Cybersecurity is now a board responsibility.
NIS2 raises the cybersecurity bar for organisations that society depends on, including water, health and parts of life science. It requires risk-management measures, fast incident reporting, and makes management personally accountable.
A technical view, not legal advice. Facts checked against the official sources below on 1 November 2026.
- Drinking water and waste water operators
- Healthcare providers and medicinal-product research
- Manufacturers of pharmaceuticals and medical devices
- Medium and large organisations in those sectors, and others a country designates
- 17 Oct 2024 Deadline for countries to turn the directive into national law.
- 15 Jan 2026 Sweden’s Cybersecurity Act (SFS 2025:1506) in force.
- Pending The Commission proposed amendments in January 2026. Not adopted when checked.
Measures, reporting and accountability.
Risk management
Incident handling, business continuity, supply-chain security, secure development, access control, encryption and multi-factor authentication.
Incident reporting
An early warning within 24 hours, a notification within 72 hours and a final report within a month.
Management accountability
The management body must approve and oversee the measures, can be held liable, and must take training.
Penalties
Fines of at least €10 million or 2% of turnover for essential entities, and €7 million or 1.4% for important ones.
From requirement to working system.
NIS2 touches every system you build or buy. New AI and data platforms should strengthen your position under it, not add risk.
- Assess new systems against the NIS2 measures before they go live
- Secure development and supplier management for software you commission
- Logging and monitoring that support the 24-hour reporting window
- Private and EU-hosted platforms where the data and the rules demand it
What does this mean for your systems?
Tell us what you build or run. We will give you a straight, technical answer.
Book a consultation