2026 is the year NIS2 stops being a slide deck
The transposition deadline was 17 October 2024, and most member states blew straight past it. By early 2026 roughly 22 of 27 have NIS2 on the books, and the regulators who got there first have moved from sending letters to opening proceedings. Germany has gone after entities that missed incident-notification windows. France has issued formal warnings to firms running with no minimum measures at all. There's no headline nine-figure fine yet. But "no fine yet" is not "no enforcement," and the space between those two is exactly where a lot of mid-sized companies are parked right now, hoping nobody runs the audit.
If you run a 50-plus-person EU business, or you sell to one, this is the year to find out whether you're in scope and what your cloud setup owes the regulation. NIS2 covers an estimated 160,000 entities across 18 sectors. Plenty of them haven't done the math.
Are you actually in scope?
Two things pull you in: sector and size. Sector first. NIS2 has two annexes. Annex I is "high-criticality" — energy, transport, banking, health, drinking water, and the digital infrastructure bucket that sweeps in cloud computing providers and data-centre operators. Annex II is "other critical" — postal, waste management, food production, manufacturing, plus digital providers like online marketplaces and search engines. Then size:
| Classification | Threshold | Maximum fine |
|---|---|---|
| Essential entity | Large org (250+ staff, or €50M+ turnover) in an Annex I sector | €10M or 2% of global turnover, whichever is higher |
| Important entity | Medium org (50+ staff or €10M+ turnover) in Annex I or II | €7M or 1.4% of global turnover, whichever is higher |
Read the "or" on the medium threshold carefully. Fifty people or ten million in turnover trips it — not both. A lean, high-revenue 40-person shop can be in scope on turnover alone. And a handful of entity types (DNS providers, TLD name registries, qualified trust-service providers, public electronic-comms networks) are in scope no matter how small they are.
Why a 12-person company can still get pulled in
This is the part the "am I in scope?" checklists tend to bury, and it's the one that matters most for small suppliers. Article 21 names supply-chain security as a mandatory measure. Every regulated entity has to assess, monitor, and contractually bind the security of its suppliers and sub-suppliers — anyone with a route to its critical data or systems.
So even if you sit well under the size threshold and outside every named sector, the moment you sell a service to an Essential or Important entity, their obligation becomes your contract clause. You'll get the security questionnaire. You'll get the DPA-style addendum demanding encryption at rest, incident notification inside a fixed window, and a right to audit. NIS2 reaches SMEs not by naming them, but by making their customers answerable for them. If a meaningful slice of your revenue comes from regulated EU businesses, NIS2 is already your problem. It just shows up as a procurement requirement instead of a regulator's letter.
The ten measures, and the two your storage has to satisfy
Article 21(2) lists ten minimum risk-management measures. They're written to be technology-neutral and outcomes-based — the regulation tells you what to achieve, never which product to buy — and scaled to your risk profile. The full ten: risk analysis and security policies; incident handling; business continuity and backups; supply-chain security; secure acquisition and development; measures to assess effectiveness; basic cyber hygiene and training; cryptography and encryption; access control, asset management, and HR security; and multi-factor authentication plus secured communications.
Your storage choice touches several of these, but two it can't avoid:
- Cryptography (measure 8). The text calls for policies on cryptography "and, where appropriate, encryption" — covering data in transit, at rest, and in processing. Most consumer cloud encrypts the first two: TLS on the wire, the provider's own keys on the provider's disks. The "in processing" leg, and the harder question of who holds the key, is where the cheap answers come apart. If your provider can decrypt your files, your encryption posture is only as good as their access controls — and their breach becomes your reportable incident.
- Multi-factor authentication (measure 10). Not optional anymore. Password-only access to a system holding regulated data will not survive an audit.
This is where storage architecture changes your compliance surface instead of just decorating it. With a zero-knowledge provider, files are encrypted on your own device with AES-256-GCM before they leave it; the keys are stretched client-side with Argon2id and never reach the server. The provider stores ciphertext and metadata, nothing it can read. We've written up the full key model on our security page, but the short version is that the server is structurally incapable of reading your data — so a server-side breach leaks unreadable blobs, not your customers' documents. X25519-sealed sharing and TOTP-based 2FA carry the access-control and MFA measures on the same stack; the features page shows what's live today.
Honest caveat: zero-knowledge is not a NIS2 stamp. It satisfies the cryptography and access measures cleanly, and it shrinks your breach-notification exposure because there's no plaintext to lose in the first place. It does not write your risk analysis, draft your continuity plan, or train your staff. Eight of the ten measures are still yours to run.
The 24 / 72 / one-month clock you can't miss
Article 23 is the part that bites first, because it's binary. You hit the deadline or you don't. A "significant incident" — one causing severe operational disruption or considerable damage — triggers a three-stage cascade to your national CSIRT:
- Early warning within 24 hours of becoming aware. Low-friction: flag whether it looks malicious and whether there's cross-border impact.
- Incident notification within 72 hours, updating the early warning with an initial severity assessment and any indicators of compromise.
- Final report within one month, with root-cause analysis. If it's still live, you file an interim progress report instead.
Twenty-four hours is brutal. It assumes you can detect the incident — which assumes logging plus a human actually watching it. The early German actions were about missed notifications, not weak encryption. The clock is the easiest obligation to fail and the easiest one for a regulator to prove you failed.
Management is personally on the hook
NIS2 made cybersecurity a board responsibility with teeth. Senior management has to approve the risk-management measures, oversee them, and sit through training — and they can be held personally liable when those measures fail. In serious cases, member states can suspend a manager from their role. The "this is an IT problem" deflection from the C-suite is gone by statute now. That's the lever about to move budgets: the people signing off finally have skin in it.
The practical move for a mid-sized firm is unglamorous. Work out whether your sector, your size, or your customers put you in scope. Map who actually holds the keys to your data, and whether your provider would convert their breach into your reportable incident. Get MFA on everything that touches regulated data. Stand up detection and the 24-hour notification path before you need either of them. None of that needs a consultant's retainer — most of it needs someone deciding it's real, which in 2026 the regulators already have. If you want to pressure-test the encryption and access-control side, the security page lays out the key handling end to end, and