NIS2 for UK Companies: Does Your Business Qualify?

For NIS2 UK companies, trading with the EU alone doesn't create direct obligations. Applicability depends on the services provided, the size of the relevant organisation and its connection to an EU Member State.

The distinction matters because direct legal duties differ from security requirements passed down through customer contracts. Post-Brexit, the UK is developing its own cyber security reforms separately from NIS2.

Start by identifying which legal entities and services each regime covers.

Key takeaways

• A UK headquarters doesn't exempt an otherwise covered business from NIS2.

• Certain digital providers can face obligations without an EU establishment.

• Boards must approve and oversee security measures, rather than delegate accountability entirely to IT.

• The UK's NIS Regulations 2018 and proposed reforms are separate from NIS2.

When NIS2 applies to UK companies

The NIS2 Directive broadens sector coverage, strengthens security requirements and increases enforcement penalties compared with the original NIS Directive. However, businesses encounter its obligations through Member States' implementing laws.

The deadline for national transposition was 17 October 2024. It wasn't a universal certification deadline for businesses.

EU establishments, sectors and size

A UK-owned subsidiary operating in an EU Member State can qualify if its activities and size meet the applicable rules.

NIS2 generally covers medium-sized and larger entities in specified sectors. These include energy, transport, health, water, digital infrastructure, managed IT services and certain manufacturing activities. Some entities qualify regardless of size, whilst national designation can bring others within scope.

The size assessment can include linked and partner enterprises. Therefore, a small subsidiary shouldn't assess eligibility using its own headcount alone.

Covered services without an EU establishment

Certain digital providers can fall within NIS2 even without an EU establishment. These include cloud computing providers, data centre providers, managed service providers (MSPs) and managed security service providers offering covered services in the EU.

Providers covered by these representative requirements must designate an EU representative. However, selling ordinary goods to EU customers doesn't automatically create direct obligations.

BSI's NIS2 guidance explains the Directive's requirements and supporting standards. Your scope assessment should record the entity, service, relevant jurisdiction and reasons for inclusion or exclusion.

What security and incident reporting require

Implement proportionate security measures

NIS2 requires appropriate and proportionate technical, operational and organisational measures. These cover risk analysis, incident handling, business continuity, supply chain security and secure system development.

Other requirements include vulnerability handling, access control, security training, cryptography and measures to assess control effectiveness. Multi-factor authentication also features where appropriate.

Build the risk assessment around relevant cyber threats, including ransomware, and the organisation's actual services and dependencies. Record assets, responsible owners, cloud platforms, remote support access and critical suppliers. Then assess likelihood and business impact consistently.

Assess cybersecurity controls against the organisation's services and dependencies. ISO/IEC 27002 control guidance can support control design, but the applicable national requirements determine the legal obligation.

Prepare for staged EU reporting

Under NIS2's general reporting sequence, significant incidents require an early warning within 24 hours of awareness. An incident notification follows within 72 hours, with a final report generally due within one month of that notification.

Different provisions can apply to particular providers. A personal data breach can also create separate GDPR notification duties.

Your incident reporting plan should name an incident lead and deputy, provide out-of-hours coverage and define escalation authority. Staff should report suspicions promptly without deleting evidence or attempting their own investigation.

Board accountability and financial penalties

Management must approve and oversee

NIS2 requires management bodies to approve cyber security risk-management measures and oversee their implementation. It also requires management training, including training for board members.

In practice, board members should set expectations, while senior management allocates resources, monitors compliance and engages relevant stakeholders, including EU regulators. Reporting should help senior management review unresolved risks, overdue actions, supplier exposure and incident exercise findings.

Management should also define who can authorise service suspension, emergency expenditure or external communications during an incident.

Where permanent security leadership isn't practical, our virtual CISO services can support governance and coordination. External support doesn't transfer the board's accountability.

Penalties depend on entity classification

NIS2 distinguishes between essential and important entities. Both face security and reporting duties, but supervision and penalty provisions differ.

For essential entities, national law must provide maximum administrative fines of at least €10 million or 2% of worldwide annual turnover, whichever is higher. For important entities, the corresponding figures are €7 million or 1.4%, whichever is higher.

These are required maximum-fine thresholds, not automatic penalties for every breach. Non-compliance can lead to regulatory action, and national rules can also create management liability.

Beyond regulatory action, failures can cause operational disruption, reputational damage and contractual claims.

