This article describes the general obligations arising from the amended UKSC and is not legal advice — confirm your company's classification and the detailed scope of obligations with a lawyer or compliance advisor.
Why this applies to you too, not just power plants
The previous regime (under the old National Cybersecurity System Act) mainly covered operators of essential services and digital service providers — large organisations in energy, transport, banking, healthcare and digital infrastructure. The amendment implementing NIS2 replaces those categories with two new ones: essential entity and important entity — and significantly widens the list of sectors.
The new list includes, among others: water supply and wastewater, ICT service management, space, postal and courier services, waste management, manufacture and distribution of chemicals, production and distribution of food, research, and manufacturing of certain products (including machinery, equipment and vehicles). If your mid-sized company operates in one of these areas, NIS2 most likely applies to it — even if it has never dealt with cybersecurity regulations before.
Step 1. Check whether you are an important entity (the most common case for a mid-sized company)
A key change in approach: the company itself assesses whether it falls under the act — it no longer waits for an administrative decision as it did before. This is called self-identification.
- Important entity — usually a mid-sized company: more than 50 employees, or annual turnover and balance sheet total above EUR 10 million, operating in one of the sectors covered by the act (including the newly added ones listed above).
- Essential entity — usually a large company: more than 250 employees, or turnover above EUR 50 million and balance sheet total above EUR 43 million, in the highest-risk sectors (energy, banking, healthcare, digital infrastructure, transport).
Most mid-sized companies in the newly added sectors will fall into the important entity category. The difference matters — it affects the scope of supervision and the level of fines (see below).
Example
A food company with 80 employees and annual turnover of EUR 15 million, producing for retail chains — it meets both numerical thresholds (headcount and turnover) and operates in a sector covered by the act. It is an important entity: it must register, implement a minimum ISMS and report significant incidents. The same company with 30 employees and turnover of EUR 4 million — despite operating in the same sector — does not exceed the thresholds and is not covered by the act for now. It's worth checking each threshold separately, because exceeding one of them is enough.
Step 2. Register in the S46 system — deadline: 3 October 2026
S46 is the national ICT system used to register essential and important entities, report incidents and exchange information with the CSIRTs (computer security incident response teams). After self-identification, a company must register in S46 by 3 October 2026 — less than a month from today. Registration includes contact details, the sector of activity and the person responsible for contact with the supervisory authorities.
Failing to register on time is a standalone basis for a fine — regardless of whether the company has already implemented any security measures.
Step 3. Get the management board involved — it is personally liable
NIS2 explicitly requires management to approve and oversee cybersecurity risk management measures. Negligence can lead to personal liability of board members, independent of any fines imposed on the company itself. In practice this means three things to do right away:
- the board familiarises itself with the obligations and signs off the decision to start implementation,
- someone specific — a person, a department or an external partner — gets the mandate and budget for implementation (in a mid-sized company without its own security team, an “on-demand” cybersecurity advisor works well),
- the board sets a progress review cadence — e.g. monthly until 3 April 2027 (see step 4).
Step 4. Carry out a risk analysis and build a minimum ISMS — deadline: 12 months
Companies that already met the important or essential entity criteria on 3 April 2026 (the day the amendment came into force) have 12 months — until 3 April 2027 — to implement an information security management system (ISMS) and a documented risk analysis. For a mid-sized company without its own IT security team, a realistic minimum ISMS scope covers:
- risk analysis — an inventory of systems and data critical to the business and an assessment of what happens if they go down;
- incident handling policy — who responds, when and how (see step 5);
- business continuity plan — backups and a procedure for restoring systems after a failure or attack;
- supply chain security — assessment of IT suppliers and subcontractors with access to your systems;
- access control and multi-factor authentication (MFA) for accounts with access to critical systems;
- regular staff training — basic cyber hygiene and recognising phishing.
It doesn't have to be an elaborate enterprise-grade system from day one — the act allows measures proportionate to the company's size and risk profile. What matters is that they are real and documented, not just written down on paper.
Step 5. Prepare an incident reporting procedure: 24 hours, 72 hours, 30 days
For a significant security incident (one that actually disrupts the service or causes losses), a three-stage reporting model to the competent CSIRT applies — exclusively through the S46 system:
- within 24 hours of detection — early warning: a signal that an incident has occurred, with an initial assessment of whether it may have been caused deliberately;
- within 72 hours — the incident notification proper: a fuller assessment of the incident, including its scale and impact;
- within 30 days of the notification — final report: a detailed description of the incident, the measures taken and lessons learned.
Without a procedure prepared in advance and a designated on-call person, these deadlines are hard to meet in practice — it's worth writing it up calmly before an incident actually happens.
What ignoring the obligation costs
Administrative fines for failing to meet NIS2/UKSC obligations are significant even for a mid-sized company:
- essential entity — up to EUR 10 million or 2% of annual worldwide turnover, whichever is higher;
- important entity — up to EUR 7 million or 1.4% of annual worldwide turnover.
On top of that comes the personal liability of board members for failing to oversee the implementation of risk management measures, mentioned above. So missing the S46 registration or ignoring the ISMS deadline is not an “administrative oversight” but a real financial and personal risk for decision-makers. Regardless of any fine, the supervisory authority can also order the company to remedy identified breaches within a set deadline — which, if the topic has been neglected, means implementing under time pressure instead of following a calm plan spread over months.
Plan for the coming weeks
If you are just getting started, work in this order:
- now — self-identification: check your sector and your company's headcount and turnover against the thresholds in step 1;
- by 3 October 2026 — registration in the S46 system;
- in parallel — a board decision and appointing the person or partner responsible for implementation;
- by 3 April 2027 — risk analysis, a minimum ISMS and a tested incident reporting procedure.