NIS2 guide

NIS2 and UK businesses

NIS2, Directive (EU) 2022/2555, is EU law. The EU adopted it in December 2022, after the UK had left, so it is not part of UK law. The UK has its own rules, the Network and Information Systems Regulations 2018, and a Bill before Parliament to update them.

NIS2 can still reach a UK business through an EU subsidiary or branch, through certain digital services offered in the EU, through telecoms services in the EU, and through contracts with EU customers. This guide explains the UK rules first, then each of those four routes. Article numbers refer to the Directive and regulation numbers to the NIS Regulations 2018.

Last checked 3 November 2026 against the Directive's text on EUR-Lex, the NIS Regulations 2018 on legislation.gov.uk and the Bill's record on the UK Parliament website. This is general information, not legal advice. Each EU country puts NIS2 into its own law, and its authority has the final word.

1. The short answer

Being in the UK does not bring a business under NIS2. The UK's own NIS Regulations 2018 apply only to essential services above set thresholds and to online marketplaces, search engines and cloud providers that are medium-sized or larger (section 2).

NIS2 applies to a UK business, or to part of it, in these cases:

In any other case, NIS2 can still reach you through your customers: an EU customer in scope must manage the security of its suppliers and may write that into your contract (section 7).

2. The UK's NIS Regulations 2018

The Network and Information Systems Regulations 2018 put the first NIS Directive, (EU) 2016/1148, into UK law. They came into force on 10 May 2018 (regulation 1(1)) and apply across the UK, including Northern Ireland (regulation 1(6)). They cover two groups.

Operators of essential services. A business is treated as one if it provides an essential service of a kind listed in Schedule 2, the service relies on network and information systems, and it meets the threshold Schedule 2 sets for that service (regulation 8(1)). It must tell its regulator, called the competent authority (regulation 8(2)). Schedule 2 covers these subsectors:

The thresholds are high. Two examples: in Great Britain, an electricity supplier is covered when it supplies more than 250,000 final customers; a DNS resolver service is covered when it serves 500,000 or more different IP addresses used by people in the UK in any 168 hours. A competent authority can also designate a business below its threshold if an incident there would be likely to have significant disruptive effects on the essential service (regulation 8(3)).

Relevant digital service providers. These provide an online marketplace, an online search engine or a cloud computing service in the UK, have their head office in the UK or a representative there, and are not micro or small enterprises under Commission Recommendation 2003/361/EC (regulation 1(3)(e)). They register with the Information Commission, the UK's data protection regulator (regulation 14). A provider of those services with its head office outside the UK, and not small or micro, must name a representative in the UK within three months of first offering its services there (regulation 14A). NIS2 uses the same Recommendation for its size test.

What they must do. Both groups must take appropriate and proportionate measures to manage the risks to their systems and to limit the impact of incidents (regulations 10 and 12(1) and (2)). An operator of an essential service reports an incident with a significant impact on the continuity of its service to its competent authority. A digital service provider reports an incident with a substantial impact on its service to the Information Commission. Both report without undue delay and no later than 72 hours after becoming aware of it (regulations 11(3) and 12(6)).

Fines. The maximum is £1 million for a contravention that is not material, £8.5 million for a material one, and £17 million for a material contravention that has or could have created a significant risk to, or impact on, the service (regulation 18(6)).

UK telecoms providers are not treated as operators of essential services under regulation 8(1) when sections 105A to 105C of the Communications Act 2003 apply to them (regulation 8(1A)). Those sections set their security duties instead.

3. The Cyber Security and Resilience Bill

The Cyber Security and Resilience (Network and Information Systems) Bill would amend the NIS Regulations 2018 and make further provision about the security of systems used for essential activities, in the words of its long title. Its progress on 3 November 2026:

It becomes law only when both Houses agree the text and it receives Royal Assent, and its provisions then come into force as the Act provides. Until then the 2018 Regulations apply as they stand. This guide does not describe the Bill's duties, because its text can still change. We will update this section when it becomes an Act.

4. An EU subsidiary or branch

An organisation in scope of NIS2 falls under the law of the EU country where it is established (Article 26(1)). Establishment means carrying on activity there through stable arrangements, whether those are a branch or a subsidiary (recital 114).

So an EU subsidiary of a UK group goes through the same tests as any other business in that country: its type of business in Annex I or II, and its size. For the size test, the figures of businesses linked to it are added to its own (Articles 3 and 6 of the Annex to Recommendation 2003/361/EC). A 30-person subsidiary in Ireland that a large UK group controls can therefore count as large. Our guide Does NIS2 apply to your business? walks through both tests.

The Directive's text points other types of business to the country where they are established and has no rule for those established only outside the EU. If you have staff, premises or a regular operation in an EU country, check with that country's authority whether it counts as an establishment.

