Organisations that were comfortably outside the original NIS Directive keep discovering they are squarely inside its successor. That is the single most important thing to understand about NIS2: it is not a light refresh of the 2016 rules, it is a substantial widening and hardening of them. If your last read of EU cybersecurity law was under the first directive, almost every assumption you formed then is worth re-checking.
The original NIS Directive applied to a relatively narrow set of operators and left a great deal to national discretion, which produced an uneven patchwork across the EU. NIS2 was written to fix exactly that - and in doing so it changed who is covered, what they owe, who is accountable, and what happens when they fail. Five shifts matter most.
Change one: far more organisations are in scope
The biggest change is reach. The original directive covered operators of essential services and certain digital service providers - a limited group, often identified entity by entity at national level. NIS2 replaces that narrow, nationally-designated approach with a broad, rules-based one.
Now, scope follows sector and size: if you operate in one of the many sectors NIS2 lists and you meet the size threshold, you are generally in - no national authority has to tap you on the shoulder first. The sector list itself is much longer, pulling in areas the first directive never touched.
The practical effect is that a large population of mid-market firms that were never "operators of essential services" are now in scope without having changed anything about what they do. This is covered in depth in the scope self-check for mid-market firms; the point here is simply that the net got dramatically wider.
Change two: two tiers, not one undifferentiated group
The original directive did not sort covered entities into supervisory tiers in the way NIS2 does. NIS2 introduces the essential-versus-important distinction, which determines how closely an entity is watched and how hard it is penalised.
Essential entities face proactive, ex-ante supervision; important entities face reactive, ex-post supervision. It is a more calibrated model than the original directive's, letting regulators concentrate scrutiny where the stakes are highest, and it means that "am I in scope" is now followed by a second question the first directive never posed: "in scope as what."
Change three: cybersecurity became a board responsibility
Under the original directive, cybersecurity obligations largely sat at the organisational level. NIS2 pushes them upward, onto the management body itself.
This is one of the most consequential changes, because it reframes cybersecurity from an IT matter into a governance one.
Management bodies now have to approve the risk-management measures, oversee their implementation, undertake training - and can be held personally liable for failures. The original directive had nothing equivalent at this level.
It is the change that has done most to get NIS2 onto board agendas, and it is covered in its own right in the writing on the board's duties and on personal liability. The shift in a sentence: the people running an in-scope entity are now personally in the frame, which they were not before.
Change four: harder, more harmonised obligations
The substance of what entities must do also grew more demanding and more specific. The original directive set out high-level requirements and left much of the detail to Member States, producing inconsistency. NIS2 lays down a more concrete, common set of risk-management measures and a more structured incident-reporting regime.
Two areas hardened in particular. Supply-chain security became an explicit, named obligation rather than a general expectation - entities must now account for the security of their suppliers and providers. And incident reporting moved onto a defined, staged timeline rather than being left loosely to national rules.
Both are substantial pieces in their own right, treated in the Article 21 measures and the incident-reporting clocks respectively; the orientation point is that the floor rose and the variation between Member States narrowed.
Change five: stronger enforcement and penalties
Finally, the consequences changed. The original directive's enforcement was widely seen as weak and inconsistently applied. NIS2 introduces a sharper supervisory and penalty regime, with meaningful maximum fines and a tiered approach to sanctions.
The point of the tougher enforcement is to make the obligations real rather than aspirational. Combined with the personal-liability provisions, it changes the calculus for a board deciding how seriously to take cybersecurity: under the original directive, non-compliance was a modest institutional risk; under NIS2, it is a larger institutional risk with a personal dimension attached.
What this means if you were out of scope before
Put the five changes together and the headline is straightforward: being outside the original NIS Directive tells you almost nothing about your position under NIS2. The scope is wider, the tiers are new, the accountability reaches the board, the obligations are harder, and the enforcement is sharper.
The practical move for any organisation that had filed EU cybersecurity law under "not us" is to re-run the question from scratch against NIS2's actual scope. The most common NIS2 mistake is not failing an obligation, it is never realising the obligations now apply.
The rest of this cluster works through what follows once you establish that they do: who is in scope and as what, the measures themselves, the board's duties, and the incident-reporting timeline.
Frequently asked questions
What is the difference between NIS and NIS2?
Montro's summary: NIS2 replaced the original 2016 NIS Directive with a substantially wider and tougher regime.
The main changes are broader scope (many more sectors and entities, caught by sector-plus-size rather than national designation), a new essential/important two-tier classification, management-body accountability including personal liability, more prescriptive and harmonised obligations, and significantly stronger enforcement. In short, NIS2 covers more organisations, demands more of them, and penalises failure harder.
Why are more organisations in scope under NIS2?
Because NIS2 changed how scope is determined. The original directive covered a narrow set of operators of essential services and certain digital providers, often identified case by case at national level; NIS2 uses a broad sector-plus-size approach across a much longer list of sectors.
The result is that many mid-market organisations are now in scope automatically, without having changed what they do, they simply fall within a covered sector and meet the size threshold.
Did NIS2 introduce personal liability for management?
Yes - this is one of its most significant additions. Under NIS2, the management body must approve and oversee the cybersecurity risk-management measures and undertake training, and members can be held personally liable for infringements.
The original directive had no equivalent board-level accountability, which is why NIS2 has moved cybersecurity from an IT concern onto board agendas.
If we were not covered by the original NIS Directive, are we covered by NIS2?
Quite possibly - and you should not assume otherwise. NIS2's scope is much wider than the original directive's, so a great many organisations that were previously out of scope are now in it, purely by operating in a covered sector and meeting the size threshold.
The safest step is to run the scope assessment afresh against NIS2 rather than relying on your status under the old rules, because the net widened considerably.
