EU NIS 2 Directive

Entities listed in Art. 26(1)(b) — including cloud computing service providers, data centre service providers, content delivery network providers, managed service and managed security service providers, and providers of online marketplaces, online search engines and social networking platforms — that are not established in the Union but offer services there must designate a representative in one of the Member States where the services are offered, and are then under that Member State’s jurisdiction. Art. 27(2) requires such entities to submit to the competent authorities their name, sector and entity type, the address of their main establishment or of the representative, contact details, the Member States served and their IP ranges, and Art. 27(3) requires notification of any change without delay and in any event within three months of the change.

Applies when

Companies established in China offering cloud, managed, CDN or managed security services, or operating platform businesses, into the EU. Designating a representative is not merely formal: it determines which Member State authority supervises and can fine you.

Deadline: The Art. 27(2) submission deadline was 17 Jan 2025; changes must be notified within three months.

Applies from: 2024-10-18

Evidence to retain

• · Representative appointment documents and proof of establishment
• · Registry information submitted to the competent authority and the acknowledgement
• · Records of change notifications filed within three months
• · Inventory of services and Member States served, used to determine jurisdiction

Estimated first-time effort: 5–12 person-days (estimate, not a commitment)

Entities must take appropriate and proportionate technical, operational and organisational measures to manage the risks to the security of the network and information systems they use for their operations or services, and to prevent or minimise the impact of incidents on service recipients and other services. The measures must follow an all-hazards approach and include at least: (a) policies on risk analysis and information system security; (b) incident handling; (c) business continuity such as backup management and disaster recovery, and crisis management; (d) supply chain security, including security aspects of relationships with direct suppliers and service providers; (e) security in network and information system acquisition, development and maintenance, including vulnerability handling and disclosure; (f) policies and procedures to assess the effectiveness of the measures; (g) basic cyber hygiene practices and cybersecurity training; (h) policies and procedures on cryptography and, where appropriate, encryption; (i) human resources security, access control policies and asset management; and (j) the use of multi-factor or continuous authentication, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate.

Applies when

EU entities of Chinese groups within NIS2 scope, or entities under the jurisdiction established by their designated representative. There is substantial overlap with ISO/IEC 27001, but points (d) and (j) — supply chain security and multi-factor authentication — are usually where the largest gaps sit.

Applies from: 2024-10-18

Evidence to retain

• · Information security management system documentation with an item-by-item mapping to the ten categories
• · Risk assessment reports and treatment plans
• · Business continuity and disaster recovery exercise records
• · Periodic assessment reports on the effectiveness of the measures

Estimated first-time effort: 30–80 person-days (estimate, not a commitment)

When assessing whether the Art. 21(2)(d) supply chain measures are appropriate, entities must take into account the vulnerabilities specific to each direct supplier and service provider and the overall quality of products and cybersecurity practices of those suppliers, including their secure development procedures, and must take into account the results of the coordinated security risk assessments of critical supply chains carried out under Art. 22(1). For an AI supply chain this means model vendors, GPU clouds, annotation outsourcers and open-source components all fall within the assessment.

Applies when

Entities within NIS2 scope. Chinese AI companies usually meet this provision first as suppliers: EU customers push NIS2 requirements upstream through contracts, creating a de facto compliance obligation.

Applies from: 2024-10-18

Evidence to retain

• · Direct supplier inventory with tiered assessment records
• · Supplier security questionnaires and collected audits or certificates
• · Security and incident-notification clauses in contracts
• · Inventory of open-source and third-party components with vulnerability monitoring records

Estimated first-time effort: 15–40 person-days (estimate, not a commitment)

On an incident having a significant impact on the provision of services, the entity must notify its CSIRT or, where applicable, the competent authority without undue delay, and where appropriate notify the recipients of its services likely to be adversely affected. An incident is significant if it has caused or is capable of causing severe operational disruption or financial loss for the entity, or has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage. Reporting is staged: an early warning within 24 hours of becoming aware, indicating where applicable whether the incident is suspected of being caused by unlawful or malicious acts or could have cross-border impact; an incident notification within 72 hours updating the early warning with an initial assessment including severity and impact and, where available, indicators of compromise; an intermediate report on request of the CSIRT or competent authority; and a final report under Art. 23(4). Entities must also, where appropriate, communicate without undue delay to potentially affected service recipients any measures or remedies they can take in response to a significant cyber threat.

Applies when

Entities within NIS2 scope. The NIS2 and GDPR clocks are separate: a security incident involving personal data typically triggers both the NIS2 24-hour early warning and the GDPR 72-hour notification, so both must be sequenced in the same playbook.

Deadline: 24-hour early warning; 72-hour incident notification; final report as required by Art. 23(4).

Applies from: 2024-10-18

Evidence to retain

• · Incident severity criteria and significance determination records
• · Submission records and acknowledgements for the 24-hour early warning, 72-hour notification and final report
• · Notification text and delivery records for service recipients
• · Playbook sequencing the NIS2 clock alongside the GDPR breach notification clock

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

Member States must ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken to comply with Art. 21, oversee their implementation, and can be held liable for the entity’s infringements of that Article. Members of management bodies must also follow training, and entities are encouraged to offer similar training to employees regularly, so that they gain sufficient knowledge and skills to identify risks and assess cybersecurity risk-management practices and their impact on the services provided.

Applies when

Boards and executives of entities within NIS2 scope. For the EU subsidiary of a Chinese group this means cybersecurity cannot sit only with IT: EU directors need a written trail of approval and oversight, or personal liability exposure is real.

Applies from: 2024-10-18

Evidence to retain

• · Board resolutions or minutes approving the cybersecurity measures
• · Periodic oversight reporting packs and records of management’s comments
• · Training records and certificates for management body members
• · Employee cybersecurity training plan and completion statistics

Estimated first-time effort: 5–12 person-days (estimate, not a commitment)