NIS2 postponed: companies given more time to prepare

NIS2 is an important European directive designed to strengthen cybersecurity across essential and important sectors, including energy, transport, water, healthcare, digital infrastructure and manufacturing. The directive requires organisations to manage risks within the digital supply chain, report incidents and implement basic security measures.

Although the formal deadline is shifting, the message remains clear: do not wait. Organisations would be wise to get their cybersecurity policies in order now. Pressure on the supply chain is increasing, and suppliers that lack sufficient resilience pose a genuine risk.

For procurement professionals, this means looking beyond price and lead time. Cybersecurity is becoming an increasingly important factor in supplier selection and supplier management. The postponement offers breathing space, but also an opportunity to act proactively.

The new implementation deadline has not yet been officially announced. Introduction of the legislation in the second quarter of 2026 is likely, as the legal text is ready, political and legal pressure is high, the private sector is already anticipating the changes, and the technical and organisational supervision infrastructure is in place. It is now mainly a matter of completing the formal political process.