The NIS2 directive: what changes for your organization
The NIS2 directive (Network and Information Security 2) significantly extends the scope of organisations subject to cybersecurity obligations in Europe. With penalties of up to 10 million euros or 2% of worldwide annual turnover, NIS2 compliance becomes a board-level priority. An AI GRC platform like Vailor helps you structure the work and sustain it over time.
NIS2 requirements covered by AI GRC
NIS2 requires risk-management measures in several areas: risk analysis and security policies, incident handling, business continuity, supply chain security, and assessment of how effective the measures are. Vailor covers risk analysis (EBIOS RM or flash assessment, prefilled by the AI from your documents), compliance tracking against the NIS2 and ANSSI ReCyF framework, and the third-party register linked to your organisation and assets. Operational incident handling stays in your response tools.
Compliance strategy with Vailor
Step 1: frame the scope and assess your controls against the NIS2 and ReCyF framework to identify gaps. Step 2: run risk assessments with EBIOS RM, or with a flash assessment for less critical projects. Step 3: track the action plan, with measures costed in effort and budget and prioritised from P1 to P4. Step 4: collect each piece of evidence once, attach it to the control and reuse it for your other frameworks, such as DORA. Step 5: steer with dashboards, reminders and a summary for the management body.
NIS2 timeline and penalties
Member States had to transpose the directive by 17 October 2024 at the latest. The applicable timeline then depends on each national law and its implementing texts: check it for every country you operate in. Penalties are significant: up to €10M or 2% of worldwide turnover for essential entities, and up to €7M or 1.4% for important entities, whichever amount is higher. Don't wait for the last deadline to start your compliance project.
Are you in scope, and as an essential or an important entity?
The first piece of work is legal, not technical. NIS2 applies by sector and by size: as a rule it captures entities that reach the medium-sized enterprise threshold, with exceptions that pull in certain players whatever their size, particularly in digital infrastructure. Being classified as an essential or an important entity then shapes everything that follows, because the supervision regimes differ (oversight exercised up front on one side, action triggered by evidence of a shortcoming on the other) and the penalty ceilings are not the same. Two mistakes recur. The first is waiting for a letter from the national authority, when the directive relies on entities identifying and registering themselves. The second is reasoning at group level, when the obligation reads subsidiary by subsidiary and country by country. So before any tooling project, produce a dated scoping note, signed off by legal, listing the entities you hold in scope, the ones you exclude, and the reason for each call.
Incident reporting: rehearse the decision chain, not the form
The directive sets a short reporting cadence for significant incidents: an early warning within twenty-four hours, a fuller notification within seventy-two hours, and a final report within one month. What stalls in practice is almost never the form, it is the decision. Who, at two in the morning on a Sunday, holds the mandate to qualify an incident as significant and commit the organisation in front of the authority? Three things must exist before the first incident: written qualification criteria the on-call rota can apply without a legal ruling; a named list of people authorised to report, with their deputies; notification templates pre-filled for the stable parts (entity identity, scope, technical and legal contacts). Then rehearse the chain in a tabletop exercise, with a stopwatch. The metric worth tracking is not the number of incidents, it is the lag between detection and qualification, because that is what eats the twenty-four hour budget.
Holding compliance over time: governance, evidence, measurement
NIS2 is not satisfied by a file assembled once. It puts the management body on the hook: that body must approve the cybersecurity risk-management measures, oversee their implementation and take training itself, with personal liability possible where it falls short. The directive also expects an organisation to be able to assess how effective its own measures are, which means evidence that ages well. Four indicators are enough to steer by: the share of measures with a named owner and a due date, the median age of the evidence held in the file, the lag between a risk assessment and the actual update of the treatment plan, and the share of critical suppliers reassessed within the year. This is where tooling changes the economics of the exercise: a control maintained in one place, dated evidence reused everywhere, and time moves back towards decisions and remediation instead of document formatting.
Conclusion: AI in the service of your NIS2 compliance
NIS2 compliance is long-haul work. AI makes it more manageable by cutting the time spent collecting and writing risk assessments, and a framework structured by control avoids redoing the same work from one text to the next. Book 30 minutes: we listen to your NIS2 context and priorities, and tell you concretely how Vailor addresses them.