NIS2 Compliance 2025: How to Avoid Fines of Up to EUR 10M [Complete Implementation Guide]

The Cybersecurity Revolution Is Here: What Does the NIS2 Directive Mean for Your Business?

October 17, 2024 has come and gone, and with it an era in which many companies could treat cybersecurity as a secondary concern, or even as an IT department indulgence. That day marked the deadline for EU member states to transpose the NIS2 Directive into national law. This is not just another cosmetic legal change. It is a fundamental overhaul of how organizations approach digital resilience, and it reaches thousands of Polish businesses.

For many business leaders, terms like "risk management," "cyber hygiene" and "incident handling" may have sounded like specialist jargon until recently. Because of NIS2, they are now a core part of business strategy, as critical as managing finance, operations or sales. Ignoring the new rules carries more than the risk of heavy fines. It knowingly exposes your company, your customers and your business partners to operational paralysis, data loss and lasting reputational damage.

This article is your guide to the new legal landscape. We explain, thoroughly but in plain language, what the NIS2 Directive is, which companies had to comply, what specific obligations it places on businesses and, most importantly, what those obligations look like in practice. This is not a text for cybersecurity experts. It is written for informed managers and business owners who understand that in a digital world, resilience is a condition for survival and growth.

From NIS1 to NIS2: Why Change Was Necessary

To fully understand why NIS2 matters, we need to look back at its predecessor, the 2016 NIS Directive. It was the first attempt to create an EU-wide legal framework for cybersecurity. It introduced the concepts of "operators of essential services" (OES, known in Poland as OUK) and "digital service providers," and it imposed basic security obligations on them.

Groundbreaking as it was, NIS1 had significant weaknesses. First, as a "minimum harmonization" directive, it gave member states wide latitude in how they implemented it. The result was considerable inconsistency. For example, the same cloud service provider could be classified as an operator of essential services in one country but not in another, creating legal chaos for companies operating across borders. This market fragmentation was a real headache.

Second, the directive's scope proved too narrow. The digital transformation of the economy moved faster than lawmakers anticipated, and many critically important sectors, such as food production and waste management, remained unregulated. The threat landscape was also evolving rapidly. NIS1, negotiated between 2013 and 2016, did not fully address emerging challenges such as supply chain security or growing dependence on cloud services.

EU lawmakers concluded that a new, more ambitious and more harmonized approach was needed. The result was the NIS2 Directive, adopted on December 14, 2022, which replaced NIS1 on October 18, 2024. Its goal is clear: to significantly raise the common level of cybersecurity across the Union by establishing a uniform, robust legal framework for a much broader range of organizations.

Who Does NIS2 Apply To? Check Whether Your Company Is on the List

This is one of the most important questions every business owner had to answer. NIS2 significantly expanded the range of regulated entities while introducing much clearer rules for identifying them. The new rules rest on two main criteria: sector of activity and company size.

A New Classification: Essential and Important Entities

NIS2 dropped the old classification in favor of two new categories:

• Essential Entities: Organizations operating in the most critical sectors (e.g., energy, transport, healthcare), where a disruption would have serious consequences for the economy and society. They are subject to stricter, proactive (ex-ante) supervision.
• Important Entities: Companies in other critical sectors (e.g., postal services, food production, chemicals management) that also play a significant role. They are subject to a lighter, reactive (ex-post) supervisory regime, which means inspections are carried out mainly after a violation has occurred.

Crucially, both categories are required to implement the same minimum security measures and to report incidents. The difference lies mainly in the supervisory approach and the size of potential fines.

18 Regulated Sectors

The directive lists 18 sectors of the economy:

Sectors of high criticality (Annex I of the Directive):

• Energy: Electricity, district heating and cooling, oil, gas, hydrogen.
• Transport: Air, rail, water and road.
• Banking and financial market infrastructure: Credit institutions, trading venue operators.
• Healthcare: Healthcare providers, EU reference laboratories, manufacturers of critical pharmaceuticals and medical devices.
• Drinking water and wastewater.
• Digital infrastructure: Cloud service providers, data center providers, electronic communications networks, TLD name registries and DNS service providers.
• ICT service management (B2B): Managed service providers (MSPs) and managed security service providers (MSSPs).
• Public administration: Central and regional government bodies.
• Space.

Other critical sectors (Annex II of the Directive):

• Postal and courier services.
• Waste management.
• Manufacture, production and distribution of chemicals.
• Production, processing and distribution of food.
• Manufacturing: Medical devices, computers, electronics, machinery, motor vehicles.
• Digital providers: Online marketplaces, search engines, social networking platforms.
• Research.

The Size Criterion: Who Falls Under the Rules?

As a general rule, NIS2 covers all medium-sized and large enterprises operating in the listed sectors. Under the EU definition, a medium-sized enterprise is one that employs at least 50 people and has an annual turnover or balance sheet total exceeding EUR 10 million.

