Skip to Content

NIS2 in 2027: A Compliance Roadmap for Mid-Sized Companies

Where NIS2 stands in November 2026, who is covered, what the law requires, which deadlines fall in 2027 in Germany, Austria and Italy, and a practical seven-step roadmap for mid-sized companies.
By METANOW SHPK, Gleni Isaku November 11, 2026
November 11, 2026 by
METANOW SHPK, Gleni Isaku

NIS2 is no longer a project for later. The EU directive had to be transposed by 17 October 2024, Germany’s implementation law has applied since 6 December 2025 and Austria’s since 1 October 2026. For many mid-sized companies, 2027 is the year in which supervisors move from registration to checking whether security measures actually work.

This guide covers what applies today, what changes in 2027 and what is only proposed. Research checked: 11 November 2026. It is general information, not legal advice; confirm your own classification with a lawyer or your compliance adviser.

The short answer

If your company has at least 50 employees, or more than €10 million in annual turnover and balance sheet, and works in one of the NIS2 sectors, you are very likely in scope. You must register with the national authority, implement documented risk management measures, report significant incidents within 24 hours, and make sure your management approves, supervises and is trained on cybersecurity. Even if you are too small to be covered, your customers in scope will pass many of these requirements on to you through contracts.

Where NIS2 stands (November 2026)

  • 16 January 2023: the NIS2 Directive, (EU) 2022/2555, entered into force.
  • 17 October 2024: deadline for Member States to transpose it. Italy applied its decree from 16 October 2024; most countries were late.
  • 6 December 2025: Germany’s NIS2 implementation act (NIS2UmsuCG) took effect and the new BSI Act applies to around 29,500 companies and institutions.
  • 6 March 2026: the legal deadline for German entities to register with the BSI passed. Late registration is still required.
  • 8 July 2026: the European Commission referred Ireland, Spain, France and the Netherlands to the EU Court of Justice for failing to notify full transposition.
  • 1 October 2026: Austria’s NISG 2026 entered into force, with registration due by the end of 2026.

The Commission’s transposition overview lists the national laws country by country. Where a national law is still missing, the directive’s obligations do not yet bind companies directly, but they will once the law applies, usually without a long grace period.

Does NIS2 apply to your company?

NIS2 uses three tests: the sector, the size and, in some cases, the type of service regardless of size.

  • Sectors: Annex I (highly critical) covers energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management, public administration and space. Annex II covers postal services, waste management, chemicals, food, manufacturing of medical devices, electronics, machinery and vehicles, digital providers and research.
  • Size: medium-sized companies with at least 50 employees or more than €10 million in turnover and balance sheet are generally covered. Large companies with 250 or more employees, or more than €50 million turnover and €43 million balance sheet, in an Annex I sector are usually essential (“besonders wichtig” in Germany).
  • Regardless of size: qualified trust service providers, DNS service providers, top-level domain registries and providers of public electronic communications are covered even when they are small.
  • Supply chain: a company that is not in scope still feels NIS2 when a covered customer asks for security clauses, evidence and incident notification in supplier contracts.

Managed IT service providers, managed security service providers, cloud computing providers and data centre operators are all in the digital infrastructure or ICT service management sectors. If you host or operate systems for others, check this carefully.

What NIS2 requires

Article 21 of the directive, and § 30 of the German BSI Act, require appropriate, proportionate and documented technical and organisational measures. At minimum they must cover:

  • risk analysis and information security policies;
  • incident handling;
  • business continuity, including backup management, disaster recovery and crisis management;
  • supply chain security, including the security of relationships with direct suppliers and service providers;
  • security in the acquisition, development and maintenance of systems, including vulnerability handling and disclosure;
  • procedures to assess whether the measures are effective;
  • basic cyber hygiene and cybersecurity training;
  • policies on cryptography and, where appropriate, encryption;
  • human resources security, access control and asset management;
  • multi-factor or continuous authentication and secured communications where appropriate.

For cloud providers, data centres, managed service providers, online marketplaces and similar digital providers, Implementing Regulation (EU) 2024/2690 spells out these measures in detail and defines when an incident counts as significant.

Incident reporting: 24 hours, 72 hours, one month

For a significant incident, § 32 BSI Act follows the directive’s three-stage model:

  • an early warning without undue delay and at the latest within 24 hours of becoming aware, saying whether malicious action or cross-border impact is suspected;
  • an incident notification within 72 hours with a first assessment of severity and impact and, where available, indicators of compromise;
  • a final report no later than one month after the notification, or a progress report if the incident is still ongoing.

Twenty-four hours is short. The clock starts when you become aware, so the decision who classifies an incident, who reports it and through which portal has to be made before anything happens.

Management is accountable

Under § 38 BSI Act, the management of covered entities must implement the risk management measures and supervise their implementation. Managers who breach this duty are liable to the company under the rules of company law that apply to its legal form, and they must attend training regularly so they can recognise and assess cyber risks. Cybersecurity can no longer be delegated entirely to the IT department.

Fines and enforcement

The directive sets maximum fines of at least €10 million or 2% of worldwide annual turnover for essential entities and €7 million or 1.4% for important entities. In Germany, § 65 BSI Act applies the percentage caps only to companies with more than €500 million in total turnover; failing to register can cost up to €500,000. Essential entities face proactive supervision, while important entities are mainly supervised after an indication of non-compliance.

Germany: what the NIS2UmsuCG means in practice

Registration in Germany has two steps: first an account with “Mein Unternehmenskonto”, which uses ELSTER organisation certificates, then registration in the BSI portal, which opened on 6 January 2026. The legal deadline expired on 6 March 2026, three months after the law took effect. According to the BSI’s NIS-2 obligations page, entities must register no later than three months after they first fall under NIS2, and report changes within two weeks.

