Skip to content
Blog Who You Gonna Call? Ten NIS2 Myths That Refuse to Stay Dead

Who You Gonna Call? Ten NIS2 Myths That Refuse to Stay Dead

This article originally appeared on The Risk Realist Newsletter on October 20, 2026. 

NIS2 turned two on October 17, 2026. That was the 2024 deadline for EU Member States to write the directive into national law, which makes it the only regulation I know of with a birthday two weeks before Halloween (but to be fair, I didn’t check.) Either way, it’s fitting, because two years in, there have been a lot of tales, ghost stories, and myths people tell each other.

The simplest one is: "Someone looked at it. It doesn't apply to us."

Sometimes that someone is right. Sometimes they read a 2023 blog post and never looked again. And sometimes they were just hoping... the way you hope the noise in the basement is just the furnace.

We've seen all three this year in NIS2 scoping work across various companies we’ve helped. The worst version shows up late in the year and comes because customers, counsel, or various leaders are asking questions.

So, consider this the Risk Realist edition of Myth Busters, with a proton pack. Ten myths, what's actually true, and the one question to put to your legal counsel to bust each one.

Money Monster Underbed Poster

 

MYTH 1 - The ghost who thinks walls stop it

AKA: "We have no EU subsidiary, so NIS2 can't touch us."

NIS2 walks through walls. Article 26 reaches a specific list of digital providers based on where they offer services, no matter where they're headquartered: DNS providers, top-level domain registries, domain registration services, cloud computing, data centers, content delivery networks, managed service providers, managed security service providers, online marketplaces, search engines, social networking platforms.

If you're on that list and you serve EU users without an EU establishment, Article 26(3) says you need a designated representative in a Member State.

Not on the list? You can still end up in the haunted house through Article 21(2)(d), which requires “essential” and “important” entities to manage supply chain security with their direct suppliers and service providers. (See myth 2 for more on Article 21 scope.)

To be fair to the skeptics, this myth also runs the other direction. A sales office in Milan does not automatically make you an “essential entity.” Scope follows what each legal entity actually does by sector and size, and a distribution or holding company can look very different from a manufacturing or R&D site. Which is exactly why it deserves real analysis instead of a hallway answer.

BUST IT WITH THIS QUESTION FOR COUNSEL: Have you analyzed our scope under Article 26 by service category, and separately under Article 21 flow-down through our EU customer contracts? Can I see both, broken out by legal entity?

MYTH 2 - The zombie: NIS1

AKA: "NIS2 only applies to critical infrastructure operators."

The original NIS Directive is dead. NIS2 repealed it as of October 18, 2024. Its narrow scope keeps shuffling through conference rooms anyway, arms out, groaning about utilities.

NIS2 covers a whopping 18 sectors. Annex I covers energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT (information and communication technology) service management, public administration, and space.

Annex II adds postal and courier, waste management, chemicals, food, manufacturing (medical devices, electronics, electrical equipment, machinery, motor vehicles, and other transport equipment), digital providers, and research.

If you make medical devices, chemicals, or machinery and filed this under "a utility problem," this zombie is yours to contend with.

BUST IT WITH THIS QUESTION FOR COUNSEL: Which of our EU-touching business units sit in Annex I or Annex II by sector and size, and does any of them cross into essential entity status?

MYTH 3 - The Rip Van Winkle Effect

AKA: "Enforcement is years away."

Wake up! It started. Germany's NIS2 law took effect December 6, 2025, and registration with the BSI was due March 6, 2026. Roughly 11,500 of an estimated 29,500 entities made it by then. The BSI gave a de facto grace window to July 31, and by that date about 18,845 had registered, according to the nisd2.eu timeline. Now? The grace window is gone.

The duty to register has been overdue since March, and the BSI has called it an obligation backed by fines, even though it hasn't opened proceedings yet.

Belgium's essential entities hit their first conformity deadline on April 18, 2026: a CyFun verification, an ISO 27001 scope and Statement of Applicability, or a request for direct inspection by the CCB. The next gate is April 18, 2027.

Bulgaria's 50% fine discount expired June 1. Austria's new law took effect October 1.

Now, a national law going live does not mean a polite audit invitation is coming on a published calendar. However, country Supervisors can ask for evidence whenever they want it. What matters is whether you can show your work on short notice.