Important: there are a number of significant exceptions under which even micro and small businesses must comply with NIS2. Regardless of size, the directive covers, among others, providers of public electronic communications networks, trust service providers, TLD registries, DNS service providers, and entities that are the sole provider of an essential service in their country.

The Domino Effect: Supply Chain Security

Even if your company does not directly qualify as an essential or important entity, you could not afford to ignore NIS2. One of the directive's fundamental requirements is supply chain security. This means every regulated entity must assess and manage the risks posed by its direct suppliers.

In practice, if a small IT firm provides services to a large energy company, the energy company must make sure its supplier's cybersecurity standards are sufficiently high. ISO 27001 certification has become a de facto requirement in the supply chains of NIS2-regulated entities. The client will likely require specific policies and procedures to be in place, and meeting them has become a condition for continued business. In this way, NIS2 creates a "ripple effect" that spreads good practices across the entire economy.

Key Obligations for Businesses: A Practical Guide

At the heart of the NIS2 Directive are two pillars of obligations: risk management and incident reporting. These have had the greatest impact on how companies operate day to day.

Pillar 1: Comprehensive Risk Management

NIS2 requires organizations to implement "appropriate and proportionate technical, operational and organizational measures." Cybersecurity can no longer be treated as purely an IT problem. It has become a strategic issue for which the management board is personally accountable.

• Management Accountability: Management bodies must approve security measures and oversee their implementation. Moreover, board members can be held liable for violations. The directive also requires them to undergo regular training. Put simply, the ball is now in the board's court.
• An "All-Hazards" Approach: Companies must take an approach that covers all threats, protecting systems and their physical environment against cyberattacks, theft, fire, flooding and power outages.
• Minimum Set of Security Measures: Article 21 of the Directive lists at least 10 areas that must be covered. At a minimum, a company must have:
  1. Policies on risk analysis and information system security.
  2. Incident handling procedures.
  3. Business continuity and crisis management, including backup management and disaster recovery plans.
  4. Supply chain security, including assessment of supplier-related risks.
  5. Security in the acquisition, development and maintenance of systems, including vulnerability management.
  6. Policies and procedures to assess the effectiveness of the measures in place (e.g., through audits).
  7. Basic cyber hygiene practices and employee training.
  8. Policies and procedures on the use of cryptography and encryption.
  9. Human resources security, access control policies and asset management.
  10. Multi-factor authentication (MFA) and secured communication systems.

Tip: One of the most effective ways to demonstrate NIS2 compliance is to adopt international standards. See how ISO 27001 helps you meet the directive's requirements and build resilience. Keep in mind, too, that NIS2 directly affects strategic sectors such as energy and transport, which must pay particular attention to business continuity.

Pillar 2: Strict Incident Reporting

If a company experiences a "significant incident," NIS2 imposes a strict, multi-stage obligation to report it to the national CSIRT.

• What Is a "Significant Incident"? One that has caused or is capable of causing severe operational disruption or financial loss, or that has affected other organizations by causing considerable damage.
• A Reporting Timeline You Cannot Miss:
  • Within 24 hours of becoming aware of the incident: submit an early warning.
  • Within 72 hours of becoming aware of the incident: submit an incident notification with an initial assessment of its severity.
  • At the CSIRT's request: an intermediate report may be required.
  • Within one month of the incident notification: submit a final report. If the incident is still ongoing, a progress report is submitted instead, followed by a final report within one month of the incident being resolved.

Supervision and Penalties: What Are the Consequences of Non-Compliance?

The NIS2 Directive gives national supervisory authorities a powerful arsenal of enforcement tools.

• Essential entities: Subject to proactive (ex-ante) supervision, which means regular inspections and audits.
• Important entities: Subject to reactive (ex-post) supervision, meaning authorities step in mainly after receiving evidence of a violation.

Regardless of category, if a violation is found, the authority can impose heavy administrative fines:

• For essential entities: up to EUR 10,000,000 or at least 2% of total annual worldwide turnover.
• For important entities: up to EUR 7,000,000 or at least 1.4% of total annual worldwide turnover.

In extreme cases, authorities can even seek a temporary suspension of business activities or a ban on the CEO holding management positions.

Conclusion: An Obligation That Became an Opportunity

The NIS2 Directive has become one of the biggest regulatory challenges European companies have faced in recent years. It has demanded investment, commitment and a fundamental shift in mindset. Yet viewing it only as a burdensome obligation would be a mistake.

Above all, NIS2 is an opportunity to build strong digital resilience, which in today's world is an invaluable business asset. Companies that approached implementation professionally did more than avoid fines. They earned customer trust, strengthened their market position and secured business continuity. It is an investment in the future that has clearly paid off. The law is already in force, so now is the time to make sure your company fully complies with the new reality.