Broader Scope: While NIS 1 focused mainly on critical infrastructure sectors (energy, transport, banking, healthcare, etc.), NIS 2 now includes additional sectors such as public administration, waste and wastewater management, food production and distribution, postal and courier services, space, and digital services (e.g., social platforms, data centres, cloud computing).

Size Cap Rule: NIS 2 introduces a clear size cap – all medium-sized and large entities (generally those with more than 50 employees or an annual turnover above €10 million) in the aforementioned sectors fall under its scope. It should be noted that certain service providers (like DNS, trust services, domain name registration) are included regardless of size due to their criticality.

Essential vs. Important Entities: Entities are now categorized as „essential“ (e.g., energy, healthcare, finance, public administration) and „important“ (e.g., manufacturing, postal, food, digital services), each with tailored requirements and oversight.

Swiss Entities: Subsidiaries or branches of Swiss companies located in the EU fall directly under NIS 2 obligations. Similarly, Swiss companies offering products or services to the EU market, participating in EU supply chains, or who act as suppliers to EU critical infrastructure or digital service providers may be required to meet NIS 2 standards by their European partners.

Finally, sectors newly covered by NIS 2, such as manufacturing, healthcare, digital infrastructure, finance, and even Alpine tourism-related infrastructure, are increasingly regulated in Switzerland through aligned laws (e.g., ISG, upcoming KRITIS laws and ordinances).

Stricter Security Requirements: NIS 2 mandates more comprehensive and risk-based cybersecurity measures than NIS 1, including technical, operational, and organisational controls. Entities must implement information security management systems (ISMS), supply chain security, vulnerability management, and regular cybersecurity training.

Incident Reporting: The directive introduces clearer and stricter incident reporting obligations than NIS 1. Entities must report significant incidents to authorities within 24 hours (early warning), follow up with a detailed report within 72 hours, and submit a final report upon resolution of the incident.

Governance and Accountability: NIS 2 places accountability directly on top management, who must ensure compliance and may face personal liability for failures and non-compliance.

Supply Chain Security: For the first time, NIS 2 explicitly addresses supply chain and supplier relationship security, recognising the interconnected nature of modern business.

Stronger Enforcement: Under NIS 2, national authorities have greater powers to supervise, audit, and enforce compliance, with the ability to impose substantial fines for non-compliance.

Transposition Deadline: Unlike EU regulations, EU directives do not apply automatically. Instead, they set goals that every Member State must achieve, leaving each country with an obligation to pass its own national laws to implement the directive. The deadline for EU Member States to transpose NIS 2 into national law was October 17, 2024.

Some countries may have had a transition period (e.g., up to March 2025 in Germany) for full implementation, but most obligations began from October 2024. As of mid-2025, most EU Member States have yet to meet this deadline. As shown in the table below, many European countries have not yet issued a national law for the implementation of the NIS 2 directive.