Yes, potentially. If your organisation provides digital services to EU-based users, operates EU-facing infrastructure, or has subsidiaries that operate essential or important services within the EU, NIS 2 obligations may apply — even if your headquarters is in the US, UK, Singapore, or India. We regularly advise non-EU organisations on their NIS 2 exposure, and it's one of the most misunderstood aspects of the Directive. The first step is a scoping conversation to determine whether and how you're affected.

Both essential and important entities are subject to the same technical and governance requirements under Articles 20–23. The difference is in supervisory intensity and penalty ceiling. Essential entities (Annex I) face proactive supervision — authorities can audit them at any time. Important entities (Annex II) face reactive supervision — triggered by incidents or complaints. Essential entities also face higher fines: up to €10M or 2% of global turnover, versus €7M or 1.4% for important entities. Management personal liability applies to both tiers.

It depends significantly on where you're starting from. Organisations with a mature ISO 27001 or GDPR programme in place can typically reach NIS 2 readiness in 3–5 months, since much of the governance infrastructure is already built. Organisations starting from a lower baseline should plan for 6–12 months to build and evidence the required controls. The single most important factor is starting before you're under regulatory pressure — not after. We'll give you a realistic timeline assessment during your free initial consultation.

Article 23 establishes a three-phase reporting obligation for significant incidents. An early warning must be submitted to your national CSIRT or competent authority within 24 hours of becoming aware of the incident. A detailed incident notification follows within 72 hours, including an initial assessment of severity and impact. A final report — including root cause analysis, mitigation steps, and cross-border impact assessment where relevant — must be submitted within one month. For trust service providers, the 24-hour notification deadline is particularly strict. Missing any of these deadlines is itself a compliance violation, independent of the underlying incident.

Article 20 is direct: management bodies of essential and important entities must approve cybersecurity risk management measures, oversee their implementation, and can be held personally liable for breaches of their obligations. Member states can implement temporary bans on individuals from holding management positions if serious breaches occur. In practice, this means your board needs to be able to demonstrate that they've received appropriate cybersecurity training, that they've formally approved your risk management approach, and that they have a meaningful understanding of your organisation's NIS 2 posture — not just a sign-off on a policy document. Our vCISO service and board training programme are specifically designed to build this capability.

DORA (Digital Operational Resilience Act) applies specifically to financial sector entities and their ICT service providers, and came into force in January 2025. NIS 2 applies more broadly across all critical sectors. Financial entities typically need both — and while there's significant overlap in their technical requirements (ICT risk management, incident reporting, third-party oversight), DORA's requirements on ICT-related incident classification and third-party contractual requirements go further than NIS 2 in the financial context. Our AuditFusion360 programme runs both assessments in parallel, so you get full coverage without running two completely separate programmes.