The EU is already rewriting NIS2 while many Member States are still transposing it, and the proposed changes would move some organisations in or out of the essential category, change how security measures are specified and add new ransomware reporting fields. In January 2026 the European Commission proposed a targeted directive amending NIS2 (Directive (EU) 2022/2555), COM(2026) 13, procedure 2026/0012(COD), alongside the Cybersecurity Act 2 proposal. This guide explains what the amending proposal would change, how it interacts with national transposition and the Cybersecurity Act 2, and what security and compliance teams should do while it is negotiated. It is for organisations already in NIS2 scope or close to its size thresholds.
Source note: we could not access the proposal text itself, so this page is based on the European Parliament's Legislative Observatory procedure file and summary, and on summaries by Covington, DLA Piper, Morrison Foerster and SZA Schilling, Zutt & Anschütz. Each change is attributed to its sources, and figures appear only where at least two independent sources agree. This is a proposal and may change in negotiation. Confirm against the official text before relying on it.
Key takeaways
- It is still a proposal. As of 10 November 2026 the Legislative Observatory lists the file as awaiting a committee decision in Parliament, with a draft report tabled on 24 September 2026; current national NIS2 rules continue to apply.
- A new small mid-cap tier. Covington, Morrison Foerster and SZA report a small mid-cap category of fewer than 750 employees and turnover up to 150 million euros, treated at most as important entities.
- Scope moves both ways. Micro and small DNS providers would leave scope, while European Digital Identity Wallet and European Business Wallet providers and submarine data cable operators would be added.
- Article 21 measures could become maximum harmonisation. Where the Commission adopts implementing acts, Member States could not add their own technical requirements on the same points.
- Ransomware reporting gets harmonised fields. Standard reports would cover attack vector and mitigations, with ransom demand and payment details on request.
Where the proposal stands
| Date | Step | Source |
|---|---|---|
| 14 January 2026 | Proposal COM(2026) 13 dated in the Legislative Observatory | Legislative Observatory |
| 20 January 2026 | Published with the Cybersecurity Act 2 package | Covington; DLA Piper |
| 26 February 2026 | ITRE rapporteur appointed | Legislative Observatory |
| 24 September 2026 | ITRE draft report tabled | Legislative Observatory |
| 13 October 2026 | Committee amendments tabled | Legislative Observatory |
When checked on 10 November 2026, the Legislative Observatory showed no committee vote, plenary vote or Council position on this file. We do not know when negotiations will conclude. DLA Piper expected adoption in late 2026 or, more likely, 2027. DLA Piper, Morrison Foerster and Covington all report a 12 month transposition period after entry into force in the Commission draft, which negotiators may change.
What would change, by area
| Area | Proposed change | Reported by |
|---|---|---|
| Size tiers | New small mid-cap category (fewer than 750 employees; turnover up to 150 million euros or balance sheet up to 129 million euros), important entities at most | Morrison Foerster; SZA; Covington (turnover figure); Legislative Observatory (category) |
| DNS | Micro and small DNS service providers removed from scope | Legislative Observatory; DLA Piper; Covington |
| New entities | European Digital Identity Wallet and European Business Wallet providers and operators of submarine data transmission infrastructure brought into scope; SZA reports submarine infrastructure as essential | DLA Piper; Morrison Foerster; SZA |
| Sector definitions | Clarified scope for healthcare providers, electricity producers, hydrogen and chemicals; chemicals limited to manufacture and production, removing distribution | Legislative Observatory; Morrison Foerster; Covington |
| Article 21 measures | Maximum harmonisation where Commission implementing acts specify measures | Legislative Observatory; DLA Piper; Morrison Foerster |
| Certification | Compliance could be shown through an organisational cyber posture certificate under the European Cybersecurity Certification Framework; authorities could not impose additional supervisory measures on aspects a valid certificate covers | Legislative Observatory; Morrison Foerster; Covington |
| Ransomware reporting | Harmonised data on attack vector and mitigations; ransom demand and payment details on request | Legislative Observatory; DLA Piper; Covington |
| ENISA | New role supporting supervision of cross-border entities and mutual assistance; not a one-stop shop | Legislative Observatory; Covington |
| Supply chain | Commission guidelines on supply chain security requirements passed to suppliers, to stop obligations being pushed onto entities outside scope | Legislative Observatory; SZA |
| Post-quantum | Member States to include post-quantum cryptography migration policies in national strategies | Legislative Observatory; DLA Piper |
Supply chain and the Cybersecurity Act 2 link
The scope note for this page asked about ICT supply chain and high-risk supplier provisions. Our sources split them clearly. SZA reports that the NIS2 amendment deals with supply chain security only through Commission guidelines that standardise the structure, format and level of detail of supplier questionnaires (Recital 9), while the designation of high-risk suppliers and key ICT assets sits in the separate Cybersecurity Act 2 proposal, 2026/0011(COD). The Legislative Observatory summary describes the guidelines as aimed at preventing undue passing on of obligations to suppliers outside NIS2 scope.
In practice this means two things. If you buy from suppliers, your current Article 21(2)(d) questionnaire is likely to be reshaped by those guidelines, so avoid building a large bespoke one now. If you are a supplier outside scope, you may see fewer pass-through clauses once the guidelines exist. For the high-risk supplier regime itself, see the EU Cybersecurity Act and EUCS Guide; for current Article 21 supply chain duties, see the NIS2 Supply Chain Security Guide.
