NIS1 vs NIS2: what changed?
NIS1 vs NIS2: scope widened from 7 to 18 sectors, an end to case-by-case designation, accountable management, 24-hour reporting and harmonised fines explained.
NIS2 has replaced NIS1 since 18 October 2024, and the biggest change is scope. NIS1 covered operators designated case by case in 7 sectors. NIS2 automatically covers medium-sized and large organisations in 18 sectors. It also tightens obligations: management accountability, supplier security, 24-hour incident reporting and harmonised fines.
To check whether NIS2 applies to you, see Who does NIS2 apply to?.
NIS1 in brief
Directive (EU) 2016/1148, known as NIS1, was the first EU-wide cybersecurity law. It created two categories:
- operators of essential services (OES), designated one by one by each Member State in 7 sectors;
- digital service providers (DSPs): online marketplaces, search engines and cloud computing services, excluding micro and small enterprises.
NIS2 repeals NIS1 with effect from 18 October 2024 (Article 44 of Directive (EU) 2022/2555).
The main differences
| Topic | NIS1 | NIS2 |
|---|---|---|
| Sectors | 7 sectors for OES, plus 3 types of digital service | 18 sectors (11 in Annex I, 7 in Annex II) |
| How you enter scope | Case-by-case designation by the state | Automatic sector and size criteria, plus some designations |
| Categories | OES and DSPs | Essential and important entities |
| Security measures | General principles, detailed by each state | 10 minimum measures listed in Article 21 |
| Suppliers | Barely covered | Supply chain security mandatory |
| Management | No specific accountability | Approval, oversight, training and accountability (Article 20) |
| Incident reporting | ”Without undue delay” | Early warning within 24 hours, notification within 72 hours, final report within one month (Article 23) |
| Fines | Set freely by each state | Harmonised minimum ceilings: at least €10m or 2% of worldwide turnover (essential), €7m or 1.4% (important) |
The three changes that matter most
1. Scope becomes automatic. Under NIS1, an organisation knew it was covered because the state told it so. Under NIS2, scope follows from sector and size criteria set in the directive, and national laws organise how entities identify and register themselves. Many organisations covered for the first time do not know it yet.
2. New sectors and new players. Manufacturing, food, waste management, chemicals, postal services, research and space join the list. So do managed service providers and managed security service providers (MSPs and MSSPs), now in Annex I. See Which sectors are covered by NIS2?.
3. Governance moves to the board. Article 20 provides that management bodies approve the measures, oversee their implementation and can be held liable for failures. It also provides for their training.
What happens to former operators of essential services?
The directive allows Member States to classify NIS1 operators of essential services as essential entities automatically (Article 3(1)(g)). Whether each country uses this option depends on its national law.
Article 3 also classifies large entities in Annex I sectors as essential, and many former operators of essential services are large organisations in those sectors. How this applies to a given organisation depends on national law and is best checked with a legal adviser. See NIS2 essential vs important entities.
And national regimes?
NIS1 and NIS2 sit alongside existing national regimes for critical operators. In France, for instance, the 2013 military programming law (LPM) created cyber rules for operators of vital importance, which coexist with NIS2. See Does NIS2 replace France’s LPM cyber rules?.
Talk to an expert
Moving to NIS2 mostly means being able to detect and report incidents quickly. If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.
Frequently asked questions
Are measures taken for NIS1 still valid?
They are a useful foundation, but they often covered a narrow perimeter. Article 21 of NIS2 refers to measures protecting the network and information systems the entity uses for its operations or services.
Are NIS1 digital service providers still covered?
Online marketplaces, search engines and cloud services remain in scope, now split between Annex I (cloud) and Annex II (digital providers), under NIS2's size rules.
Will NIS2 itself be amended?
On 20 January 2026 the Commission proposed targeted amendments, notably on scope and jurisdiction. They are under negotiation and do not apply today.
Is NIS2 stricter on incident reporting?
Yes. NIS1 asked for notification "without undue delay". NIS2 sets a three-step timetable: early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month. It also defines what makes an incident "significant" (Article 23(3)).
Does NIS2 cover the whole company or only certain systems?
Article 21 of NIS2 refers to the network and information systems the entity uses for its operations or to provide its services. The exact perimeter for a given organisation is a question for national law and its legal adviser.
Who supervises NIS2 compliance?
Each Member State designates one or more competent authorities. In France, that role falls to ANSSI.
This article provides general information for guidance only. It is neither legal advice nor a contractual commitment from Cyna: service terms are those of the contract agreed through your partner MSP. For any regulatory question, consult your legal adviser.