New Obligations in the Field of Cybersecurity: Are You an Operator of an Essential Service?

The European Union is currently preparing a comprehensive amendment to Directive (EU) 2022/2555 of the European Parliamentand of the Council of 14 December 2022 on measures for a high common level ofcybersecurity across the Union (the "NIS 2 Directive"), responding to practical challenges identified during its implementation. On 20 January 2026, the European Commission (the "Commission") published a proposal for an amending directive to the NIS 2 Directive, introducing clearer rules, reduced administrative burden, and more effective coordination of supervision over entities operating across multiple Member States. The overarching objective is to enable enterprises to spend less time on administrative compliance and more time on genuinely strengthening their cybersecurity resilience.

As previously outlined in our prior articles, the NIS 2 Directive establishes obligations for operators of essential services. Below is a summary of the key proposed amendments.

1.     Rationale for Amending the NIS 2 Directive

During the implementation of the NIS 2 Directive, Member States encountered several ambiguities—particularly regarding the determination of scope, the application of cybersecurity risk-management measures, incident reporting, and the supervision of cross-border entities. Consequently, the Commission has proposed amendments designed to enhance legal certainty, unify enforcement approaches across Member States, and reduce administrative burdens for both businesses and national regulatory authorities.

The amendment alters the status of certain entities—most notably power generation entities within the energy sector and entities within the chemical sector. It also introduces a new size criterion for regulatory subjection, new certification options, novel reporting frameworks for ransomware attacks, and refined obligations for Member States.

The most significant proposed changes are detailed below.

2.     Changes Concerning Selected Entities Falling within the Scope of the NIS 2 Directive

• DNS Providers: Will be covered only if they meet the size thresholds for medium-sized enterprises set forth in the NIS 2 Directive.
• European Digital Identity Wallet (EDIW) and European Business Wallet (EBW) Providers: Will invariably qualify as essential entities, regardless of their size.
• Electricity Producers: Will fall within the scope only if their total installed capacity exceeds 1 MW.
• Hydrogen Undertakings: Added under the new regulatory framework (covering production, storage, and transmission).
• Chemical Sector: Refined in alignment with the obligations under the REACH Regulation (registration or notification of substances). Only chemical manufacturers and product manufacturers remain regulated entities, while distributors are excluded from the regulatory scope.
• Dual-Use Strategic Infrastructure: Entities identified as owners, managers, or operators of strategic dual-use infrastructure—pursuant to the proposal for a regulation of the European Parliament and of the Council establishing a framework of measures to facilitate the transport of military equipment, goods, and personnel within the Union—will fall within the scope of the NIS 2 Directive regardless of their size.

3.     Introduction of the "Small Mid-Cap" Category

The amendment introduces a new category ofenterprises into the NIS 2 Directive: "small mid-cap companies." These are defined as enterprises with: fewer than 750 employees and an annual turnover not exceeding EUR 150 million; or a balance sheet total not exceeding EUR 129 million.

Consequently, entities specified in Annex I of the NIS 2 Directive would only be regulated in the field of cybersecurity if they exceed the thresholds.

Compared to the current legal framework, this represents a substantial change with the potential to exempt numerous entities currently registered as critical entities from stricter regulation. This shift may result in less intensive supervision and a reduced scope of regulatory obligations. For the affected entities, this translates into a lower administrative burden and potentially lower compliance costs.

4.     Certification and Maximum Harmonization

The proposal enables regulated entities to demonstrate compliance with their obligations through "cyber posture" certification under ECCF/CSA schemes.

If a certificate covers the methodological requirements set out in implementing regulations issued by the Commission, national authorities will be precluded from imposing additional technical or methodological obligations in the domains covered by the certificate. [1]

Concurrently, the Commission will regularly evaluate for which sectors it is appropriate to adopt implementing acts with maximum harmonization.

Once the Commission adopts such implementing acts pursuant to Article 21, Member States will no longer be permitted to impose any additional technical, methodological, or sector-specific requirements beyond those stipulated in these acts. In other words, the harmonized rules will be binding, leaving Member States with no discretion to further tighten requirements vis-à-vis regulated entities.

5.     Supply Chains: Reduction of Duplication

Regulated entities have frequently faced a multiplicity of non-standardized supplier questionnaires. To address this, the Commission will issue guidelines concerning the appropriate structure and scope of information that may be requested from suppliers. The objectives are to:

• reduce administrative burden;
• prevent the shifting of obligations onto entities outside the scope of NIS 2; and
• standardize risk-assessment procedures across supply chains.

6.     Ransomware: A New Reporting Framework

The amendment establishes a harmonized data-collection framework for ransomware incidents (covering detection, attack vectors, and mitigation measures).

Upon request by a CSIRT or a competent authority in the event of significant incidents, entities will also be required to provide sensitive data, such as whether a ransom demand was made and whether a payment was executed. The Commission recommends that every essential and important entity designate a responsible person as a point of contact to ensure the confidentiality and integrity of the data provided. Furthermore, the EU maintains its policy against the payment of ransoms in ransomware attacks.

7.     Post-Quantum Cryptography (PQC)

As part of their national cybersecurity strategies, Member States will be required to adopt policies for transitioning to post-quantum cryptography. The objective is to implement these measures for critical applications by 2030 and for all other systems by 2035.

8.     ENISA: Enhanced Supervisory Role

ENISA will establish a single registry of essential and important entities as well as domain name registration entities. It will support Member States in:

• data exchange;
• cross-border risk assessments;
• the establishment of joint supervisory teams; and
• joint inspections of high-risk entities.

Entities will be under a statutory obligation to notify changes to their data within a maximum of 2 weeks. This obligation will likewise apply vis-à-vis the competent authorities of the Member States, thereby eliminating duplicative regulation under Act No. 69/2018 Coll. on Cybersecurity.

Conclusion

The NIS 2 amendment is currently only a legislative proposal; however, if adopted in its submitted form, it will deliver practical simplifications, a more precise regulatory scope, and more uniform supervision across the EU. By doing so, it will resolve existing ambiguities, mitigate administrative burdens, and enable businesses to concentrate on tangible enhancements to their cybersecurity resilience.

Upon adoption by the European Parliament, the transposition deadline for the amended NIS 2 Directive will be 12 months from the date of its entry into force.

If your enterprise is impacted by these changes, we would be pleased to assist you with assessing their legal impact, establishing compliance processes, preparing for the new incident-reporting regime, or adjusting supply-chain contractual relationships. Should it become apparent following the adoption of the NIS 2 amendment that your enterprise is no longer classified as a regulated entity, we can also assist you in preparing and submitting a substantiated application for deregistration from the register of operators of essential services.

[1] Referring to Commission implementing acts issued primarily pursuant to Article 21(5) and Article 21(2) of the NIS 2 Directive (such as policies on cybersecurity risk management and information system security, incident handling, business continuity—backup management and disaster recovery, supply chain security, secure system development and maintenance including vulnerability handling, cryptography and encryption, access control and asset management, multi-factor authentication, and secured communications).