/ Across Industry, Board & Governance / By

NIS2, DORA and the UK Cyber Resilience Bill: A Director's Briefing

NIS2 and DORA are EU laws already in force: NIS2 (Directive (EU) 2022/2555) had to be applied by EU Member States from 18 October 2024, and DORA (Regulation (EU) 2022/2554) has applied to EU financial entities since 17 January 2025. Neither is UK law, but both can reach UK companies that provide services in the EU, own EU subsidiaries or supply technology to EU firms. The UK's own Cyber Security and Resilience (Network and Information Systems) Bill is still going through Parliament: as of 11 November 2026 it is at the stage where the Commons considers Lords amendments, and it has not received Royal Assent.

European Union flags flying outside a glass office building

This briefing sets out, for each regime, who it covers, what it requires, what boards are personally expected to do, the penalties and the key dates. It is general information, not legal advice: take advice on your own organisation’s position.

Why UK directors should care about EU rules

Brexit did not put UK firms beyond EU cyber law. There are three common routes in:

  • You operate in the EU. NIS2 applies to medium-sized and larger entities in its listed sectors “which provide their services or carry out their activities within the Union” (Article 2(1)). An EU subsidiary of a UK group will be in scope in its own right if it meets the sector and size tests.
  • You sell certain digital services into the EU from the UK. NIS2 Article 26(3) requires providers such as cloud, data centre, managed service and managed security service providers that are “not established in the Union, but offers services within the Union” to designate a representative in the EU.
  • Your customers are regulated. NIS2 requires covered entities to manage supply chain security, and DORA requires EU financial entities to put specific terms into contracts with their ICT providers. UK suppliers feel this through their contracts.

NIS2: the EU’s cross-sector cyber law

What it is. Directive (EU) 2022/2555 of 14 December 2022 “on measures for a high common level of cybersecurity across the Union”. As a directive, it works through national laws. Member States had to adopt them by 17 October 2024 and apply them from 18 October 2024 (Article 41). Not all did: on 8 July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice for failing to notify full transposition. The detailed rules depend on the country.

Who it applies to. Entities in the sectors listed in its Annexes (the Commission describes 18 critical sectors), generally if they are medium-sized or larger. Some, such as DNS service providers and trust service providers, are covered regardless of size.

Key obligations.

  • Risk management (Article 21): “appropriate and proportionate” technical, operational and organisational measures, including at least incident handling, business continuity and backups, supply chain security, vulnerability handling, cyber hygiene and training, cryptography, access control and multi-factor authentication.
  • Incident reporting (Article 23): for a significant incident, an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours, and a final report no later than one month after the notification.
  • Board accountability (Article 20): management bodies must approve the risk-management measures, oversee their implementation and “can be held liable” for infringements. Members of management bodies “are required to follow training”.

Penalties (Article 34). For breaches of the risk-management or reporting duties, Member States must allow fines of at least up to EUR 10 million or 2% of total worldwide annual turnover (whichever is higher) for essential entities, and at least up to EUR 7 million or 1.4% for important entities. For essential entities, as a last resort where earlier enforcement measures have not worked and a deadline to put things right has been missed, authorities can also ask a court or other body to temporarily prohibit a person at chief executive or legal representative level from exercising managerial functions (Article 32(5)).

DORA: digital operational resilience for EU finance

What it is. Regulation (EU) 2022/2554 of 14 December 2022 on digital operational resilience for the financial sector. As a regulation it is directly applicable in every Member State, and it has applied since 17 January 2025 (Article 64).

Who it applies to. A long list of EU financial entities in Article 2, including banks, payment and e-money institutions, investment firms, crypto-asset service providers, insurers and insurance intermediaries, fund managers and occupational pension schemes. It does not apply to UK-authorised firms as such, but it does apply to a UK group’s EU-authorised entities.

Key obligations.

