Tools / Regulatory tracker / NIS2 Directive
Regulatory tracker · European Union · Cyber and resilience
NIS2 Directive
Data centre service providers are digital infrastructure entities with cyber risk and incident reporting duties.
In force Member States had to apply national rules from 18 October 2024. Transposition varies by country.
What it does
The rule in brief
Directive (EU) 2022/2555 lists data centre service providers and cloud computing service providers in the digital infrastructure sector (Annex I). In-scope entities must take cyber security risk management measures, report significant incidents (early warning within 24 hours, notification within 72 hours) and their management bodies must approve and oversee the measures. Fines reach at least €10 million or 2% of worldwide turnover for essential entities.
Timeline
Key dates
| Date | What happens |
|---|---|
| 16 January 2023 | Directive in force |
| 18 October 2024 | National rules apply |
Primary sources
Read it at source
- Directive (EU) 2022/2555 (NIS2), OJ L 333, 27.12.2022 Official Journal
Cite as: InfraCompute regulatory tracker, “NIS2 Directive”, checked 27 October 2026, https://www.infracompute.co.uk/tools/regulatory-tracker/eu-nis2.
Related
Also on the tracker
Cyber Security and Resilience Bill
Brings data centres of 1 MW or more (10 MW for enterprise sites) under the NIS rules, with Ofcom as regulator.
United Kingdom · Cyber and resilienceData centres designated critical national infrastructure
UK data centres were designated CNI in September 2024, alongside energy and water.
European Union · Cyber and resilienceCritical Entities Resilience Directive
Member States identify critical entities, including digital infrastructure, which then carry physical resilience duties.
European Union · Energy and efficiencyEU data centre energy reporting and rating scheme
Annual reporting for data centres of 500 kW or more; rating scheme proposed September 2026; minimum standards next.
Method
Each entry is written from the official text and the government, regulator or legislature pages listed above, never from secondary commentary. This entry is checked by hand at each content review. Status and dates can change after the review date, so check the source before relying on it. General information drawn from public filings. It is not legal advice on any transaction, and using this page does not create a lawyer-client relationship. Views are personal.
