What Is The Impact Of The EU's New Network And Information Systems Directive For Businesses?

Summary

Forming part of the EU's broader digital and cyber security strategy, the new Network and Information Systems Directive 2022/2555 (NIS2) came into effect on 18 October 2024 (this being the deadline by which the directive is required to be implemented into national law, although this process is not yet complete). It replaces NIS Directive 2016/1148 and complements the EU's Cyber Resilience Act (discussed in a recent BCLP insight). The revised directive is intended to cast a wider net and bring more industries and sectors directly within its regulatory remit. In-scope businesses will therefore need to ensure appropriate risk-management procedures are embedded across their organisations. Senior management also need to understand the oversight which they are required to exercise, given the personal liability for cybersecurity failings which NIS2 now mandates.