BUST IT WITH THIS QUESTION FOR COUNSEL: In which Member States where we do business is the law in force, and which registration or conformity deadlines have we already missed?

MYTH 4 - The monster under the bed

AKA: "The fines are the main risk."

 

1-Nov-02-2026-06-32-05-6557-PM

Everybody keeps a nervous eye on the fines: up to €10 million or 2% of worldwide turnover for essential entities, and €7 million or 1.4% for important ones. Fair enough. Those are real. The hidden danger is personal liability for management bodies.

Article 20 requires management bodies to approve and oversee cyber risk measures and makes them answerable for failures. Article 32 lets authorities, for essential entities, temporarily bar people at the CEO or legal-representative level from exercising managerial functions.

Bulgaria wrote personal fines of €500 to €5,000 for management body members into its law, plus possible temporary restrictions on management functions at essential entities. And in Germany, failing to register is its own offense. You can be penalized for not being on the list before a regulator ever looks at a single control.

BUST IT WITH THIS QUESTION FOR COUNSEL: What is our exposure under Article 20 management accountability, Article 32 suspension powers, and the registration rules in each Member State where we operate?

MYTH 5 - Evil Twin/The doppelgänger

AKA: "NIS2 is basically GDPR for cybersecurity."

From across the street, it looks familiar. Up close, it's a different creature wearing a similar face (creepy!).

GDPR is a regulation: one law, directly applicable everywhere, with a one-stop-shop lead authority. NIS2 is a directive. Each Member State writes its own version, which gives you 27 national laws, 27 sets of authorities, and 27 procedural rulebooks. Outside a narrow main-establishment rule for certain digital providers, there's no one-stop-shop.

And the creature is still changing shape. As of early October, 24 of 27 Member States had a law in force. France, Ireland, and Spain still didn't. On July 8, the Commission referred those three, plus the Netherlands, to the EU Court of Justice and asked for financial penalties. The Netherlands got its law live on August 15. Meanwhile, the Commission proposed targeted amendments to NIS2 itself in January.

BUST IT WITH THIS QUESTION FOR COUNSEL: For each country where we have operations, customers, or services, do we know the transposing law, the competent authority, and the fine structure? If not, which countries are we prioritizing, and why?

MYTH 6 - The Costume Contest

AKA: "Our ISO 27001 or SOC 2 means we're already covered."

It's a good costume. It covers a lot. But national supervisors do the Scooby-Doo move: they pull off the mask.

Article 21(2) lists ten minimum measures: risk analysis and security policies, incident handling, business continuity and crisis management, supply chain security, security in acquisition, development and maintenance (including vulnerability handling), assessing whether your measures work, cyber hygiene and training, cryptography, HR security with access control and asset management, and MFA with secured communications. ISO 27001 and SOC 2 overlap a big chunk of that. Neither maps one-for-one. Supply chain security under 21(2)(d) in particular reaches further than the way most programs run the ISO 27001:2022 supplier controls (5.19 through 5.23). And your evidence is packaged for your certification auditor, which may or may not be how a national supervisor wants to see it.

Belgium accepts ISO 27001 as one of three conformity paths, with a Statement of Applicability mapped against CyFun. Most other countries haven't said anything nearly that clear.

BUST IT WITH THIS QUESTION FOR COUNSEL: Has anyone mapped our certifications and audit evidence against Article 21(2) for the specific supervisors we'll face? If we don’t have certs/audits, have we done independent assessments against NIS2? What gaps came back?

MYTH 7 - Three knocks at the door

AKA: "Incident reporting is just one notification."

Article 23 knocks three times.

First, an early warning to the CSIRT or competent authority within 24 hours of becoming aware of a significant incident. Second, an incident notification within 72 hours with an initial assessment of severity, impact, and indicators of compromise where available. Third, a final report within one month of that notification. Authorities can also ask for status updates in between.

Each knock has its own content requirements, and missing the 24-hour one is a separate failure from missing the 72-hour one. If your IR plan has a single box that says "notify regulator," that box is about to get spooked. Your playbooks and authority matrix need the full cadence, and legal needs to know who is allowed to hit send at each stage. At 2 a.m. On a Saturday. In a country where you've never filed anything before.

BUST IT WITH THIS QUESTION FOR COUNSEL: Have our IR playbooks and authority matrix been updated to the Article 23 three-stage cadence, and who is authorized to make each submission in each country?

