NIS2 has drawn a great deal of attention, and a great deal of confusion with it. Plenty of smaller companies know the directive exists but are unsure whether it actually applies to them, and what they are expected to do if it does. This article answers both questions, starting with the basic one: does NIS2 apply to you, and what follows if it does?
What NIS2 is
NIS2, the second Network and Information Security Directive, is the EU’s cybersecurity directive, replacing the original NIS Directive. Sweden implements it through the Cybersecurity Act, which came into force on 15 January 2026. The law, the requirements and the dates are covered in the complete guide to the Cybersecurity Act. The aim is to raise the level of cybersecurity in essential and digital operations across the EU.
Does it apply to you?
NIS2 applies in the first instance to organisations in listed sectors. It divides them into “essential” and “important” entities depending on sector and size.
The sectors covered include energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, public administration and space, along with a number of digital services such as search engines, cloud services and data centres.
As a rule of thumb: if your company has more than 50 employees and turnover above 10 million euro, and operates in one of the listed sectors, you should find out whether you are covered. Companies below those thresholds can still be caught if they play a critical role in a supply chain.
When it does not apply directly, but still reaches you
The common scenario for a smaller company is indirect. Your customers, who might be public authorities, energy companies, hospitals or telecoms operators, are covered by NIS2, and they pass requirements on to their suppliers. So you can find yourself answering questions about your cybersecurity maturity, your incident routines and your risk management without the law naming you at all.
That is the kind of customer demand pushing compliance down through the supply chain. How to read and answer it is covered in supplier security requirements.
What NIS2 requires if you are covered
For those directly caught by the law, the requirements fall into four areas.
Risk management and security measures: you need systematic processes for identifying, assessing and managing cybersecurity risk. That covers technical measures (firewalls, access control, encryption) and organisational ones (policies, training, clear responsibility).
Incident reporting: serious incidents have to be reported to the competent authority. The clock is tight. An initial notification within 24 hours of becoming aware of the incident, and a full report within 72 hours.
Governance and accountability: management is personally accountable for compliance. That is a deliberate tightening compared with the original NIS Directive.
Supply chain security: you have to assess and manage the risks tied to your suppliers and subcontractors.
What to do now
Step one is to establish whether you are directly covered, ideally with your lawyer or your trade body. Step two, whatever the answer, is to review your basic security routines: incident response, password policy, access control and logging. Those are sensible measures under any regime, and they strengthen your position with customers who ask.
NIS2 is, at bottom, a market expectation that became law. Companies that take security seriously have a head start, commercially as well as in regulatory terms.
Want to know where you stand before the demands arrive? Take our Compliance Health Check and get a position per area.
