NIS2 misconceptions are not just a knowledge problem. They are a risk problem. When a company operates on a false assumption about what NIS2 requires, who it applies to, or when enforcement begins, the consequences are specific: significant fines, accountability that sits with the managing directors, and a security posture that is weaker than leadership realizes.
NIS2, the EU's updated Network and Information Security Directive, set a transposition deadline of October 2024. Yet a large number of European organizations, particularly SMBs and mid-market companies, are still operating on assumptions about the directive that range from outdated to simply wrong. This article corrects the seven most common, with the facts and context needed to understand what compliance actually involves.
NIS2 Only Applies to Large Enterprises and Critical Infrastructure
This is the most widespread NIS2 myth, and it has left thousands of organizations unprepared.
The original NIS Directive focused primarily on operators of essential services in traditional critical sectors: energy, water, transport, banking, and healthcare. It was, in practice, a regulation for large, strategically important entities. NIS2 is a fundamental expansion of that scope.
The German figures show how far that expansion reaches: the BSI expects around 29,500 entities to fall under its supervision in Germany alone. The directive covers 18 sectors, split into Annex I (essential entities) and Annex II (important entities). Essential sectors include energy, transport, banking, health, water, digital infrastructure, public administration, and space. Important sectors extend into postal and courier services, waste management, chemicals, food production, manufacturing of critical products including medical devices and electronics, digital providers, and research organizations. That list describes a very large share of the European business landscape.
National transpositions group these sectors differently. Germany's BSIG, for example, lists seven sectors in Anlage 1 and seven in Anlage 2, and places public administration in § 29 BSIG rather than in either annex. If you are assessing whether you are in scope, work from your national law, not from the directive's annexes.
The size threshold is also clearly defined, and smaller than many assume. As set out in the official directive text, NIS2 applies to entities with at least 50 employees or an annual turnover exceeding €10 million, operating in one of the covered sectors. That description matches a significant portion of European SMBs that have not yet started their compliance journey. If you are unsure whether your organization falls in scope, the Kertos NIS2 Checker walks you through the assessment in a few minutes.
Being ISO 27001 Certified Means Being NIS2 Compliant
ISO 27001 certification is genuinely valuable. It shows that an organization has built a structured information security management system and subjected it to independent audit. If your organization has achieved it, you already have a strong foundation for NIS2. But calling yourself NIS2 compliant on the basis of ISO 27001 alone is one of the most consequential NIS2 compliance mistakes a company can make.
The two frameworks overlap meaningfully, but they address distinct obligations. Reading NIS2 through the lens of ISO 27001 reveals three critical gaps in particular.
First, incident reporting timelines. NIS2 requires essential entities to submit an early warning to the competent national authority within 24 hours of becoming aware of a significant incident, followed by a fuller notification within 72 hours, and a final report within one month of that notification. ISO 27001 has no equivalent mandatory regulatory timeline. It asks organizations to manage incidents well; it does not impose a legal clock with enforcement consequences attached to missing it.
Second, supply chain security. NIS2 requires organizations to assess and actively manage the security vulnerabilities of their direct suppliers. This extends due diligence well beyond a standard vendor risk questionnaire into a formal, documented supply chain security program. ISO 27001 addresses third-party risk, but NIS2 applies a different level of stringency.
Third, and perhaps most practically significant, management accountability. NIS2 places explicit personal responsibility on senior management and governing bodies for overseeing cybersecurity. ISO 27001 requires management commitment, but attaches no legal consequence to the individuals involved. That is a NIS2-specific obligation that no certification satisfies on its own.
| Requirement | ISO 27001 | NIS2 |
|---|---|---|
| Information security management system | Yes (core requirement) | Yes (implied) |
| Risk assessment and treatment | Yes | Yes |
| Incident management process | Yes (internal) | Yes + mandatory regulatory reporting |
| Incident reporting timeline | Not specified | 24h early warning / 72h notification / final report 1 month after the 72h notification |
| Supply chain security | Addressed (Annex A) | Mandatory, covering direct suppliers |
| Management accountability | No | Yes; in Germany, liability toward the entity itself under § 38 (2) BSIG |
| Regulatory fines for non-compliance | No | Up to €10M under § 65 (5) BSIG; turnover percentages only above €500M total turnover |
| Registration with national authority | No | Yes (in Germany under § 33 BSIG) |
NIS2 Is an IT Department Problem
This assumption is understandable. Cybersecurity has historically lived in the technical domain, managed by IT teams and, in more mature organizations, by a dedicated security function. NIS2 changes that model explicitly and with legal weight.