Operators of critical facilities have an additional duty: they must prove their measures through audits, inspections or certifications every three years, at a date set by the BSI. For everyone else, 2027 will be the year in which risk analyses, documentation and incident processes are expected to exist when the BSI asks for them.

Austria and Italy: deadlines in 2027

In Austria, the NISG 2026 has applied since 1 October 2026. Essential and important entities must register through the business service portal USP; the Federal Office for Cybersecurity names 31 December 2026 as the end date, while the three-month rule in the law can run to 4 January 2027. Missing registration can lead to fines of up to €50,000, or €100,000 for repeat cases.

In Italy, Legislative Decree 138/2024 has applied since 16 October 2024. Entities first added to the NIS list in 2026 must report significant incidents from 1 January 2027, which means naming a CSIRT contact by the end of 2026, and must adopt the basic security measures by 31 July 2027, according to the National Cybersecurity Agency (ACN). Entities listed in 2025 have been reporting since January 2026.

What could change in 2027, and what is only proposed

Two Commission proposals would amend NIS2: targeted amendments in COM(2026) 13 of 20 January 2026, covering scope, size rules and registration, and the Digital Omnibus COM(2025) 837, which proposes simpler incident reporting. On 21 October 2026 the Council agreed its position on the Digital Omnibus and replaced the single EU reporting portal with national entry points. Neither proposal is law; the European Parliament has not yet voted, and the Commission must also review NIS2 by 17 October 2027. Plan with the rules in force, not with drafts. If you also use AI, our guide to the EU AI Act in 2027 covers the parallel AI deadlines.

A 2027 roadmap for mid-sized companies

1. Confirm your scope and register

Check your sector against Annexes I and II, calculate employees and turnover using the EU definition of SMEs, which can include partner and linked companies, and document the result even if you conclude that you are not covered. If you are in scope and not yet registered, register now. Late registration is still better than none.

2. Run a risk analysis and gap check

Map your critical services, the systems behind them and the suppliers they depend on. Compare what you have against the ten minimum measures and record the gaps with an owner and a date. This document is what a supervisor or customer will ask for first.

3. Make incident reporting work in practice

Define what a significant incident is for your company, who decides, who reports and who talks to customers. Run a tabletop exercise with a realistic case such as ransomware or a hosting outage. Our article on how we handle outages, 500 errors and malware shows what the first hours look like in practice.

4. Secure backups, access and patching

Use multi-factor authentication for all administrative and remote access, keep tested offline or immutable backups, and patch internet-facing systems quickly. The choice between managed and shared hosting matters here, because it decides who is responsible for updates, monitoring and restores.

5. Manage your suppliers

List the suppliers that can affect your critical services, ask for evidence such as ISO/IEC 27001 certificates or audit reports, and add security and incident notification clauses to contracts. For cloud choices, data location and support are part of the risk; see our comparison of Hetzner, AWS and Azure for SMEs.

6. Train management and staff

Book regular training for managing directors, as the law requires, and run short, role-based awareness sessions for staff. Keep attendance records. Phishing and stolen credentials remain the most common way in.

7. Document, measure and review

Keep policies, risk decisions, training records and incident logs in one place, define a few metrics such as patch times and backup test results, and review them every six months. If you lack the people to run this, a managed IT service provider can take over monitoring and operations, but legal responsibility stays with your management.

How Metanow helps

Metanow has worked on cloud, hosting and ERP projects since 2022, and Metanow Cloud hosts websites and applications for more than 10,000 businesses. We help mid-sized companies with the technical side of NIS2: managed hosting with monitoring, backups and patching, multi-factor access, logging, asset and supplier registers in Odoo, and incident workflows automated with n8n. We are not a law firm or a certification body; we work alongside your legal adviser and auditor so that the documentation matches the systems.

Frequently asked questions

Does NIS2 apply to companies with fewer than 50 employees?

Usually not directly. NIS2 covers medium and large companies in the listed sectors, but some providers are covered regardless of size, such as DNS service providers, top-level domain registries, qualified trust service providers and public electronic communications providers. Small suppliers are also affected indirectly through customer contracts.

What are the NIS2 incident reporting deadlines?

A significant incident must be reported with an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours and a final report no later than one month after the notification. In Germany these deadlines are set out in § 32 of the BSI Act.

Is it too late to register for NIS2 in Germany?

The legal deadline for entities covered when the law took effect was 6 March 2026, but registration is still mandatory and the BSI keeps accepting it. Register through Mein Unternehmenskonto and the BSI portal as soon as possible, because a missing registration can be fined up to €500,000.

What NIS2 fines can a mid-sized company face?

Under the directive, the maximum is at least €10 million or 2% of worldwide turnover for essential entities and €7 million or 1.4% for important entities. In Germany the percentage caps apply only above €500 million in total turnover, and managing directors can be liable to their company if they fail to supervise the measures.

Will NIS2 change in 2027?

Two proposals, COM(2026) 13 and the Digital Omnibus, would change scope, registration and incident reporting, and the Commission must review the directive by 17 October 2027. As of November 2026 neither proposal has been adopted, so companies should comply with the rules currently in force.

Get your NIS2 roadmap ready for 2027

Metanow can review your hosting and IT setup, close technical gaps such as backups, patching and multi-factor access, and build asset, supplier and incident registers in Odoo with n8n automation. We work alongside your legal adviser, so the paperwork and the systems tell the same story.

Official sources

Want help with this for your business?

Our team turns these ideas into working websites, marketing, automation and ERP systems. Let’s talk about what would move the needle for you.

Book a call

Comments