What Is the NIS2 Directive? Impact on Turkish Companies

"What is the NIS2 Directive, and why are our EU customers asking us for cybersecurity documents?" is a question heard more and more often at Turkish companies that supply products or services to Europe. NIS2 is the European Union's common framework for the security of network and information systems. It does not apply directly in Türkiye, but it can reach Turkish companies through customers, subsidiaries and digital services in the EU.

In this article we summarize the Directive's scope, entity types, reporting deadlines and implementation timeline, strictly as they appear in the text of the Directive and on the official pages of EU institutions. Obligations in Türkiye are a separate framework; we covered them in our article on Cybersecurity Law No. 7545.

What is the NIS2 Directive?

Its official name is Directive (EU) 2022/2555. It was adopted on 14 December 2022 and published in the Official Journal of the European Union on 27 December 2022. There is no Turkish version of the text; the references in this article are based on the English text. According to ENISA, the Directive entered into force on 16 January 2023 and replaced the earlier NIS Directive (2016/1148).

As a directive, NIS2 is addressed to Member States rather than companies (Art. 46). What binds companies is the national legislation through which each Member State has transposed the Directive. The timeline works accordingly:

• 17 October 2024: The date by which Member States had to adopt and publish their national rules (Art. 41).
• 18 October 2024: The start of application of the national rules and the repeal of NIS1 (Art. 41, Art. 44).
• 17 April 2025: The date by which Member States had to establish their list of essential and important entities; the list is reviewed at least every two years (Art. 3(3)).

Transposition did not move at the same speed in every country. According to the European Commission's transposition page, on 7 May 2025 the Commission sent a reasoned opinion to 19 Member States that had not notified full transposition. The main text a company needs to look at is therefore the NIS2 implementing law of the country where it operates.

Whom does it cover? Essential and important entities

The Directive applies to public or private entities of the types listed in Annex I and Annex II. The criterion is being medium-sized or larger under the EU's SME definition and providing services or carrying out activities within the EU (Art. 2(1)). The sectors are grouped in the two annexes:

• Annex I, sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business-to-business), public administration and space.
• Annex II, other critical sectors: postal and courier services, waste management, the production and distribution of chemicals, the production, processing and distribution of food, manufacturing, digital providers and research.

Some entities are covered regardless of size: providers of public electronic communications, trust service providers, top-level domain name registries and DNS service providers, domain name registration service providers, and entities that a Member State regards as sole providers or as critical (Arts. 2(2) to 2(4)).

Covered entities fall into two groups (Art. 3). Essential entities are mainly those in Annex I that exceed the medium-sized thresholds, together with those a Member State places in this category. Important entities are all covered entities that do not qualify as essential. The difference lies in supervision: essential entities are subject to preventive supervision such as on-site inspections and regular security audits (Art. 32), while for important entities supervision is provided for after the fact (ex post), when evidence or information of non-compliance emerges (Art. 33).

What is required of companies?

Management responsibility (Art. 20). Management bodies are required to approve the cybersecurity risk-management measures, oversee their implementation and undergo training; they can be held liable for infringements of Art. 21.

Risk-management measures (Art. 21). The measures must be based on an "all-hazards" approach and must cover at least the following: risk analysis and information system security policies; incident handling; business continuity and crisis management; supply chain security; security in system acquisition and development, including vulnerability handling; assessing the effectiveness of the measures; basic cyber hygiene and training; cryptography; human resources security together with access control and asset management; and, where appropriate, multi-factor authentication.

Incident reporting (Art. 23). A "significant incident", meaning one that significantly affects service delivery, is reported in stages to the national CSIRT or the competent authority:

1. An early warning within 24 hours of becoming aware of it,
2. An incident notification and initial assessment within 72 hours,
3. An intermediate report if the competent authority requests one,
4. A final report no later than one month after the incident notification; if the incident is still ongoing at that date, a progress report.

What it means for Turkish companies serving the EU

The Directive does not set a general obligation for companies outside the EU; its effect arises through three bases in the text.

1. A subsidiary established in the EU. Covered entities generally fall under the jurisdiction of the Member State in which they are established (Art. 26(1)). A Turkish group's company that is established in the EU and operates in an Annex I or Annex II sector may be subject to that country's NIS2 implementing law if it meets the size condition.

2. Digital service providers not established in the EU. Providers of cloud computing, data centre, content delivery network, managed services and managed security services, as well as online marketplaces, search engines and social networking platforms, must designate a representative in the EU if they are not established there but offer services in the EU (Art. 26(3)). If there is no representative, any Member State where the service is provided may take legal action. This provision applies only to the listed service types; the text contains no representative requirement for non-EU companies in other sectors.

3. Being a supplier to a covered customer. In practice, this is the most common effect. Art. 21(2)(d) requires supply chain security to cover relationships with direct suppliers and service providers, and Art. 21(3) calls for each supplier's vulnerabilities and secure development practices to be taken into account. The Directive's recitals encourage reflecting these measures in contracts with direct suppliers. The Directive does not itself place an obligation on the supplier, but an EU customer may, for its own compliance, want to add security clauses, an incident notification commitment or audit rights to the contract. In meeting these requests, a framework such as an ISO 27001 information security management system can provide a common language.

Sanctions: article and type

The Directive leaves the sanction amounts to Member States in the form of minimum ceilings; this article gives no amounts. The types of sanction are as follows:

• Supervisory and enforcement measures (Arts. 32-33): warnings, binding instructions, orders to remedy deficiencies, orders to implement audit recommendations, and orders to make the infringement public.
• Additional measures for essential entities (Art. 32(5)): if earlier measures are ineffective, the temporary suspension of the relevant certification or authorization, and a request that the chief executive be temporarily prohibited from exercising managerial functions.
• Administrative fines (Art. 34): for infringements of Art. 21 and Art. 23; separate ceilings are set for essential and important entities, along with a calculation tied to total worldwide annual turnover.
• National penalties (Art. 36): Member States separately lay down rules on effective, proportionate and dissuasive penalties.

Proposed amendment

According to the European Commission's NIS2 page, on 20 January 2026 the Commission proposed targeted amendments to NIS2 to increase legal clarity, as part of a new cybersecurity package. This is a proposal; until it is adopted, the text in force remains 2022/2555.

Where to start?

The steps below are a general framework derived from the articles of the Directive:

1. Establish your position: List separately any subsidiaries established in the EU, digital services offered directly to the EU, and supply relationships with covered customers in the EU.
2. Find the country law: Identify the NIS2 implementing law and the competent authority of each Member State where you operate.
3. Prepare for customer requests: Map your existing policies and evidence against the ten headings in Art. 21(2).
4. Write down the notification flow: Define who will provide information, and within what time, in an incident that could affect a customer.

Conclusion

NIS2 does not apply directly in Türkiye, but it concerns Turkish companies through subsidiaries in the EU, digital services offered to the EU, and the supply chain requests of covered customers. From Orient Global's perspective, turning the headings in Art. 21 into a documented compliance map now makes it easier to answer, from the same foundation, both the questions of EU customers and the local obligations under Law No. 7545.

This article is for general information only and does not constitute legal or financial advice. For your own situation, consult your advisor.

#interimmanagement #forwarddeployedengineering