Article 20 of the NIS2 Directive requires management bodies of essential and important entities to approve cybersecurity risk management measures, oversee their implementation, and complete cybersecurity training. German law implements this in § 38 BSIG, and more narrowly: management must implement the measures under § 30 BSIG and oversee their implementation. The BSIG does not use the language of approval.
This is not a theoretical exposure, but it works differently from how it is usually reported. The NIS2 obligations that fall directly on managing directors take the form, under § 38 (2) BSIG, of liability toward their own organization: a management body that culpably breaches its duties under paragraph 1 is liable to the entity for the resulting loss, under the company law rules applying to its legal form, meaning § 43 GmbHG or § 93 AktG. The BSIG does not provide for personal fines against individual directors. That does not make the rule harmless. A loss from a security incident that proper implementation would have avoided becomes a claim by the company against its own directors, and an insolvency administrator or a new shareholder can pursue it. On top of that, § 38 (3) BSIG obliges management personally to attend training at regular intervals.
The practical implication is that NIS2 compliance requires cross-functional ownership. Security teams handle technical implementation. Legal and compliance teams interpret the obligations. Management implements the measures, oversees their execution, and accepts accountability for the outcome. Organizations that treat NIS2 as a ticket in the IT team's backlog are misallocating both responsibility and risk.
The Deadline Has Passed, So There's No Urgency Anymore
The October 2024 transposition deadline came and went, and for many organizations, nothing dramatic happened immediately. No fines arrived. No auditors appeared. It is tempting to conclude that the urgency was overstated, or that the window to act has already closed.
Both conclusions are wrong, and the second is the more dangerous of the two.
On the transposition timeline: most member states missed the October 2024 deadline, and the European Commission opened infringement procedures in response. On 8 July 2026 it referred Ireland, Spain, France and the Netherlands to the Court of Justice of the European Union over transposition that was still outstanding. In most of the remaining member states the obligations already apply.
Germany is one of them. The NIS2 implementation act was promulgated in the Federal Law Gazette on 5 December 2025 and recast the BSI Act; the obligations have applied since 6 December 2025, and the act contains no substantive transition period. For entities in scope on that date, the registration deadline under § 33 BSIG expired on 6 March 2026. The BSI then accepted registrations without further consequence under an enforcement grace period running to 31 July 2026. Both dates have passed. The registration obligation remains in force, and an organization registering today is catching up on a duty it has already missed.
The BSI has already issued dozens of formal notices to organizations that failed to register or designate a point of contact, with the energy sector and digital infrastructure providers receiving early attention. No major fines have been issued yet, but the escalation path is clearly defined and regulators have shown they intend to follow it.
The window to act has not closed. But organizations that have been waiting for a compelling reason to start now have one: a registration deadline that has already expired, an active national supervisory authority, and duties that attach personally to management. Waiting further does not reduce the compliance gap. It increases the exposure of everyone accountable for it.
NIS2 Compliance Is a One-Time Project, and Supply Chain Is Someone Else's Responsibility
These two beliefs often appear together, and together they represent a fundamental misreading of what NIS2 actually demands.
NIS2 is not a certification you achieve and file away. It is a continuous obligation. The directive requires that risk management measures be maintained, reviewed, and updated on an ongoing basis. Incident reporting obligations are always active. Supply chain security assessments must reflect the current state of your supplier relationships, not a point-in-time snapshot from a project completed two years ago. In Germany, § 33 (5) BSIG requires registrations with the BSI to be updated without undue delay, and within two weeks at the latest, whenever details change.
The continuous nature of NIS2 compliance is one reason compliance automation has become central to how forward-looking security teams approach the directive. Manually maintaining evidence, tracking control status, and managing supplier assessments across a live, changing business is an enormous operational burden, particularly for teams that are already stretched. Platforms like Kertos automate evidence collection, continuously monitor control status across integrated systems, and surface gaps in real time, turning compliance from a periodic sprint into a steady-state function that does not consume disproportionate team capacity.
