Is your organisation subject to NIS2?

Your organisation is subject to NIS2 if it operates in one of the 18 sectors covered by the directive and meets the size criteria — 50 or more employees, or €10 million or more in annual revenue. Certain critical operators are always in scope regardless of size, and public authorities are covered as well. Use the sector overview on this page to check where you fit.

The NIS2 Directive required EU member states to transpose it into national law by 17 October 2024, though several member states finalised their laws later — Denmark's NIS 2 Act, for example, entered into force on 1 July 2025. Requirements apply from the date of national implementation.

Yes. Central government bodies are explicitly covered by NIS2 and classified as essential entities regardless of size. Regional public administration bodies are typically classified as important entities, and member states can extend coverage to local government — Denmark, for example, covers municipalities through their sector activities. All are subject to the requirements of Articles 21 and 23, including systematic certificate management and TLS certificate monitoring.

Both categories are subject to the same requirements under Article 21. The difference lies in the intensity of supervision and the level of fines: essential entities face stricter proactive supervision and can be fined up to €10 million or 2% of global turnover. Important entities face a somewhat lower fine ceiling — up to €7 million or 1.4% — but the requirements for certificate management and NIS2 compliance are identical.

Important entities can be fined up to €7 million or 1.4% of global turnover. Essential entities up to €10 million or 2%. Senior management can be held personally liable. Supervisory authorities may conduct inspections and issue binding instructions.

Yes, indirectly. NIS2 Article 21(2)(d) and Article 22 require NIS2-covered organisations to address security across the entire supply chain. In practice, this means they will impose concrete security requirements on suppliers — including requirements for certificate management and TLS configuration. If you supply a NIS2-covered organisation, expect to be asked about this.

Supervision is carried out by each member state's designated national NIS2 supervisory authority. For financial sector entities, the relevant financial sector regulator typically acts as sector-specific supervisory authority. The exact body depends on your sector and country — consult your industry association or national authority if you are unsure who supervises your organisation.

NIS2 covers 18 sectors across the EU, divided into essential entities — such as energy, transport, banking, healthcare, water and wastewater, digital infrastructure and central public administration — and important entities, such as postal and courier services, waste management, chemicals, food, manufacturing, research and digital providers. Essential entities face stricter supervision and higher fines, while important entities face lighter supervision, but both categories are subject to the same Article 21 requirements for certificate management and TLS security.

The first step is to build an asset inventory of all your TLS certificates and the systems they protect — this is the first thing a NIS2 supervisory authority will ask for. From there, conduct a risk assessment, set up proactive certificate monitoring, and ensure audit-ready documentation. NIS2 Article 21 specifies ten security categories you must implement, and these four steps are the immediate first priorities for IT teams.