NIS2 Directive requirements explained: video brief

No. The Directive creates obligations that your national competent authority supervises, not a certificate. Article 24 lets Member States require certain ICT products, services or processes certified under European cybersecurity certification schemes, a different matter. The Commission's January 2026 package proposes a future EU certification of an entity's cybersecurity posture with a presumption of conformity; until one exists, a "NIS2 certificate" is a vendor's badge.

Not by itself, though it is the strongest starting point. Articles 21 and 25 point to European and international standards, and ENISA's June 2025 guidance maps the Implementing Regulation to ISO/IEC 27001:2022 while stating that following it does not in itself mean compliance. Typical gaps: a narrower certificate scope, the reporting clock, management-body duties, registration and supplier requirements. Belgium's authority lists ISO/IEC 27001 as one recognised pathway for essential entities.

It depends on sector, size and national decisions. Annex I entities above the medium-sized ceilings are essential, as are qualified trust service providers, top-level domain registries and DNS service providers of any size, public electronic communications providers of at least medium size, central government bodies and critical entities under the CER Directive; other entities in scope are important unless designated essential. Measures are the same; supervision and fine ceilings differ.

Yes. In-scope cloud, data centre, content delivery, DNS and domain, managed and managed security service providers and certain online platforms that serve the Union must designate a representative in a Member State where they offer services. More often NIS2 arrives by contract, because entities in scope must manage their direct suppliers' security. NIS2 does not apply in the United Kingdom, which has its own NIS Regulations 2018; a bill before Parliament in September 2026 would amend them.

Significant incidents, which cause or could cause severe operational disruption or financial loss to you, or considerable material or non-material damage to others. Your CSIRT or competent authority gets an early warning within 24 hours of your becoming aware, a notification with an initial assessment within 72 hours, an intermediate report if asked and a final report within one month of the notification. The Implementing Regulation adds thresholds for digital providers, such as direct financial loss above €500,000 or 5% of annual turnover, whichever is lower.