The law that made your staff a compliance item.
NIS2 is the EU directive that turned cybersecurity from good practice into a legal duty for tens of thousands of companies. This page explains what it actually asks of a company, without the consultancy fog. It is written to be read in ten minutes and quoted afterwards.
Three questions decide it.
Are you in one of the 18?
The directive lists eleven sectors of high criticality and seven other critical sectors. If your main activity sits in one of them, keep reading.
Are you medium-sized or larger?
The general threshold is 50 employees, or annual turnover above EUR 10 million. Some activities are in scope at any size: for example certain digital infrastructure, and any entity a member state designates as critical.
Does a customer in scope depend on you?
This is the one small companies miss. In-scope entities must manage the security of their direct suppliers. So a 12-person firm that serves a hospital, a municipality or a food producer will be asked to show its own controls, training included, or lose the contract to someone who can.
- Energy
- Transport
- Banking
- Financial market infrastructure
- Health
- Drinking water
- Waste water
- Digital infrastructure
- ICT service management (B2B)
- Public administration
- Space
- Postal and courier services
- Waste management
- Chemicals
- Food production and distribution
- Manufacturing (medical devices, electronics, machinery, vehicles)
- Digital providers (marketplaces, search, social networks)
- Research organisations
Three articles carry the whole weight.
Management owns it. Personally.
The management body must approve the security measures, oversee how they are put in place, and can be held liable for failing to. It must also undergo cybersecurity training itself, and the entity is expected to offer similar training to staff on a regular basis. Several national laws, Sweden's included, turn that expectation into a duty.
THE TRAINING REQUIREMENT IN DETAILA minimum set, not a menu.
- 01Risk analysis and information system security policies
- 02Incident handling
- 03Business continuity, backup and crisis management
- 04Supply chain security, including your direct suppliers
- 05Security in acquiring, developing and maintaining systems
- 06Policies to assess how effective your measures are
- 07Basic cyber hygiene practices and cybersecurity training
- 08Cryptography and, where appropriate, encryption
- 09Human resources security, access control and asset management
- 10Multi-factor authentication and secured communications
Measure seven is the one this site exists for. It is also the only one of the ten that a regulator can check by asking a random employee a question.
The clock starts when you become aware.
You have become aware of a significant incident. Say so, and say whether you suspect it was unlawful or malicious and whether it could spread across borders.
An initial assessment: severity, impact, and any indicators of compromise you have. This updates the early warning rather than replacing it.
A detailed description, the likely root cause, what you did about it and any cross-border impact. If the incident is still running, a progress report instead, and the final one when it ends.
These deadlines are the same in every member state. Only the authority you send them to changes.
Not the video. The register.
Nobody supervising this law will watch your training. They will ask for a document that shows it happened, to whom, and what you did with the result. Six columns cover it.
Every person trained, by name or by an identifier the employer can resolve, with their role.
The topics covered, mapped to the risk areas the law names. A syllabus, not a slogan.
Dates. Enough of them to show the training is continuous, not a single afternoon a year.
Who finished, who did not, and what you did about the ones who did not.
A separate line showing the management body itself was trained. The law names them specifically.
Who delivered it, when the record was produced, and how a third party can check it is real.
Sending this to your IT lead or auditor? There is a one-page version written for them: what PHSHX hands over, in what format, and which article each item answers.
The evidence pageTwo ceilings, and a personal one.
The directive sets minimum maximum fines, which member states may raise. It also allows authorities to hold individual members of the management body responsible, up to and including a temporary ban from holding a management position.
or 2% of worldwide annual turnover, whichever is higher
or 1.4% of worldwide annual turnover, whichever is higher
The core is identical everywhere.
A directive is transposed into each country's own law. The ten measures, the management duty and the reporting clock do not change. What changes is the name of the law, the authority that supervises it, the registration process, and whether the fines are raised above the EU floor.
- Transposition deadline was 17 October 2024. Most member states missed it; by early 2026, twenty of twenty-seven had passed their national law and the rest faced infringement proceedings.
- Sweden: cybersäkerhetslagen, in force 15 January 2026, registration with MSB by 2 February 2026. The law makes management training a duty and requires that staff be offered training.
- Everywhere else: the same articles under a different name. If you operate in several countries, one programme with one register satisfies all of them, provided it is documented.
Eight things, in order.
- 01Confirm whether you are in scope: sector, size, and whether a customer in scope depends on you.
- 02Find out whether you are classified as essential or important. The fines and supervision differ.
- 03Register with your national authority if your country requires it. Sweden's window closed in February 2026.
- 04Name the person in the management body who is accountable for the measures.
- 05Put the management body through training and keep the record.
- 06Offer staff training that repeats, and keep the register of who completed it.
- 07Write down the ten measures as they apply to you. A short honest document beats a long borrowed one.
- 08Rehearse the reporting clock once. Who notices, who decides, who sends the 24-hour warning, to whom.
See what an attacker sees before they use it.
Tell us the domain. You get one page on what is publicly exposed around your company, at a fixed price, within two working days. No call, no demo, no subscription.
This page is a plain-language summary of Directive (EU) 2022/2555 and its Swedish transposition, written for company owners and managers. It is not legal advice. For a decision about your own obligations, read the national law that applies to you or ask a lawyer who has.