How the UK's separate regime is changing

What the NIS Regulations 2018 cover

The Government describes the NIS Regulations 2018 as the UK's only cross-sector cyber security legislation. They cover operators of essential services in transport, energy, drinking water, health and digital infrastructure, plus certain digital services.

Those digital services include online marketplaces, search engines and cloud computing. Twelve competent authorities enforce the framework.

Data centres received critical national infrastructure designation in 2024, the first new CNI sector in almost a decade. CNI designation and regulatory scope are separate questions.

What the proposed Bill would add

The Cyber Security and Resilience Bill, formally the Cyber Security and Resilience (Network and Information Systems) Bill, follows the July 2024 King's Speech announcement. Introduced on 12 November 2025, it proposes changes to UK law rather than wholesale adoption of NIS2.

Its proposed expansion includes medium and large MSPs, with an estimated 900 to 1,100 additional providers entering scope.

Regulators could designate suppliers as critical suppliers if disruption could significantly affect a regulated service. Designated critical suppliers would then have direct duties, not just contractual requirements.

The proposals would let the Information Commissioner's Office enforce non-compliance with registration duties and expand its information-gathering powers over digital service providers.

These proposed measures are distinct from obligations already in force under the existing Regulations.

Prepare UK reporting and supplier arrangements

The proposed UK reporting model would require notification to the regulator and NCSC within 24 hours of awareness of a significant incident. A fuller incident report would follow within 72 hours.

Although those timings resemble parts of NIS2, maintain separate reporting procedures for each applicable jurisdiction. Rehearse them to support cyber resilience. Your incident record should capture awareness time, affected services, operational impact and decisions about notification.

  A supplier notification deadline must leave your organisation enough time to assess the incident and meet its own reporting obligations.  

Contracts should address incident notification, confidentiality, subcontracting, evidence access and secure offboarding. Review the service and certification scope, rather than relying on a supplier's certificate alone.

The evidence supports that focus. The 2024 Cyber Breaches Survey found that half of businesses had experienced a breach or cyber attack in the previous 12 months. Meanwhile, the NIS 2018 Second Post Implementation Review found fewer than one tenth of essential-service operators felt confident managing wider supply chain risk.

The NCSC Cyber Assessment Framework provides a structure for assessing cyber-risk management. Its Basic and Enhanced Profiles define relevant principles and objectives. Use assessment findings to assign corrective actions, owners and completion dates.

Build on existing assurance without assuming equivalence

Use ISO 27001 as a management foundation

ISO/IEC 27001 defines requirements for an information security management system. Its risk assessment, management review and improvement processes can support NIS2 preparation.

However, certification doesn't establish NIS2 compliance. An ISMS scope can exclude services or dependencies that matter under the law.

ISO 27001 training helps staff understand their responsibilities. Our ISO 27001 consultancy can support implementation, whilst internal auditing tests whether controls operate as intended.

Map existing evidence against the applicable legal requirements before commissioning new policies or purchasing tools.

Preserve each framework's purpose

Automotive organisations may already hold supplier and access-control evidence through the TISAX assessment framework. TISAX training and consultancy can support that preparation, but TISAX auditing doesn't determine NIS2 compliance.

Similarly, CMMC addresses requirements attached to applicable US defence contracts, whilst ISO 42001 concerns AI management systems.

Reuse evidence where boundaries and requirements genuinely overlap. However, maintain separate records of legal duties, customer requirements and assessment criteria.

Preparation costs depend on the entities and systems involved, existing control maturity and remediation needs. Prioritise gaps affecting several requirements, such as incomplete asset ownership, inconsistent authentication or missing logs.

Frequently asked questions

Is there a definitive list of affected UK companies?

There isn't a single EU-wide list that settles applicability for every UK business. Scope follows the relevant entity, service, size rules and jurisdiction. National registration or designation arrangements can also matter.

Cloud providers, MSPs and UK-owned EU operations deserve particular attention, but those categories alone don't establish every company's obligations.

Can an EU customer impose requirements on an out-of-scope supplier?

Yes. A regulated customer can require security controls, incident notification and assurance evidence through its contracts. Those obligations can apply even where the supplier has no direct NIS2 duties.

Record whether each requirement arises through legislation or contract. That distinction determines the responsible regulator, enforcement route and evidence needed.

Establish scope before committing resources

For UK companies, NIS2 applicability depends on business activities and jurisdiction, rather than headquarters alone. A documented scope decision gives management a sound basis for allocating resources.

Then connect existing controls to the requirements, close material gaps and rehearse reporting arrangements.

If you would like to find out more information or require any of our services please Contact Us and complete our contact form.