NIS2-Updates-Proposals-and-the-ISC2-Response - ECSO — Cybersecurity Act Revision And NIS2 Directive Amendments: ECSO Reaction (March 2026)
https://ecs-org.eu/?publications=cybersecurity-act-revision-and-nis2-directive-amendments-ecso-reaction - DigitalEurope — EU Cybersecurity Rules: Fixing Certification, Supply Chains And Critical Entities (May 2026)
https://cdn.digitaleurope.org/uploads/2026/05/Fixing-certification-supply-chains-and-critical-entities-CSA2-position-DIGITALEUROPE.pdf - Skadden — European Commission Announces Potential NIS2 Cybersecurity Reform With Implementation Well Underway (March 2026)
https://www.skadden.com/insights/publications/2026/03/european-commission-announces-potential-nis2-cybersecurity-reform - DLA Piper — NIS2 Update: EU Moves To Harmonise Cyber Controls, Refine Scope, And Add New In-Scope Entities (February 16, 2026)
https://www.dlapiper.com/en/insights/publications/2026/02/nis2-update-eu-moves-to-harmonise-cyber-controls-refine-scope-and-add-new-in-scope-entities
Get In Touch
