Short answer: NIS2 (Directive (EU) 2022/2555) is the EU's cybersecurity law for critical sectors. Health is a sector of high criticality (Annex I): hospitals and other healthcare providers, EU reference laboratories, manufacturers of basic pharmaceutical products and of medical devices critical during a public health emergency, and entities doing research and development of medicinal products. Digital providers that health relies on are covered too: cloud computing, data centres, managed security services, and online platforms and marketplaces. Entities above the size threshold (medium: 50 staff or €10 million turnover) are essential or important depending on sector and size, and must implement ten categories of security measures, report significant incidents in 24 hours, 72 hours and one month, and accept that management is personally accountable. Member states had to transpose by 17 October 2024; several did so late, and the national laws, not the directive, are what applies to you.
Who is in scope
NIS2 covers the health sector as a sector of high criticality: hospitals and other healthcare providers, EU reference laboratories, manufacturers of basic pharmaceutical products and of medical devices critical in a public health emergency, and medicinal product R&D entities, plus the cloud, data centre and managed service providers health relies on. Medium-sized entities are generally important, large ones essential.
| Entity | Annex | Typical status |
|---|---|---|
| Hospitals, clinics, GP networks, laboratories, pharmacies providing care (healthcare providers under Directive 2011/24) | I, health | Essential if large (250+ staff or €50m+), important if medium |
| EU reference laboratories | I, health | Essential |
| Manufacturers of basic pharmaceutical products and preparations | I, health | Essential or important by size |
| Manufacturers of medical devices considered critical during a public health emergency (the Regulation 2022/123 list) | I, health | Essential or important by size |
| Entities carrying out R&D of medicinal products | I, health | Essential or important by size |
| Cloud computing service providers, data centre providers, content delivery networks, managed (security) service providers, DNS, TLD registries | I, digital infrastructure and ICT service management | Essential regardless of size for some (DNS, TLD, trust services); otherwise by size |
| Online marketplaces, search engines, social networks | II, digital providers | Important by size |
| Manufacturers of other medical devices and of computers, electronics, machinery | II, manufacturing | Important by size |
A health-tech SaaS vendor is not a healthcare provider, but it may be in scope as a cloud computing service provider (if it offers cloud services as its business) or be pulled in through its customers: Article 21(2)(d) requires essential and important entities to manage supply chain security, so hospitals pass NIS2-level requirements into contracts with their software suppliers. Micro and small companies are generally out of scope unless a member state designates them (for example as sole providers of a critical service).
The ten measures, Article 21
Article 21 of NIS2 requires every entity in scope to take proportionate measures in ten areas: risk analysis and security policies, incident handling, business continuity and crisis management, supply chain security, secure acquisition and development including vulnerability handling, effectiveness assessment, cyber hygiene and training, cryptography and encryption, human resources security and access control, and multi-factor authentication with secured communications.
Every entity in scope must take appropriate and proportionate technical, operational and organisational measures covering at least:
- policies on risk analysis and information system security;
- incident handling;
- business continuity (backups, disaster recovery) and crisis management;
- supply chain security, including the security of relationships with direct suppliers;
- security in acquisition, development and maintenance of systems, including vulnerability handling and disclosure;
- policies to assess the effectiveness of the measures;
- basic cyber hygiene practices and training;
- policies on cryptography and, where appropriate, encryption;
- human resources security, access control and asset management;
- multi-factor or continuous authentication, secured communications and secured emergency communication.
An implementing regulation of October 2024 (2024/2690) specifies these in detail for digital infrastructure and ICT providers, and national authorities publish their own catalogues for health. The list maps closely onto ISO/IEC 27001 Annex A; an organisation with a certified ISMS scoped over the relevant systems is most of the way there. See ISO 27001 vs ISO 27799.
The incident clock, Article 23
Under Article 23 of NIS2, a significant incident must be reported to the national CSIRT or competent authority in three steps: an early warning within 24 hours of becoming aware, an incident notification within 72 hours with an initial assessment, and a final report within one month covering root cause and mitigation, with an intermediate report on request.
A significant incident (one causing or capable of causing severe operational disruption or financial loss, or affecting others with considerable damage) must be reported to the national CSIRT or competent authority:
- early warning within 24 hours of becoming aware, saying whether malicious action is suspected and whether there is a cross-border impact;
- incident notification within 72 hours, with an initial assessment of severity and impact and indicators of compromise;
- an intermediate report on request;
- a final report within one month, with root cause, mitigation and cross-border impact.
