NIS2 Is Being Rewritten: What the 2026 Amendment Proposal Means for You and Your Clients

Twenty-two of 27 EU member states have now transposed NIS2 into national law. While most organisations are still scrambling to meet the original requirements, the European Commission has already published a proposal to change the rules. On January 20, 2026, the Commission released an amendment package that touches scope, ransomware reporting, certification, and cross-border supervision.

This isn't a complete rewrite. But for IT consultants, MSPs, and vCISOs advising clients on NIS2 compliance, it introduces enough new complexity to warrant a close read — now, not after trilogue negotiations wrap up later in 2026.

Why the Commission Is Already Amending a Directive That Isn't Fully Implemented

NIS2 became enforceable in October 2024. Several countries missed the transposition deadline; a handful are still working through it. The Commission's broader Digital Omnibus Package, launched in November 2025, is systematically streamlining EU digital legislation to reduce fragmentation. NIS2 got caught in that sweep. Real-world implementation also exposed gaps — particularly around divergence in national rules and the lack of any harmonised certification pathway.

The January 2026 proposal is described as "targeted" — the Commission isn't revisiting the fundamental architecture of NIS2. The ten security measures in Article 21 remain unchanged. The incident reporting timelines (24 hours, 72 hours, one month) are unchanged. What's changing is how the directive interacts with certification, how ransomware incidents get reported, and who exactly falls within scope.

Ransomware Reporting: New Obligations on the Horizon

This is the change most relevant to your day-to-day incident response work.

Under current NIS2, organisations must report "significant incidents" following the standard three-step timeline. The amendment proposal adds ransomware-specific reporting requirements on top of that. If a national authority requests it, organisations will be required to disclose whether a ransom demand was made and by whom, whether a ransom was paid, the amount and payment method, and the identity of the recipient (including any crypto-asset service provider involved).

Disclosure of ransom payment is not automatic — it's triggered by an authority request. The proposal targets the information asymmetry that regulators have struggled with: authorities often have no visibility into whether victims quietly pay ransoms, which undermines threat intelligence and attribution efforts.

For IT consultants advising clients: this doesn't change your incident response playbook today, since the amendment still needs to pass through EU legislative procedure. But it signals clearly where enforcement is heading. Clients who manage ransomware incidents need to start building internal documentation practices now — logging decision points, amounts, and communications — so they're not reconstructing that information under regulatory pressure after the fact.

Scope Changes: Who's In, Who's Out

The proposal makes three notable scope adjustments. Operators of undersea cables and submarine communication systems will be brought within scope for the first time — a direct new obligation for carriers, telecoms, or data centre operators with subsea connectivity assets. Chemical distribution goes out: the amendment removes "distribution" from Annex II, limiting coverage to manufacturers and producers. A new "small mid-cap" category covers organisations with fewer than 750 employees and under €150 million turnover — these would generally be treated as "important entities" rather than "essential entities," meaning reactive rather than proactive supervision.

Certification as a Compliance Pathway: The Cyber-Posture Certificate

Under the proposed amendment, entities will eventually be able to obtain an EU "cyber-posture certificate" — a new entity-level certification under a future European cybersecurity certification scheme aligned with Cybersecurity Act 2 (CSA2). If an entity holds a valid cyber-posture certificate covering Article 21 requirements, competent authorities cannot subject it to additional security audits for those requirements. Prove compliance once, avoid duplicative national audits.

CSA2 is itself still a proposal. The certification schemes don't exist yet. But for clients building long-term compliance programmes, the direction is clear: invest in frameworks and controls that will be certifiable, not just documentable. ENISA's guidance mapping NIS2 requirements onto ISO 27001 controls is likely to become the foundation for future cyber-posture certificates — ISO 27001 work today is a head start.

For more background on the ten Article 21 security measures, see the NIS2 Article 21 deep dive.

Stronger ENISA Role: What Cross-Border Supervision Looks Like

ENISA gets a more operational role under the proposal. It will facilitate cooperation between national competent authorities, help determine a lead authority for joint supervisory actions, conduct a cybersecurity risk analysis within 15 months of entry into force, and participate directly in joint supervisory activities upon request. This is not a GDPR-style one-stop-shop — entities still report incidents through national authorities. But the coordination layer is being strengthened, which should reduce the problem of an entity in five countries facing five separate and sometimes contradictory supervisory processes.

What Changes and When: A Practical Timeline

Parliament and Council negotiations are expected through the second half of 2026. Conservative estimate: these amendments won't be in national law before late 2027 or early 2028. Start advising clients now — but selectively. The ransomware documentation requirement is low-cost to implement now and high-cost to reconstruct after an incident. The certification pathway is aspirational — build toward ISO 27001 alignment. Scope changes are the highest priority for clients in affected sectors.

The Bigger Picture: NIS2 Enforcement Is Already Starting

The European Commission's message is clear: 2026 is the year enforcement begins in earnest. Seven member states have already been referred to the Court of Justice for missing the transposition deadline. National authorities are starting to conduct inspections. The first fines are expected before year end. Clients who have been treating NIS2 compliance as a future problem are running out of runway.

The proposed amendments don't give organisations more time. They add new obligations on top of the existing baseline. The most defensible position for any in-scope organisation right now is a documented gap analysis showing where they stand against Article 21, what remediation is in progress, and what the timeline looks like.

If your clients haven't done that gap analysis yet, run it now. The NIS2 quick-scan at NIS2Certify gives you a structured starting point in under 20 minutes.