"That Doesn't Apply to Us"—The Most Expensive Mistake of 2026
When I talk to managing directors about NIS2, I hear the same sentence almost every time: "That's only for large corporations." This mistake can be costly. Very costly, in fact—up to €10 million or 2% of global annual revenue.
The NIS2 Directive has been transposed into national law across the EU since October 2024, fundamentally tightening cybersecurity requirements for businesses in Europe. The tricky part: an estimated 30,000 companies in Germany alone are directly affected. Another 100,000 indirectly as suppliers. And the trickiest part of all: many of them don't know it.
Are You Affected? The Honest Answer
NIS2 casts a significantly wider net than its predecessor. The directive distinguishes between "essential" and "important" entities, and the thresholds are lower than most people think.
From 50 employees or €10 million in revenue, you could be affected—provided you operate in one of the regulated sectors. And these sectors are broad: energy, transport, healthcare, food, manufacturing, digital infrastructure. Even postal and courier services fall under it. If you manufacture electronics, vehicles, or machinery, you're in.
But here's the point most people overlook: the supply chain trap. Even if your company doesn't directly fall under NIS2, your major customers can demand NIS2 compliance from you. And they will. Because NIS2 explicitly requires companies to secure their supply chain. When your biggest client suddenly sends a cybersecurity questionnaire and you can't provide satisfactory answers, the business relationship is at stake.
What NIS2 Demands From You—In Plain English
The directive is extensive, but at its core it demands three things: technical safeguards, rapid incident reporting, and personal accountability of management.
The technical measures cover what should really be self-evident anyway: conduct risk assessments, implement backup strategies, segment networks, secure access, patch regularly. Sounds like a long list, but if you already have a reasonable IT security concept, you're probably closer than you think.
The reporting obligations are stricter. For a significant security incident, you must send an early warning to the relevant authority within 24 hours. A detailed incident report follows within 72 hours. And a final report within one month. Sounds manageable—but only if you have processes that can meet these deadlines. In the chaos of an actual cyberattack, 24 hours pass faster than you'd think.
And then the point that keeps managing directors up at night: personal liability. NIS2 makes company leadership personally responsible for cybersecurity. This doesn't mean the CEO has to configure the firewall port. But they must approve risk management measures, oversee their implementation, and attend cybersecurity training themselves. If they neglect this, they face personal fines and even a temporary management ban.
The Pragmatic Approach: How to Get There Without Going Crazy
Take a deep breath. NIS2 sounds overwhelming at first glance, but it's manageable if you approach it systematically. Here's our recommended path.
Start with a GAP analysis. Compare what you already have with what NIS2 demands. Many companies are surprised at how much they've already covered—especially if they've invested in IT security in recent years. The gaps that remain are your work programme.
In most cases, the biggest gaps are: a documented risk assessment, a formalised incident response process, management training, and supply chain security. None of these are rocket science, but they need to be written down, practised, and maintained.
The investment is proportionate to your company size. For 50-100 employees, plan for €50,000-100,000 in one-off costs and €20,000-50,000 annually. Sounds like a lot, but compare it with a €10 million fine. Or with a management ban. Suddenly, the budget for a proper security concept looks like a bargain.
The Silver Lining
Here's the thing that nobody talks about in all the NIS2 panic: these measures make sense regardless of any regulation. Better backup strategies, faster incident response, segmented networks—all of this protects your company from the very real cyber threats that exist independent of any EU directive.
I've seen companies use NIS2 as a catalyst to finally sort out their IT security properly. And almost all of them say afterwards: "We should have done this years ago." Not because of the regulation, but because they now actually sleep better at night.
So yes, NIS2 is a regulatory burden. But it's also an opportunity to do what should have been done long ago—and to do it right this time.
*Free NIS2 readiness check: Are you affected, and where are the gaps? Schedule a conversation*