Where personal data is involved, the GDPR's 72-hour notification to the data protection authority runs in parallel; a hospital ransomware attack triggers both. Recipients of services must be informed when the incident may affect them.
Governance, liability, fines
NIS2 makes management personally accountable: management bodies must approve the cybersecurity measures, oversee their implementation and follow training, and can be held liable for infringements; for essential entities, authorities may temporarily suspend managers. Fines reach €10 million or 2% of worldwide turnover for essential entities and €7 million or 1.4% for important entities.
Authorities may audit, require evidence, and in some member states the registration of entities is itself an obligation.
Where transposition stands
NIS2 had to be transposed into national law by 17 October 2024. By mid-2025 roughly half the member states had laws in force, the Commission had opened infringement procedures against late ones, and Germany's implementing act took effect in late 2025. The national law, not the directive, sets the registration deadline, the competent authority and any health-sector catalogue.
The transposition deadline was 17 October 2024. By mid-2025 roughly half the member states had laws in force (Belgium, Croatia, Hungary, Italy, Latvia, Lithuania, Romania, Slovakia among the first), and the Commission opened infringement procedures against the late ones; Germany's NIS2 implementation act took effect in late 2025. Check your national law for the registration deadline, the authority (often the national cybersecurity agency for health, sometimes a health-sector regulator) and sector-specific catalogues. Outside the EU, the UK is following with the Cyber Security and Resilience Bill.
For a health-tech vendor, practically
For a health-tech vendor, NIS2 arrives mainly through hospital contracts: customers in scope must manage supply chain security, so they require incident notification within hours, evidence of the ten Article 21 measures, vulnerability disclosure, subcontractor lists and exit and continuity plans. One information security management system with these elements documented once is the cheapest way to answer.
Anpheros publishes its security practice on the developer site (security, reliability) and runs incident response with both the NIS2 and GDPR clocks in the same runbook.
This page explains regulation for product and engineering teams. It is not legal advice; the texts linked under Sources are the authority, and your data protection officer, notified body or counsel decides for your case. Last reviewed: October 2026.
Related pages
- ISO 27001 vs ISO 27799
- GDPR Article 9 for health data
- Health data regulation map
- DPIA for a health app
- Platform security (developer site)
Sources
- Directive (EU) 2022/2555 (NIS2), EUR-Lex
- Commission Implementing Regulation (EU) 2024/2690 (NIS2 technical requirements for digital providers), EUR-Lex
- European Commission: NIS2 Directive overview
- Regulation (EU) 2022/123 (EMA's reinforced role; critical medical devices list), EUR-Lex
Frequently asked questions
Is my 30-person health software company in scope?
Usually not directly, unless your national law designates you or you provide a service listed in Annex I regardless of size. You will still meet NIS2 through your hospital customers' supply-chain obligations, which flow into contracts.
What is a significant incident?
One that causes or can cause severe operational disruption or financial loss for the entity, or that affects other people or organisations with considerable material or non-material damage. A ransomware attack on a hospital is the textbook case; a brief outage with no data impact usually is not.
Does NIS2 replace the GDPR breach notification?
No. They run in parallel with different recipients (the CSIRT or cybersecurity authority vs the data protection authority), different triggers (service disruption vs personal data breach) and overlapping deadlines.
Is ISO 27001 certification proof of NIS2 compliance?
Not formally, but several member states and ENISA treat a certified ISMS over the relevant scope as strong evidence, and some national schemes accept it as a presumption for most measures. The incident reporting and management-training duties still need to be shown separately.
Try it free in the sandbox
Your first FHIR call in 5 minutes. An HL7 FHIR R4 API with the patient's consent built in: try it in the sandbox, then connect your own app or clinic system.
Free · 30 synthetic patients · no card
Anpheros builds a medical record that the patient controls and can share with any clinic, on an HL7 FHIR R4 platform, based in the EU. These guides help you understand and organise your health; they do not replace your doctor.
About Anpheros →
AnpherosThe more you log, the clearer your record
Your health history in one place, under your control.
Free · Works in your browser · No card
