Does NIS2 apply to UK companies?
NIS2 does not apply in the UK as UK law, because it is an EU directive adopted after Brexit. A UK company can still be caught if it has an EU establishment or offers certain digital services in the EU. The UK’s own route is the NIS Regulations 2018 and the Cyber Security and Resilience Bill (CSRB).
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
The short answer
NIS2 is an EU directive that member states put into their own national law. The UK isn't a member state, so NIS2 doesn't apply here as UK law. The UK has the NIS Regulations 2018, which the Cyber Security and Resilience Bill (CSRB) would update. That Bill is a separate UK law and not a version of NIS2.
A UK company can still have NIS2 duties. It depends on where the company operates and what it sells, so check the three routes below.
Three ways NIS2 reaches a UK company
1. You have an EU establishment
An EU subsidiary or branch in a covered sector can be in scope under the law of that member state. Size matters: NIS2 generally targets medium and large organisations, though some types of entity are covered whatever their size.
2. You offer certain digital services into the EU
Article 26 has a special rule for certain digital providers. If you are not established in the EU but offer services there, you must designate an EU representative in a member state where you offer them. It covers:
- DNS service providers, top-level domain registries and domain registration services
- Cloud computing, data centre and content delivery network providers
- Managed service and managed security service providers
- Online marketplaces, online search engines and social networking platforms
If you don't designate a representative, any member state where you provide services may take legal action against you.
This matters for UK MSPs and cloud providers selling to EU customers, who could have duties under both regimes.
3. Your EU customers pass requirements down
EU organisations in scope must manage supply chain security. Even if NIS2 doesn't apply to you, customers may ask for security questionnaires, contract clauses, audit rights and incident notice periods.
Quick check
| Question | If yes |
|---|---|
| Do you have an EU subsidiary or branch? | Check that member state's law for that entity |
| Do you offer a service on the Article 26 list to EU customers? | Consider whether you need an EU representative |
| Do you supply organisations in NIS2 sectors? | Expect contract requirements |
| None of these? | NIS2 is unlikely to apply, but keep an eye on it if you expand into the EU |
National laws differ and some member states have moved at different speeds, so confirm the position in each country you operate in. Take local advice where the answer matters.
How NIS2 and the UK Bill differ
The two share a similar reporting structure, but they are not interchangeable.
| NIS2 (EU) | The Bill (UK) | |
|---|---|---|
| Legal form | Directive, implemented nationally | Amends the NIS Regulations 2018 |
| First notice | Early warning within 24 hours | Initial notification within 24 hours |
| Next report | Incident notification within 72 hours | Full notification within 72 hours |
| Final report | Within one month of the incident notification | No equivalent final report in the regulation's two stages |
| Maximum fines | At least €10m or 2% of worldwide turnover for essential entities; at least €7m or 1.4% for important entities | The greater of £17m and 4% of turnover for serious failures; the greater of £10m and 2% for administrative failures |
Scope also differs. For the full comparison, see UK Bill vs NIS2.
If you are caught by both
A single incident could mean notifying authorities in the UK and in EU member states. Plan for it now:
- Map each service to the regimes that apply, by legal entity.
- Keep one incident process, with a separate reporting route for each regulator.
- Time each deadline from when that regime says the clock starts.
- Use one set of security controls, then check it against each regime's requirements.
- Agree who in the business decides whether an incident is reportable in each place.
Sources
Frequently asked questions
The NIS Regulations 2018 are the current UK regime, and the Cyber Security and Resilience Bill would update them. It is a separate UK law, not an implementation of NIS2.
It can. Certain digital providers not established in the EU, such as cloud, data centre and managed service providers, must appoint an EU representative if they offer services there. Check the national law in each relevant member state.
Yes. EU organisations in scope must manage supply chain security, so they may ask UK suppliers for security commitments by contract.
Not automatically. The two overlap on themes such as 24-hour and 72-hour reporting, but scope, regulators and detail differ, so assess each regime separately.