EU directive · Directive (EU) 2022/2555 on a high common level of cybersecurity
NIS2
NIS2 requires essential and important entities in many sectors to manage cybersecurity risks and report significant incidents. It applies to organisations rather than products, but product makers often meet it as suppliers or as entities in scope themselves.
Checked 18 Oct 2026
What it asks
- Cybersecurity risk-management measures approved by management.
- Reporting of significant incidents within the set deadlines.
- Supply-chain security and secure development and maintenance.
- Management accountability and training.
How Complia supports the work
- 01
References down to the article
Requirements arrive with their NIS2 article reference and a link to the official text, so every task shows where it comes from.
- 02
Owner, evidence and review
Each requirement gets an owner, linked evidence and an independent review – the same workflow as every other source.
- 03
Cross-mapping
See where it overlaps with the CRA, ISO/IEC 27001 or your own standards, so evidence collected once supports several requirements.
What stays with you
NIS2 is implemented through national law – what applies to you depends on your country and sector. The structure in Complia follows the directive and is unchecked until you verify it.
Other frameworks
See it with your own product.
We go through your requirements, owners and next steps in a walkthrough.