  • Board accountability (Article 5): the management body must “bear the ultimate responsibility for managing the financial entity’s ICT risk”, approve the digital operational resilience strategy and ICT business continuity policy, and keep its knowledge up to date “including by following specific training on a regular basis”.
  • Incident reporting (Article 19 and Commission Delegated Regulation (EU) 2025/301): an initial notification within four hours of classifying an incident as major and no later than 24 hours from becoming aware of it, an intermediate report within 72 hours of the initial notification, and a final report within one month of the latest intermediate report.
  • Testing (Articles 24 to 27): a resilience testing programme, and for entities identified by their regulator, threat-led penetration testing (TLPT) on live production systems at least every three years. Our post on whether your company needs a red team explains what that kind of testing involves.

ICT third-party risk. This is where UK technology suppliers are most exposed. Financial entities must keep a register of information on all their ICT contracts (Article 28(3)), and contracts must set out rights and obligations in writing, with specific terms required (Article 30). The EU’s financial supervisors (the ESAs) can designate critical ICT third-party providers for direct oversight; the first list, published on 18 November 2025, named 19 providers. Under Article 31(12), EU financial entities may only use a designated critical provider established outside the EU if it sets up an EU subsidiary within 12 months of designation.

Penalties. DORA leaves administrative penalties for financial entities to Member States (Article 50) rather than fixing a maximum. For designated critical providers, the lead overseer can impose periodic penalty payments of up to 1% of average daily worldwide turnover (Article 35(8)).

The UK Cyber Security and Resilience Bill: where it stands

Status (checked 11 November 2026). The Bill’s full title is the Cyber Security and Resilience (Network and Information Systems) Bill. It was introduced in the Commons on 12 November 2025, carried over into the new session, and passed its Commons third reading on 16 June 2026. The Lords completed report stage on 26 October 2026 and third reading on 2 November 2026. Its current stage on the Parliament website is Commons “Consideration of Lords amendments”. It is a Bill, not an Act. None of it is yet law.

What it would do. It would amend the Network and Information Systems Regulations 2018, the UK’s existing NIS regime. According to the government’s factsheets (updated 3 November 2026):

  • Wider scope: data centres would become essential services; medium and large managed service providers would come into scope, regulated by the Information Commission and required to register within three months of the rules commencing; large load controllers would be covered; and regulators could designate individual “critical suppliers”.
  • Faster incident reporting: an initial notification to the regulator within 24 hours of becoming aware of an incident, with the NCSC informed at the same time, and a fuller report within 72 hours. Digital service providers, managed service providers and data centres would also have to notify affected customers.
  • Higher penalties: two bands, up to £17 million or 4% of worldwide turnover (whichever is higher) for more serious breaches, including incident notification and security duties, and up to £10 million or 2% for less serious ones. Today’s NIS maximum is £17 million.
  • Government powers: the Secretary of State could issue a statement of strategic priorities that regulators must have regard to, update the regime through secondary legislation and issue directions in response to threats.

When it would apply. The government says the Bill “will come into force in phases once it has become an Act”, with many measures depending on secondary legislation and a later commencement decision.

The board question. Unlike NIS2 and DORA, neither the government’s April 2025 policy statement on the Bill nor its factsheets (updated 3 November 2026) describe a duty on boards or named directors. UK board expectations currently sit in guidance, notably the Cyber Governance Code of Practice published in April 2025, which the government says “should be the first point of reference for board members”.