5. Digital services offered in the EU

Eleven types of digital business follow their own rules on which EU country is in charge of them (Article 26(1)(b)):

With an establishment in the EU, such a business falls under the country of its main establishment. That is the country where its decisions on cybersecurity risk-management measures are mainly taken. If that cannot be decided, it is where its cybersecurity operations are carried out, and failing that, its EU establishment with the most employees (Article 26(2)).

Without an establishment in the EU, a business of these types that offers services in the EU must name a representative established in one of the EU countries where it offers them. It then falls under that country's law. If it names no representative, any EU country where it provides services may take legal action against it (Article 26(3)). Naming a representative does not protect the business itself from legal action (Article 26(4)).

Offering services in the EU means planning to serve people in one or more EU countries. A website or email address that can be reached from the EU is not enough, and nor is using a language generally used where the business is based, such as English for a UK firm. Using a language or currency of an EU country with the option to order in it, such as prices in euros, or naming customers or users in the EU, can show that plan (recital 116).

The size test still applies. Cloud, data centre, content delivery, managed service, managed security service, marketplace, search engine and social network providers are covered only if they are medium-sized or larger. DNS service providers, top-level domain name registries and businesses providing domain name registration services are covered at any size (Article 2(2)(a) and 2(4)).

Registration. Businesses of these eleven types give their authority their name, their sector and type, the address of their main establishment or of their EU representative, contact details, the EU countries where they provide services and their IP ranges. They report changes within three months (Article 27(2) and (3)). The EU's cybersecurity agency, ENISA, keeps a registry of them (Article 27(1)).

A UK cloud or marketplace provider can be under both laws at once: the NIS Regulations 2018 in the UK, and NIS2 in the EU country where its representative is established.

6. Telecoms services in the EU

Providers of public electronic communications networks and of publicly available electronic communications services fall under the law of each EU country where they provide those services (Article 26(1)(a)). They are covered whatever their size (Article 2(2)(a)). A UK provider that sells such services in an EU country is under that country's NIS2 law for them, with or without an establishment there.

7. Contracts with EU customers

This is the route most UK small businesses meet. NIS2 puts the duty on the customer, not on you. Every organisation in scope must manage "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers" (Article 21(2)(d)). It must take into account each direct supplier's specific weaknesses and "the overall quality of products and cybersecurity practices of their suppliers and service providers, including their secure development procedures" (Article 21(3)). Recital 85 encourages it to write security measures into its contracts with direct suppliers.

So an EU customer may send you a security questionnaire, ask for evidence such as your policies or a recent restore test, or add clauses on multi-factor authentication, backups, telling it about incidents and its right to audit. Once you sign those clauses, they bind you as contract terms under the law the contract names, not as NIS2. Section 6 of our scope guide and point (d) of our Article 21 guide say more about what customers ask for.

8. The two laws side by side

TopicUK: NIS Regulations 2018EU: NIS2
WhoEssential services in 10 subsectors above set thresholds; online marketplaces, search engines and cloud computing18 sectors in Annexes I and II, from energy and health to manufacturing, food and digital services
SizeThresholds per essential service; digital service providers must not be micro or smallMedium-sized or larger, with some types at any size
Incident reportsWithout undue delay, and within 72 hoursEarly warning within 24 hours, notification within 72 hours, final report one month after the notification (Article 23(4))
Maximum fine£17 millionAt least €10 million or 2% of worldwide turnover (essential entities); at least €7 million or 1.4% (important entities) (Article 34)
RepresentativeDigital service providers based outside the UK that offer services there name one in the UKThe eleven digital types based outside the EU that offer services there name one in the EU

Our guide to NIS2 incident reporting explains the three NIS2 deadlines.

9. What to do next

  1. Check whether you run an essential service above a Schedule 2 threshold, or are a medium-sized or larger online marketplace, search engine or cloud provider in the UK. If so, the NIS Regulations 2018 apply to you now.
  2. List any subsidiaries, branches or regular operations you have in EU countries, and put each through the NIS2 scope tests, with your group's figures added.
  3. If you offer one of the eleven digital services in section 5 to EU customers, check the size test and, if you are covered, name a representative and register.
  4. If you sell telecoms services in an EU country, check that country's NIS2 law.
  5. If none of these applies, get ready for your EU customers' questionnaires and contract clauses: short written policies, and evidence that you follow them.

Our NIS2 Small-Entity Compliance Kit includes a Scope Check sheet for these tests, along with the policies and registers that the Article 21 measures and customers' questionnaires call for.

Related guides: Does NIS2 apply to your business? · NIS2 Article 21: the ten measures in plain English · NIS2 incident reporting: 24 hours, 72 hours, one month

10. Sources