The NIS2 Directive

NIS2 (Network and Information Security Directive 2) is the EU's response to growing cyber threats and to the fact that the old NIS Directive covered too few sectors and was applied inconsistently across member states. The goal is a high common level of cybersecurity throughout the Union.

Because NIS2 is a directive, it does not apply directly — each country transposes it into national law. In Sweden this is done through the Cybersecurity Act (2025:1506).

NIS2 designates sectors in two annexes: Annex I (sectors of high criticality) — energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management, public administration and space — and Annex II (other critical sectors) — postal services, waste management, chemicals, food, manufacturing, digital providers and research.

As a rule, organisations that are medium-sized or larger are in scope. They are classified as either essential or important entities, which determines how strict the supervision is.

• Risk-management measures (Article 21): risk analysis, incident handling, business continuity, supply chain security, encryption, access control, multi-factor authentication and more — taking an all-hazards approach.
• Incident reporting (Article 23): an early warning within 24 hours, an incident notification within 72 hours and a final report within one month.
• Management accountability (Article 20): boards and management must approve the measures, undergo training and can be held personally accountable.

The directive sets caps for administrative fines: for essential entities at least up to €10 million or 2% of global annual turnover, for important entities up to €7 million or 1.4%. The exact amounts in Sweden are set out in the Cybersecurity Act.

We build systems that stand up to the NIS2 requirements: secure architecture, logging and incident handling, supply chain security and documentation that holds up under supervision. Talk to us about NIS2-ready systems →

This page is informational and fact-checked against the primary source, but it does not constitute legal advice. For a binding assessment of your specific organisation — talk to us or your legal counsel.