The NIS-2 simplified compliance framework, as revised by the January 2026 EU cybersecurity package, is the regulatory mechanism that determines how essential and important entities across 27 Member States must govern, document and report their cybersecurity posture. For sovereign infrastructure operators, the 2026 amendments are not a simplification in the intuitive sense: they tighten jurisdictional reach, extend ENISA’s coordinating authority and introduce new ransomware data-collection obligations that require updated documentation strategies alongside the existing requirements of Commission Implementing Regulation (EU) 2024/2690.
What the January 2026 Package Actually Changes
The COM(2026) cybersecurity package amends Directive (EU) 2022/2555 on three structural dimensions: jurisdictional scope, cross-border supervision and the institutional weight of ENISA and EU-CyCLONe.
On scope, the 2026 amendments clarify which legal establishment within a group determines the competent national authority for supervision. Previously, cross-border entities with operations in multiple Member States faced ambiguity about which national regulator had primary jurisdiction. The revision introduces a lead-supervisor model analogous to GDPR’s lead data protection authority, designating the Member State of the entity’s main establishment as the primary competent authority, while allowing coordinated reviews when incidents cross borders. For sovereign infrastructure operators running data centres in Switzerland or Luxembourg while serving clients across the EU, the practical effect is that a single national authority becomes the primary interlocutor, but peer reviews by other Member States’ authorities remain possible under EU-CyCLONe coordination.
ENISA’s coordinating role is expanded explicitly. The agency now holds a formal mandate to develop harmonised methodologies for cross-border incident impact assessments and to publish binding technical guidelines that supplement Implementing Regulation 2024/2690. This closes a gap where Member States interpreted the original Implementing Regulation differently, particularly on supply-chain risk assessment methodology.
Revised Article 21 Obligations and the Ransomware Reporting Framework
Article 21 of Directive (EU) 2022/2555 already imposed ten categories of risk-management measures. The 2026 package refines how those measures are evidenced and introduces a dedicated ransomware data-collection obligation that sits alongside the general incident-reporting timeline.
Under the original Article 21 and Implementing Regulation 2024/2690, essential entities must report significant incidents within 24 hours (early warning), 72 hours (incident notification) and 30 days (final report). The 2026 amendment adds a specific track for ransomware events: operators must now report the ransomware variant identified, whether a ransom demand was received, the approximate ransom amount and whether a payment was made. This information is not publicly disclosed but feeds ENISA’s threat intelligence database and EU-CyCLONe’s situational awareness function.
For sovereign infrastructure operators, the ransomware track creates two documentation obligations that did not exist before: a standing procedure for variant identification (requiring endpoint detection tooling capable of taxonomic classification) and a governance decision record showing who in the organisation is authorised to decide on ransom payment and on what criteria. Both must be available to competent authorities on request.
| Reporting obligation | Original NIS-2 / IR 2024/2690 | After 2026 amendment |
|---|---|---|
| Early warning | 24 hours, significant incidents | Unchanged |
| Incident notification | 72 hours | Unchanged |
| Final report | 30 days | Unchanged |
| Ransomware-specific data | Not required separately | Mandatory: variant, demand, payment decision |
| Supply-chain methodology | Operator-defined, ENISA guidance non-binding | ENISA guidelines become binding reference |
Which Newly In-Scope Entities Face Sovereign Infrastructure Requirements
ENISA estimates that NIS-2 brings approximately 160,000 entities into scope across the EU, a figure cited in the agency’s 2023 scoping analysis. The 2026 amendment’s “simplified compliance” provisions target a subset of important entities, primarily mid-size organisations in sectors such as postal services, waste management and food production, which previously lacked the legal teams to absorb the full documentation burden.
Simplified compliance does not reduce substantive security requirements. What it reduces is the procedural overhead: sector-specific templates replace bespoke policy documents, and self-assessment registers can substitute for third-party audits in certain defined circumstances. However, the 28,700 companies the Commission identified as newly benefiting from these provisions still carry the full Article 21 risk-management obligations if they operate critical infrastructure or process data categories that attract sovereignty requirements under national transposition law.
In practice, a healthcare diagnostics company newly in scope under the health sector annexe must still document encryption standards, access control policies and incident response procedures to the standard set by Implementing Regulation 2024/2690. The simplification lies in how that documentation is structured and submitted, not in what must be demonstrated.
CSA2 Certification and Its Interaction with Article 21
The revised Cybersecurity Act (CSA2), proceeding in parallel with the NIS-2 amendment package, introduces an EU-wide cyber-posture certification scheme designed to create machine-readable, auditable security assertions about cloud services, network equipment and managed security services. The question for sovereign infrastructure operators is whether achieving a CSA2 certification level eliminates the need for separate entity-level audits under NIS-2.
The answer is: partially, and only where national competent authorities explicitly recognise the certification scheme as evidence of compliance with specific Article 21 sub-obligations. The Directive’s amendment text gives competent authorities discretion to accept certification as a rebuttable presumption of compliance for the technical controls covered by the certification’s scope, but does not make that acceptance automatic or uniform across Member States. An operator hosting on a CSA2-certified sovereign cloud platform in Germany would still need to demonstrate that its own organisational policies, incident response procedures and supply-chain contracts satisfy Article 21 beyond the platform’s certified perimeter.
