EU NIS2 directive implementation affects thousands of entities

The implementation of the EU's NIS2 cybersecurity directive is progressing across member states, imposing significant operational requirements on various sectors. In Germany, the NIS-2 Implementation and Cybersecurity Strengthening Act has established a legal framework affecting approximately 29,500 entities. Other nations have also enacted measures, including Luxembourg in May 2026 and the Netherlands in August 2026.

The directive aims to protect critical infrastructure by expanding the scope of regulated sectors to include food production, processing, and distribution, as well as certain manufacturing branches. This expansion has raised concerns regarding the complexity of the regulations, with some reports suggesting that even large-scale food producers, such as ice cream manufacturers, could fall under the mandate.

Key requirements include strict incident reporting protocols: companies must provide an initial early warning within 24 hours of a significant security incident, followed by a detailed report after 72 hours, and a final comprehensive report within one month. While the European Commission notes that small and micro-enterprises are generally exempt, the directive also introduces personal liability for management and requires enhanced supply chain security.