NIS2 UK businesses: scope and duties

For NIS2, UK businesses need to distinguish direct legal scope from customer requirements. A UK address does not automatically put an organisation outside the regime. Certain providers offering services in the EU can be covered even without an EU establishment; other UK suppliers may face contractual security requirements from customers that are themselves covered.

Start by mapping your legal entities, services and EU activities. Then establish the applicable national law and regulator before making a compliance claim. A supplier questionnaire alone does not prove that your business is directly regulated, and incorporation in the UK does not prove that it is exempt.

What is the NIS2 Directive?

Directive (EU) 2022/2555, commonly called NIS2, concerns cybersecurity across specified sectors. It is a directive that EU member states implement through national law, not a single regulation applied identically without national implementation.

Article 41 required member states to adopt and publish measures by 17 October 2024 and apply them from 18 October 2024. Those dates do not remove the need to check the current legislation, implementation and competent authority in the relevant member state.

The directive covers risk management, governance, incident reporting and supervision. It expands the earlier NIS framework, but sector names alone are not enough to decide whether a particular business is covered.

How to assess your scope

Articles 2 and 3, together with the annexes, define scope and classification. The general size rule concerns medium-sized or larger entities of the listed types that provide services or carry out activities in the EU. There are exceptions and categories covered irrespective of size, as well as national identification provisions.

Annex I includes sectors such as energy, transport, health and digital infrastructure. Annex II includes specified manufacturing, food, postal, waste and other activities. Do not label every Annex I business essential and every Annex II business important without applying Article 3. Size, entity type and designation can change the classification.

The assessment should record:

• The actual legal entity and the service it provides.
• The relevant annex category and any size or special-scope provision.
• Where it is established and where it provides services.
• Whether a sector-specific EU regime affects the applicable provisions.
• The relevant national law, authority and registration requirements.

Ask a qualified adviser to resolve uncertainty about those facts. A generic sector checklist cannot determine every cross-border case.

UK providers can have direct obligations

Article 26 contains jurisdiction rules. Its special treatment includes cloud computing, data centre, content delivery network, managed service and managed security service providers, as well as other named digital services.

For an entity in the Article 26(1)(b) group that falls within scope, offering services in the EU without an EU establishment can require designation of an EU representative. The directive addresses jurisdiction through that representative and permits action where a required representative has not been designated. Other service types have different jurisdiction rules.

This is why a UK managed service provider selling into the EU should not conclude that its only exposure is contractual. It needs a service, size and jurisdiction assessment under the applicable implementation. Equally, simply having an EU customer does not make every UK supplier directly subject to all NIS2 duties.

For a group of companies, assess each relevant entity and its activities. A parent's internal policy may apply across the group, but group policy and direct regulatory jurisdiction are separate questions.

Customer and supply-chain requirements

Article 21 requires covered entities to address security-related risks in relationships with direct suppliers and service providers. An EU customer may therefore ask for evidence about your access controls, development, incident handling, continuity and subcontractors.

Read the request carefully. Determine which service it concerns, what evidence is required and what the contract would oblige you to do. A request for information does not automatically mean the supplier must satisfy every obligation placed on the customer itself.

Prepare accurate answers linked to evidence. If a control is planned, describe it as planned. If a certificate covers only part of your service, state its scope. Negotiate realistic notification and assistance terms before accepting a commitment that your team cannot deliver.

What the directive requires of covered entities

Governance and management involvement

Article 20 requires management bodies to approve cybersecurity risk-management measures and oversee their implementation. It also addresses management training and liability for infringements of Article 21. The detailed liability position depends on the applicable law; do not reduce it to an unqualified claim that every UK director is personally liable under NIS2.

Management needs a decision process, budget and evidence of follow-through. A risk register is useful only if unresolved issues reach someone who can authorise action.

Proportionate risk-management measures

Article 21 uses an all-hazards approach with appropriate and proportionate technical, operational and organisational measures. It covers risk analysis, incident handling, continuity and recovery, supply-chain security, secure acquisition and development, effectiveness checks, cyber hygiene and training, cryptography policies, people and access controls, and authentication or secure communications where appropriate.

Do not turn that into an unsupported universal technology shopping list. Assess what the relevant law and any applicable implementing rules require for your type of service, then document the controls and their effectiveness.

ISO 27001 and Cyber Essentials can contribute evidence in their respective scopes. Neither automatically certifies NIS2 compliance or replaces the required legal and operational assessment.

Incident reporting

Article 23 concerns significant incidents. It includes incidents causing or capable of causing severe operational disruption or financial loss, or considerable material or non-material damage to others. Applicable implementing rules and national provisions can supply further detail.

For the general reporting sequence, the directive requires an early warning without undue delay and within 24 hours of awareness of a significant incident, followed by an incident notification without undue delay and within 72 hours. The latter contains an initial assessment; it is not necessarily a completed investigation.

A final report is generally due no later than one month after the incident notification. Ongoing incidents have a progress-report arrangement, and trust service providers have a specific 24-hour incident-notification exception. Build the correct rules for your service into the procedure rather than copying a simplified timeline.

Customer notifications and personal-data breach notifications may also be required under different rules. Identify each recipient, threshold and clock separately. Sending one report does not automatically fulfil every obligation.

The UK framework is a separate assessment

The UK's Network and Information Systems Regulations 2018 and its domestic reform programme should not be described as UK NIS2 regulations. The government's Cyber Security and Resilience Bill collection explains that programme and links to the parliamentary record.

Check the legislation and commencement provisions currently applicable to your organisation. Do not assume that UK changes will exactly copy NIS2 or promise that particular duties will arrive in a guessed number of years. Maintain separate entries for current obligations, proposed changes and customer commitments.

A worked UK supplier assessment

Consider a fictional UK software consultancy that supplies development work to an EU manufacturer. It first identifies the contract, legal entities, service and access to the customer's systems. It does not infer direct NIS2 scope solely from the customer's sector.

The customer asks for incident contacts, secure-development evidence and notification terms. The consultancy maps each request to existing evidence, identifies gaps and agrees who can meet the proposed response times. Its legal assessment records whether any direct scope provision applies separately from those contractual commitments.

Now change the facts: the company also operates a managed service offered in the EU. That service creates an additional scope and jurisdiction question, including Article 26 where applicable. The earlier consultancy-only conclusion cannot simply be reused.

The completed decision is a documented scope assessment and an achievable contract response. If direct coverage is established, the next stage includes the appropriate authority, registration, risk-management and reporting programme. If only supplier commitments apply, those commitments still need owners and tested procedures.

Prepare the evidence before making a claim

Create a short register connecting each obligation or contract clause to its source, owner, control, evidence and review trigger. Include the service scope and jurisdiction decision. Revisit it when you add a service, market, establishment or material supplier.

Our IT compliance service can help organise systems evidence, gaps and implementation priorities. Book a consultation with your service description and the customer or regulatory question you need to answer. Legal scope should be confirmed with appropriate jurisdiction-specific advice; practical readiness work can then proceed against a clear requirement.