How it interacts with national transposition
- Current law still applies: DLA Piper advises following existing national NIS2 rules while preparing for the new framework. Track your Member State in the NIS2 Transposition Tracker.
- National extras could be overridden: under maximum harmonisation, national technical requirements on points covered by a Commission implementing act would have to go. Covington gives Belgium's coordinated vulnerability disclosure policy as an example of a national addition under the current minimum harmonisation model.
- Existing implementing act: for digital infrastructure and ICT service providers, Implementing Regulation (EU) 2024/2690 already specifies measures; see the NIS2 Implementing Regulation 2024/2690 Guide.
- Digital Omnibus overlap: Covington notes that the Digital Omnibus of 19 November 2025 made separate NIS2 changes on single incident reporting; see the EU Digital Omnibus Guide.
Decision guidance by entity type
| You are | What the proposal would mean | What to do now (our recommendation) |
|---|---|---|
| Essential entity with fewer than 750 staff and turnover up to 150 million euros | Likely to become important at most, with ex post supervision | Keep your programme; model the change but do not cut controls before adoption |
| Small DNS provider | Likely out of scope | Stay compliant with national law until the amendment is transposed |
| Wallet provider or submarine cable operator | Would come into scope | Run a gap assessment against Article 21 and Article 23 now |
| Chemicals distributor | Likely out of scope | Confirm with your national authority before changing anything |
| Multinational group | ENISA coordination of cross-border supervision | Map which authorities supervise each entity today |
| Supplier to in-scope entities | Standardised questionnaires | Prepare one evidence pack you can reuse across customers |
Ransomware and identity evidence
The harmonised ransomware fields would ask whether an attack was detected, how it got in and what mitigations are in place, with ransom and payment details on request. Where initial access came through a stolen or misused credential, such as a service account or remote access key, the attack vector field becomes an identity finding. Our recommendation: make sure your incident records can show which human or non-human identity was used, how it was obtained and when it was revoked. For payment questions, see the Ransomware Payments and Sanctions Guide.
How to prepare: a phased plan
- Scope check: recalculate headcount, turnover and balance sheet against the proposed small mid-cap figures and record the result.
- Watch list: assign someone to track the procedure file and your national authority's statements each month.
- Evidence model: organise Article 21 evidence so it can map to an implementing act or a future certification scheme.
- Incident template: add attack vector, initial access identity and mitigation fields to your incident record now.
- Supplier questionnaire: freeze major redesigns until the Commission guidelines appear.
- Post-quantum inventory: start a cryptographic inventory so national post-quantum policies do not surprise you; see the Post-Quantum Cryptography Migration Guide.
- Do not roll back early: keep current controls until the amendment is adopted and transposed in your Member State.
Metrics to track
- Classification certainty: entities whose essential or important status under the proposal has been assessed and documented.
- Evidence mapping: percentage of Article 21 measures with evidence mapped to a reusable control catalogue.
- Incident field completeness: percentage of significant incidents with attack vector and initial access identity recorded.
- Supplier questionnaire reuse: share of supplier assessments using one standard format.
- Tracking cadence: months in which the procedure file was reviewed and the result recorded.
Common failure patterns
- Acting on the proposal as if adopted: cutting controls because of a proposed downgrade to important entity status.
- Confusing two files: treating the high-risk supplier regime in the Cybersecurity Act 2 as part of the NIS2 amendment.
- Ignoring national transposition: national law, not the proposal, is what supervisors enforce today.
- Thin incident records: no record of the identity used for initial access, which the new ransomware fields would expect.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIS2 | Article 21; Article 23 | Risk management measures; incident reporting |
| NIST CSF 2.0 | GV.OC-03 | Tracking legal and regulatory requirements |
| NIST CSF 2.0 | GV.SC-05 | Supply chain requirements in contracts |
| NIST CSF 2.0 | RS.CO-02 | Notifying external stakeholders of incidents |
| NIST SP 800-53 Rev 5 | IR-6, SR-3 | Incident reporting; supply chain controls |
Practitioner checklist
- Record that the amending directive is a proposal and current national NIS2 law applies.
- Recalculate your size against the proposed small mid-cap figures.
- Check whether you provide wallets, submarine cable infrastructure, DNS or chemicals distribution.
- Map Article 21 evidence to a reusable control catalogue.
- Add attack vector and initial access identity fields to incident records.
- Hold supplier questionnaire redesigns until Commission guidelines are published.
- Start a cryptographic inventory for post-quantum migration.
- Review the procedure file monthly and confirm against the official text before relying on it.
Standards and references
- European Parliament Legislative Observatory: Procedure file 2026/0012(COD)
- European Parliament Legislative Observatory: Summary of the NIS 2 amending proposal
- Covington: European Commission Proposes Targeted Amendments to NIS2
- DLA Piper: EU NIS2 Update
- Morrison Foerster: Easing the NIS2 Burden
- SZA: Cybersecurity Update, Amendments to NIS2 and the Cybersecurity Act
Related NHI Mgmt Group resources: NIS2 Directive Guide · EU Cybersecurity Act and EUCS Guide · NIS2 Transposition Tracker · EU Digital Omnibus Guide. This guide summarises the proposed NIS2 amending directive and is not legal advice.