NIS2 in effect: What the EU cybersecurity directive means for training and management accountability

For years, Europe's approach to cybersecurity regulation was fragmented and uneven. The original NIS Directive, adopted in 2016, applied to a relatively narrow set of operators and left enforcement largely to each member state's discretion. NIS2, which member states were required to transpose into national law by October 2024, changed that. It expanded the scope dramatically, introduced explicit obligations around training and management accountability, and attached meaningful penalties. As enforcement ramped up through 2025, organizations across the EU, and many outside it that do business there, had to take notice. Here is what changed and how security awareness training fits in.

Who NIS2 covers

NIS2 applies far more broadly than its predecessor. It categorizes organizations into two tiers: essential entities and important entities. Essential entities include large operators in sectors like energy, transport, banking, health, water, and digital infrastructure, plus certain public administration bodies. Important entities cover a wider range of medium and large organizations across sectors including food, manufacturing, digital providers, and postal services. The directive also applies to the supply chains of these entities, meaning even smaller organizations that serve covered entities may face indirect pressure to meet the standards.

The shift from technical to governance

One of NIS2's most significant changes is its emphasis on governance and accountability. The directive requires management bodies to approve and oversee the cybersecurity risk-management measures, and it can hold individual managers personally liable for serious failures, including in some member states through fines or temporary bans on holding management roles. This moved cybersecurity from an IT concern to a board-level responsibility, and it meant that documented, functioning security programs, including training, became evidence that leadership takes the obligation seriously.

Where training fits in the requirements

NIS2 explicitly includes cybersecurity training among the measures organizations must implement. Article 21 requires that entities take measures that include security policies, incident handling, supply chain security, and crucially, cybersecurity training and a culture of security within the organization. This is not a vague suggestion. It is a named obligation, and auditors and national authorities will expect to see evidence that training is delivered to staff and management, updated regularly, and documented. The directive's wording makes clear that training is a foundational control, not an optional add-on.

The incident reporting clock

NIS2 tightens incident reporting requirements significantly. Covered entities must provide an early warning within 24 hours of becoming aware of a significant incident, a fuller notification within 72 hours, and a final report within one month. These timelines, like the SEC rules in the United States, place a premium on employees recognizing and reporting incidents quickly. A workforce that hesitates to flag something suspicious delays the clock and increases the risk of non-compliance. Training that emphasizes prompt, blame-free reporting directly supports the reporting obligations.

Penalties that get attention

The penalties under NIS2 are substantial enough to change behavior. Essential entities can face fines of up to 10 million euros or 2 percent of global annual turnover, whichever is higher. Important entities face fines up to 7 million euros or 1.4 percent of turnover. Enforcement varies by member state, and some have been slower than others to transpose the rules, but the direction is clear. Organizations that treat NIS2 as a compliance checkbox they can defer are taking a real risk.

How to prepare

Practical preparation starts with understanding whether your organization is in scope, directly or through its supply chain. From there, the priorities are: implement and document the required risk-management measures, including training; establish and test incident reporting procedures that can meet the 24- and 72-hour timelines; ensure management bodies are actively involved in approving and overseeing the security program; and maintain records that demonstrate compliance. A documented, current security awareness program with completion records is one of the most straightforward pieces of evidence to produce, and one of the most frequently examined.

The bigger picture

NIS2 is part of a broader global shift toward enforceable, governance-focused cybersecurity regulation. Alongside the SEC rules in the United States and other national frameworks, it signals that cybersecurity is no longer a voluntary best practice but a legal obligation with teeth. Organizations that build documented, functioning programs now, including regular training for staff and management, will find themselves well positioned not just for NIS2 but for the next wave of regulation that is certain to follow.