Compliance tools · Cybersecurity and data protection

NIS2 Directive compliance tool

Directive (EU) 2022/2555 · European Union · Binding instrument

Name anyone on your staff. The system makes them your compliance person.

A member of your own staff, with no compliance background, reads the training module, answers the interview, and finishes with your NIS2 Directive documentation cited article by article. The knowledge stays in the business.

Every account level runs inside a dedicated Claude account. Anyone can try a toolkit in their own Claude account; compliance work runs in a dedicated one. The Claude Max plan is £90 a month, paid to Anthropic, and is not included in any level.

See a finished report before you pay

NIS2 Directive is Directive (EU) 2022/2555, a binding instrument in the European Union. Cybersecurity risk management and incident reporting for essential and important entities.

The free assessment screens for NIS2 Directive when a business operates in a critical or essential sector.

Sectors this instrument reaches: energy; transport; banking; financial market infrastructure; health; drinking water; waste water; digital infrastructure; ICT service management; public administration; space; postal and courier services; waste management; chemicals; food production and distribution; manufacturing of critical products; digital providers (online marketplaces, search engines, social networks); research; electronic communications providers; trust service providers; DNS and domain name services.

Size screen: 50 or more employees or turnover above €10 million, and any size for electronic communications providers, trust service providers, DNS and domain name services and entities identified as critical.

Screen your business against all 116 agent toolkits, free →

• Your exact position under NIS2 Directive: what is in place, what is missing, and what to do about each gap.
• Documentation with article citations, ready for auditors, insurers, customers and public buyers.
• A trained person inside the business who understands what the regulation requires, and stays.
• A dated record of every section completed, with the reports themselves staying in your own Claude account. The toolkit is carried by an account level, see the plans.
• All of it completed in-house, at your own pace, without booking a single meeting.

Check that NIS2 Directive applies to your business, free →

Does NIS2 Directive apply to my business?

You are in scope if you are a medium-sized or larger entity in an Annex I or Annex II sector providing services or carrying out activities in the Union, per Article 2(1). Certain entities are caught regardless of size under Article 2(2), including electronic communications providers, trust service providers, TLD registries and DNS providers.

Who does NIS2 Directive apply to?

The Directive applies to public or private entities of a type listed in Annex I or Annex II that meet the medium-sized enterprise test in Article 2(1), plus the size-independent entities listed in Article 2(2). It also covers entities identified as critical entities under the CER Directive, which are essential entities under Article 3(1)(f).

Does NIS2 Directive apply to a small business?

Micro and small enterprises under Article 2(2) and (3) of the Annex to Recommendation 2003/361/EC are generally excluded unless they meet the specific criteria in Article 2(2). Member States must address SME cybersecurity needs in national strategies and keep an SME point of contact under Recital 56.

When does NIS2 Directive apply from, and what are the deadlines?

The Directive entered into force on 16 January 2023 under Article 45, and Member States had to adopt and publish transposition measures by 17 October 2024 and apply them from 18 October 2024 under Article 41(1). Entity deadlines include 24 hours for an early warning and 72 hours for incident notification under Article 23(4).

What does NIS2 Directive require me to do?

You must take the technical, operational and organisational measures in Article 21(2), covering the ten listed areas from risk analysis to multi-factor authentication. Your management body must approve those measures and oversee them under Article 20(1), and you must report significant incidents under Article 23.

What records or documents does NIS2 Directive require me to keep or produce?

You must submit your identity, contact details, sector classification and Member State coverage to competent authorities and notify changes within two weeks under Article 3(4), or within three months for Article 27(1) entities under Article 27(3). Incident reporting requires an early warning, a notification and a final report under Article 23(4).

What happens if I do not comply with NIS2 Directive?

Essential entities face administrative fines of at least EUR 10,000,000 or at least 2 per cent of total worldwide annual turnover, whichever is higher, under Article 34(4). Important entities face at least EUR 7,000,000 or at least 1.4 per cent under Article 34(5), and management body members can be held liable under Article 20(1).

Does NIS2 Directive apply to a UK business selling into the EU?

The Directive applies to entities providing services or carrying out activities within the Union regardless of where they are established, as stated in the territorial scope section. An entity not established in the Union but offering services there must designate a representative in a Member State under Article 26(3).

Does NIS2 Directive apply to an EU business selling into the UK?

An EU business selling into the UK is not addressed by the instrument, which sets out Union territorial scope only. The instrument does not state this.

How is NIS2 Directive different from CER Directive?

Entities identified as critical entities under the CER Directive are considered essential entities under NIS2 by Article 3(1)(f), and Chapters III, IV and VI of the CER Directive do not apply to digital infrastructure sector entities covered by NIS2. The two instruments also require their competent authorities to cooperate and exchange information regularly under Article 13(5).

How do I start complying with NIS2 Directive?

The first practical step is to determine whether you fall within scope and whether you are essential or important, which covers scope, classification and registration. Registration details go to competent authorities under Article 3(4).

Which ComplianceSME account includes the NIS2 Directive toolkit?

The NIS2 Directive agent toolkit is included from the Medium level.

Related in cybersecurity and data protection: GDPR · ePrivacy Directive · CER Directive · DORA