On supply chain: Article 21 of NIS2 explicitly requires organizations to address "the security of the supply chain, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers." The word "direct" limits the obligation to your first supplier tier, which is the point many projects discover too late after months spent cataloguing sub-sub-processors. At the same time, a supplier register is not enough, because what is required is the security-related aspects of the relationship: an assessment of each provider, and contractual terms that match that assessment. You cannot contract away this responsibility. If a supplier's security failure propagates into your environment and appropriate due diligence was not conducted, pointing to a contract clause does not reduce your regulatory exposure.
Frequently Asked Questions About NIS2 Misconceptions
Does NIS2 apply to our company if we have fewer than 50 employees?
Generally, no. NIS2 applies to entities that qualify as medium-sized or large enterprises under EU Recommendation 2003/361/EC, meaning at least 50 employees, or an annual turnover and balance sheet total each exceeding €10 million, operating in one of the covered sectors. Some entity types are in scope regardless of size, including operators of critical installations, qualified trust service providers, DNS service providers and top-level domain name registries. Smaller organizations may also be affected indirectly: NIS2-covered entities are required to assess the security of their supply chain, which creates expectations for smaller suppliers. Use the Kertos NIS2 Checker to confirm your status.
Does ISO 27001 certification satisfy NIS2 requirements?
Partially. ISO 27001 provides a strong foundation for NIS2, particularly in risk management and security controls. However, NIS2 adds mandatory incident reporting timelines, registration with the national authority, and duties on management that ISO 27001 does not address. In Germany these sit in § 32, § 33 and § 38 BSIG respectively. Organizations with ISO 27001 certification should conduct a gap assessment to identify what additional measures NIS2 requires.
What are the fines for NIS2 non-compliance?
Article 34 of the directive sets out up to €10 million or 2% of global annual turnover, whichever is higher, for essential entities, and up to €7 million or 1.4% for important entities. Germany implements this differently. § 65 (5) BSIG sets absolute amounts as the standard range: up to €10 million for particularly important entities and up to €7 million for important entities. The turnover-based ceilings in § 65 (6) and (7) BSIG apply only to entities with total turnover above €500 million, and only to certain categories of breach. A breach of the registration obligation is dealt with separately and capped at €500,000. The BSIG does not provide for personal fines against individual directors.
What does NIS2 require for incident reporting?
Essential entities must issue an early warning to the competent national authority without undue delay and within 24 hours of becoming aware of a significant incident. A fuller notification follows within 72 hours, and a final report is due within one month of that 72-hour notification. If the incident is still ongoing after a month, a progress report takes the place of the final report for the time being. The authority can also request interim reports. These are mandatory regulatory obligations with enforcement consequences, not internal targets.
Are managing directors personally liable under NIS2?
Yes, but not through a personal fine. Under § 38 (2) BSIG, a management body that culpably fails to implement and oversee the measures required by § 30 BSIG is liable to its own organization for the resulting loss, under company law rules, meaning § 43 GmbHG or § 93 AktG. In addition, § 38 (3) BSIG requires management to attend information security training at regular intervals.
How does Kertos support NIS2 compliance?
Kertos is a European compliance platform that helps organizations achieve and maintain continuous NIS2 compliance. The platform automates evidence collection, maps your security controls to the ten measures required by § 30 BSIG, tracks your compliance program status in real time, and supports supply chain security management. For organizations pursuing ISO 27001 or other frameworks in parallel, Kertos handles multiple frameworks simultaneously, reducing duplication and overhead. Book a demo to see how it works.
NIS2 misconceptions are not a minor inconvenience. They are the reason organizations arrive at enforcement conversations unprepared, with gaps that could have been closed months earlier. The directive is broad, the obligations are legally binding, and the consequences for management are specific enough that they cannot be quietly delegated away. But NIS2 is also achievable. The organizations that approach it clearly, without the filter of wishful assumptions, consistently find that the path to compliance is far more manageable than the myths suggested. Getting the facts right is the only place to start.
New to NIS2? Start with our complete guide to the NIS2 directive for the full overview.