Note: This is one that legal can help with but the CISO and IR plan lead should be driving the action.

MYTH 8 - Trick-or-treat!

AKA: "We can wait for our EU customers to tell us what we owe."

2-Nov-02-2026-06-32-05-9285-PM

 

They will tell you. On their paper. When that doorbell rings, it's a contract amendment, and it's a trick.

Article 21(2)(d) makes essential and important entities responsible for security across their relationships with direct suppliers and service providers. In procurement, that shows up as minimum security clauses, audit rights, incident notification duties, and sometimes certification requirements. The suppliers hit first aren't negotiating much. They're getting amendments to existing master agreements and new preconditions for renewal.

If you wait for the knock, you've already handed over your negotiating position.

BUST IT WITH THIS QUESTION FOR COUNSEL: Have we reviewed our EU customer contracts and sales pipeline for NIS2 flow-down language, and which contracts are likely to come up for renegotiation in the next 12 months?

MYTH 9 - The call is coming from inside the boardroom

AKA: "This is an IT or compliance issue, not a board issue."

Article 20 names the management body. It approves the cyber risk measures, oversees how they're implemented, and can be held liable. Article 20(2) says its members have to complete training. That's a governance obligation with names attached, and the CISO can't absorb it on the board's behalf. Bulgaria went further and put management on a two-year training cycle. And a 5 minute topic on the annual board meeting doesn’t cut it!

Think about which document a regulator asks for first. If your last four board agendas have no cyber item and nobody on the board has had cyber risk training, you've already assembled their evidence file for them.

BUST IT WITH THIS QUESTION FOR COUNSEL: What evidence shows our management body approved the cyber measures, completed training, and is overseeing implementation in a way that meets Article 20 under each relevant national law?

MYTH 10 - Waiting for Godzilla while the bats move in

AKA: "We'll deal with it when somebody gets a big headline fine."

GDPR trained the market to wait for the billion-euro monster movie. My bet is that NIS2's first wave looks a lot more like Germany's registration gap: thousands of small administrative problems for entities that didn't register, didn't notify, or can't produce documents when asked. Each one forgettable on its own. Together, they tell you the regulator has a list and is working it. Italy can request evidence from essential entities for any reason at any time.

The bigger risk is commercial, and it's already in motion. While you wait for Godzilla, your EU customers are running 2027 supplier reviews. The suppliers who keep the business are the ones who can hand over a registration confirmation and an evidence pack the same week someone asks.

BUST IT WITH THIS QUESTION FOR COUNSEL: Where are we today on registration, supervisory contact, and contract posture? If we did nothing for the next six months, what would the cumulative exposure look like?

Assemble your ghostbusting crew

Every good crew splits the work. Here's how I'd divide it.

CISO, you're carrying the meter. In the next 30 days, bring your GC specifics: services that might fall under Article 26, your largest EU customers, your legal entities by country and activity, and whether anyone has reviewed inbound customer amendments for NIS2 language. You don't need the legal answer yet. You need someone on the hook for producing it.

GC, you're the containment unit. Run any existing scoping opinion through the ten questions above. If it's more than a year old, it predates Germany's law taking effect. If it's more than six months old, it predates the end of Germany's grace window, Bulgaria's full fines, the Court of Justice referrals, and Austria's go-live. Ask whoever wrote it to refresh it against current state, in writing.

Outside counsel, your US-headquartered clients with EU customers deserve a refreshed memo. It needs to cover five things: Article 26 scope by service category, Article 21 flow-down through customer contracts, Article 20 management accountability, the Article 23 reporting clock, and country-by-country status wherever the client has operations or customers. A 2024 memo can't do that job in late 2026.

You may well be out of scope. Plenty of companies are. But "someone said so" is a ghost story, and the only thing that busts it is a current answer, from the right person, in writing.

 

...and Ghosts hate paperwork.

 

 

Sources

 
About the author
Aaron Pritz
Aaron Pritz is a veteran cybersecurity professional with experiences within IT, Six Sigma, privacy, insider threat, and risk management. He is the CEO and Co-Founder of Reveal Risk, a boutique cybersecurity, privacy, and risk consultancy and has over 20 years of experience in the field. He held various leadership roles in the pharmaceutical industry for 17 years before pivoting to a client advisory role and co-founding Reveal Risk. He applies robust knowledge, his industry networks, and creativity to solve some of the toughest challenges in the field