Side-by-side comparison

NIS2DORAUK Bill
Legal formEU directive, via national lawsEU regulation, directly applicableUK Bill amending the NIS Regulations 2018
StatusTo be applied from 18 October 2024Applies from 17 January 2025Before Parliament; no Royal Assent
WhoMedium and larger entities in listed sectors operating in the EUEU financial entities; ICT providers through contracts and oversightEssential services, digital and managed service providers, data centres, designated critical suppliers
First incident reportEarly warning within 24 hoursWithin 4 hours of classifying as major, no later than 24 hours from awarenessInitial notification within 24 hours
Follow-up72 hours; final report within one monthIntermediate within 72 hours; final within one monthFuller report within 72 hours
Board duties in the textApprove, oversee, can be held liable, trainingUltimate responsibility for ICT risk, regular trainingNone described in the government’s policy statement or factsheets
TestingAssess effectiveness of measuresTesting programme; TLPT every 3 years for identified firmsNot described in the government’s factsheets
Maximum finesAt least EUR 10m or 2% (essential); EUR 7m or 1.4% (important)Set by Member States; 1% of daily turnover for critical ICT providersProposed £17m or 4%; £10m or 2%

Five questions to put to management

  1. Which of our entities, services and customers bring us within NIS2 or DORA, directly or through contracts, and who has confirmed that in writing?
  2. Could we file a first incident report within 24 hours, at 3am on a Sunday? Who decides an incident is “significant” or “major”?
  3. Has every board member had the training that NIS2 and DORA expect of management bodies, and is it recorded?
  4. Which of our suppliers are critical to us, and what do our contracts let us require of them?
  5. If the UK Bill brings us into scope as a managed service provider, data centre or critical supplier, what would we need to change?

For example, imagine a 60-person UK managed service provider with a Dublin office and several EU bank clients: it may need to look at NIS2 through its Irish operations, DORA through its bank contracts, and the UK Bill’s managed service provider duties once commenced.

How LSCS can help

Our Board Governance of Cybersecurity course covers DORA, NIS2 and UK regulatory expectations for directors. It runs as one day in person or five days virtual instructor-led (12 hours), is BCS Tech 10 accredited and costs £1,900; contact us for dates. For a whole board or leadership team, see enterprise training.

Frequently asked questions

Does NIS2 apply to UK companies?

Not as UK law, but it can apply to a UK group’s EU entities, and some UK digital providers offering services in the EU (such as cloud, data centre and managed service providers) must designate an EU representative. UK suppliers may also face NIS2-driven contract terms from EU customers.

Does DORA apply to UK firms?

DORA applies to EU financial entities, including EU subsidiaries of UK groups. UK ICT providers serving EU financial entities are affected through required contract terms and, if designated as critical, direct EU oversight.

Is the Cyber Security and Resilience Bill law yet?

No. As of 11 November 2026 it is at Commons consideration of Lords amendments and has not received Royal Assent. Even after it becomes an Act, the government says it will come into force in phases.

What are the incident reporting deadlines?

NIS2: early warning within 24 hours, notification within 72 hours, final report within one month. DORA: initial notification within 4 hours of classifying an incident as major and no later than 24 hours from awareness. The UK Bill proposes 24 hours for an initial notification and a fuller report within 72 hours.

Can directors be personally liable under NIS2?

NIS2 requires Member States to ensure management bodies can be held liable for breaches of the risk-management duties, and allows temporary bans on chief executive level managers of essential entities in some circumstances. The detail depends on each country’s national law.

References

Start Learning With LSCS

Student wearing headphones studying online on a laptop at home
OUR COURSES

RELATED POSTS

ALL POSTS
Professional studying with books and a laptop in a library
Career Outlook

CGRC vs CRISC vs ISO 27001 Lead Auditor: Which GRC Cert to Take?

November 11, 2026
Colleagues reviewing printed charts and a laptop at a meeting table
Across Industry

Cyber Risk Register Template: How to Build One and Actually Use It

November 11, 2026
Security professional working at a computer workstation with code on screen in an office
Career Outlook

Is Ethical Hacking a Good Career? Pay, Path and Day-to-Day in the UK

November 11, 2026

Stay Ahead With LSCS

Get critical Cybersecurity updates, events invitations, and industry analysis. Our immersive, hands-on training is the most direct path to a high-growth cyber career.

Subscription Form
Scroll to Top