The practical value of CSA2 certification for sovereign operators is greatest in procurement and audit efficiency: a certified platform can produce standardised evidence packages that reduce the time auditors spend validating infrastructure controls, freeing compliance effort for the governance and process layers that certification does not cover.
Enforcement Consequences of Late Transposition
In October 2024, the European Commission sent reasoned opinions to 19 of the 27 Member States for failing to transpose Directive (EU) 2022/2555 by the October 2024 deadline. This is the second step in EU infringement proceedings; if those Member States do not transpose, the Commission can refer them to the Court of Justice of the EU.
Juhan Lepassaar, Executive Director of ENISA, has stated: “NIS-2 is not just a cybersecurity directive; it is a fundamental shift in how the EU expects organisations to govern risk at board level.” That governance expectation is undermined when the national rules implementing the Directive do not yet exist in more than two thirds of Member States.
For cross-border sovereign deployments, the practical consequence is legal uncertainty: a sovereign cloud provider registered in one of the 19 non-transposing Member States faces a situation where the competent national authority may lack the statutory powers NIS-2 requires, making supervisory decisions legally contestable. At the same time, the 2026 amendment’s lead-supervisor model assumes fully transposed national law exists in the lead authority’s jurisdiction. Operators should document which Member States’ transposition is in force for each jurisdiction they operate in and flag gaps formally in their compliance registers.
The IBM Cost of a Data Breach Report 2024 puts the average total cost of a data breach at USD 4.88 million, a figure that underscores why enforcement uncertainty does not reduce actual risk exposure even where it creates regulatory ambiguity.
Documenting Compliance Across Both Instruments Simultaneously
The central documentation challenge for compliance officers is that Implementing Regulation 2024/2690 and the 2026 amendment package are both in force simultaneously and must both be satisfied. The Implementing Regulation sets the technical and methodological floor for Article 21 measures; the 2026 amendment adds scope clarifications, ransomware reporting tracks and ENISA methodological guidelines that become binding references.
A structured approach uses a dual-column control register: one column maps each control to the specific provision in Implementing Regulation 2024/2690, a second column maps the same control to the relevant 2026 amendment obligation. Where the 2026 amendment introduces new evidence requirements (the ransomware governance decision record, the lead-supervisor notification procedure), those are added as standalone controls with their own evidence references. The register should record the date on which each control was last validated, the method of validation (self-assessment, third-party audit or CSA2 certification evidence) and the name of the person responsible.
The European Commission’s DG CONNECT has noted that “the transposition failures we are seeing across Member States create genuine legal uncertainty for operators that must comply across borders today, not after infringement procedures are resolved.” Sovereign infrastructure operators cannot wait for that uncertainty to resolve before building their documentation base: the 2026 amendment obligations apply from the date of entry into force regardless of national transposition status in individual Member States.
For organisations considering sovereign alternatives to US-controlled cloud infrastructure, the NIS-2 2026 amendment package reinforces rather than complicates the case for jurisdiction-controlled hosting. A sovereign environment with documented supply-chain controls, encryption standards and incident response procedures is structurally better positioned to produce the evidence packages that both the Implementing Regulation and the 2026 amendments require, precisely because the infrastructure perimeter is defined, auditable and not subject to foreign-jurisdiction access orders.
FAQ
Does the January 2026 amendment package replace or supplement Directive (EU) 2022/2555?
It supplements and amends the original NIS-2 Directive rather than replacing it. Implementing Regulation 2024/2690 remains fully in force, so organisations must satisfy both instruments simultaneously.
What does “simplified compliance” actually mean for a mid-size financial institution newly in scope?
Simplified compliance reduces certain procedural burdens for important entities, but it does not lower substantive security requirements. Article 21 risk-management measures, incident reporting timelines and supply-chain due diligence obligations all remain unchanged.
Can achieving CSA2 certification remove the need for a separate sovereign-infrastructure audit under NIS-2?
Not automatically. The revised Cybersecurity Act introduces certification schemes that competent authorities may accept as evidence of partial compliance with Article 21, but national supervisors retain discretion. Sovereign infrastructure operators should treat certification as complementary evidence, not a substitute for entity-level audits.
How does patchy national transposition affect a sovereign cloud provider operating in multiple EU Member States?
Where a Member State has not yet transposed NIS-2 in full, the applicable national rules may differ from the Directive’s requirements, creating inconsistency across jurisdictions. The 2026 amendment package strengthens ENISA’s coordinating role and EU-CyCLONe’s cross-border oversight, but closes this gap only prospectively, not retroactively.
What is the first concrete documentation step a compliance officer should take in response to the 2026 package?
Map every Article 21 control already documented under Implementing Regulation 2024/2690 against the revised scope definitions and ransomware reporting obligations introduced in the 2026 amendment, then produce a gap register that records which controls cover both instruments and which require new or updated evidence.