NIS2 Reform 2026: What Changes with the Commission’s Amendment Proposal

What the NIS2 reform is?

The NIS2 reform of 2026 is a package of targeted amendments to the NIS2 Directive, Directive (EU) 2022/2555, that the European Commission proposed on 20 January 2026. It was published alongside a proposal to revise the Cybersecurity Act, as part of a broader effort to streamline and harmonize the EU’s cybersecurity rules.

Importantly, the reform does not tear up NIS2 or remove its core requirements. Entities in scope still have to manage cyber risk and report significant incidents. What the amendment changes is the edges: who exactly is covered, how consistently the rules apply across member states, and how heavy the administrative burden is for organizations that were struggling with unclear or duplicated obligations.

The headline the Commission itself emphasizes is relief: the reform is expected to ease compliance for around 28,700 entities, including 6,200 micro and small enterprises. In other words, it is a simplification and clarification exercise layered on top of the existing directive, not a replacement of it.

Why the Commission is amending NIS2?

Amending a directive so soon after adoption is unusual, and the reasons say a lot about how NIS2 has landed in practice. These are the main drivers behind the 2026 reform.

The main changes at a glance

The proposal is detailed, but its substance can be grouped into a handful of themes. The table summarizes the main changes and what each one means for organizations.

Scope in and scope out

One of the clearest effects of the reform is that it moves some entities out of scope while pulling others in. Understanding both directions is the key to knowing whether the reform changes your own position.

Timeline and what happens next

The reform is a proposal, not yet law, so its timeline matters as much as its content. The table sets out the key dates and stages.

What it means, and Teldat’s role?

Whatever the final shape of the reform, the core NIS2 duties remain, so the technical foundation of resilience does not change. Teldat is a European manufacturer whose infrastructure supports that foundation, regardless of how entities are reclassified.

FAQ’s about the NIS2 reform

❯ What is the NIS2 reform of 2026?

The NIS2 reform of 2026 is a set of targeted amendments to the NIS2 Directive, Directive (EU) 2022/2555, that the European Commission proposed on 20 January 2026. It forms part of a wider cybersecurity package that also revises the Cybersecurity Act. Rather than replacing NIS2, the reform aims to clarify and narrow its scope, harmonize how it is applied across member states, and reduce the compliance burden, while keeping the core obligations to manage cyber risk and report significant incidents intact. The Commission estimates it will ease compliance for around 28,700 entities, including 6,200 micro and small enterprises.

❯ Why is the Commission amending NIS2 so soon?

The timing reflects practical implementation problems. NIS2 had a transposition deadline of October 2024, but many member states missed it and some are still transposing, which led to infringement proceedings and uneven national rules. That fragmentation created uncertainty and cost for businesses, especially those operating across several countries. The 2026 reform responds by clarifying scope, adding sector thresholds and harmonizing requirements, so that organizations face more predictable and proportionate obligations. It builds on the Digital Omnibus of November 2025, which had already begun streamlining how NIS2 interacts with other EU rules.

❯ What are the main changes in the NIS2 2026 amendment?

The proposal makes several targeted changes. It narrows scope in some sectors, for example only covering electricity producers above a 1 MW generation capacity and limiting the chemical sector to manufacturers subject to REACH. It creates a new small midcap category, generally classifying those entities as important rather than essential to reduce supervisory intensity. It adds strategically sensitive entities such as providers of European Digital Identity Wallets and European Business Wallets, operators of submarine data transmission infrastructure and strategic dual use infrastructure. It also harmonizes technical measures, introduces certification based compliance pathways aligned with the revised Cybersecurity Act, strengthens ENISA’s coordinating role, and adds harmonized data collection on ransomware.

❯ When will the NIS2 reform take effect?

The reform is still a proposal. Published on 20 January 2026, it now goes through the ordinary EU legislative procedure, with negotiations in the European Parliament and Council. Commentators expect political agreement no earlier than late 2026 or early 2027. Once adopted, the amendments would need to be transposed into national law, with the current draft foreseeing a 12 month transposition period after entry into force. Until then, the existing NIS2 obligations continue to apply, so organizations should keep working on current compliance while tracking the proposal, because the core duties to manage risk and report incidents are not going away.

❯ How should organizations respond to the NIS2 reform?

Because the core obligations remain, the practical priority is unchanged: build genuine cyber resilience rather than treating NIS2 as a paperwork exercise. Organizations near a scope threshold, such as the 1 MW electricity line or the small midcap size criteria, should reassess how they may be classified once the reform advances. Regardless of classification, resilient connectivity, layered network and cloud security, and fast detection remain the technical foundation. For that foundation, sourcing infrastructure from a European manufacturer such as Teldat, operating under European jurisdiction, helps align with the direction of EU cyber law, though each organization remains responsible for its own compliance.