The NIS2 Directive: What UK Businesses Need to Know in 2026

The NIS2 Directive represents one of the most significant shifts in European cybersecurity regulation since GDPR. Originally an EU regulation, its implications now extend across the UK through our post-Brexit alignment frameworks and direct adoption by UK regulators. For MSPs, risk teams, and corporate security leaders, 2026 marks a critical juncture where understanding and action converge.

What Is NIS2?

The Network and Information Security Directive 2 (NIS2) is the EU's updated cybersecurity framework designed to raise the minimum baseline of security requirements for essential and important entities. It replaces the original NIS Directive from 2016 with significantly expanded scope, tighter requirements, and steeper penalties for non-compliance.

Unlike the original NIS Directive, which focused narrowly on essential services (energy, water, transport, healthcare), NIS2 casts a much wider net. It now covers:

This expansion means that even mid-market companies may find themselves classified as "important" entities, triggering mandatory compliance obligations.

The Compliance Landscape in 2026

The UK's approach to NIS2 has been pragmatic. Rather than directly transposing the EU directive, the UK Financial Conduct Authority (FCA), Prudential Regulation Authority (PRA), and sectoral regulators have embedded NIS2-equivalent requirements into their own guidance and regulations. This means:

For organisations outside these regulated sectors, the primary driver is contractual - customers and partners increasingly demand NIS2 compliance as part of due diligence and vendor risk management.

Key Requirements Under NIS2

NIS2 establishes a risk-management framework with five core pillars:

1. Governance and Risk Management

Organisations must implement comprehensive information security policies aligned to a documented risk management framework. This goes beyond compliance checklists - regulators now expect dynamic, evidence-based approaches to identifying, assessing, and responding to emerging threats.

Governance structures must include:

2. Asset and Access Management

NIS2 requires organisations to maintain continuous visibility of their IT assets, data flows, and access controls. This includes:

3. Threat Detection and Response

Organisations must implement continuous monitoring to detect anomalies, intrusions, and security incidents. This includes:

4. Business Continuity and Resilience

NIS2 requires organisations to maintain operational resilience through:

5. Supply Chain Security

For the first time, NIS2 explicitly addresses third-party and supply chain risk through:

Penalties and Enforcement

This is where NIS2 delivers teeth. The directive authorises national regulators to impose penalties that dwarf previous cybersecurity regulations:

For a FTSE 100 company with £2 billion in annual revenue, 2% of turnover translates to £40 million in potential fines. The deterrent effect is immediate and substantial.

Compliance Deadlines: What Happens When

The transition timeline varies by country:

For the UK, the FCA's implementation timeline suggests:

Preparing Your Organisation in 2026

The window to prepare is narrowing. Here's a pragmatic roadmap:

Q1 2026: Assessment and Scoping

Determine whether your organisation falls within NIS2 scope:

Document your current security posture against the five NIS2 pillars above. Identify gaps using a recognised framework (ISO 27001, NIST Cybersecurity Framework, or CIS Controls).

Q2 2026: Governance and Planning

Establish governance structures and assign accountability:

Q3 2026: Technical Implementation

Deploy technology to address identified gaps:

Q4 2026: Monitoring and Review

Establish ongoing compliance monitoring:

How Fig Supports NIS2 Compliance

Fig Group's platform directly addresses the NIS2 compliance burden through:

The Bottom Line

NIS2 compliance is no longer optional in 2026 - it's foundational. The directive forces organisations to shift from compliance theatre (audits, reports, certifications) to genuine operational security maturity.

The organisations best positioned to succeed are those that start their assessment and planning now. By summer 2026, you should have a clear understanding of your obligations, documented your current posture, and begun remediation. By the end of 2026, continuous monitoring and evidence collection should be operational.

The cost of action pales in comparison to the cost of inaction: a £40 million fine, regulatory scrutiny, and reputational damage. The time to prepare is now.