--- title: "NIS 2 amendments: what the Commission proposes" description: "There is no NIS 3: the Commission proposes targeted NIS 2 amendments. Small mid-caps, ransomware data, certification and where the procedure stands." canonical: https://www.aegister.com/en/cms/insights/nis2-targeted-amendments-proposal-2026/ url: /en/cms/insights/nis2-targeted-amendments-proposal-2026/ lang: en --- ![](https://www.aegister.com/static/images/header-contact.webp) # NIS 2 amendments: what the Commission proposes There is no NIS 3. On 20 January 2026 the Commission proposed targeted amendments to NIS 2 (COM(2026) 13): a small mid-cap category that would make many Annex I companies important rather than essential, scope changes, harmonised ransomware data, cyber posture certification and an ENISA role in cross-border supervision. With the Digital Omnibus single entry point, where the procedure stands as of 8 October 2026 and what still applies in Italy. October 13, 2026 10 min read ![Facade of a European institutional building in Brussels](https://www.aegister.com/static/images/cms/theme-eu-institution.webp) Made with AI [NIS 2](https://www.aegister.com/en/cms/keyword/nis-2/)[Incident notification](https://www.aegister.com/en/cms/keyword/incident-notification/)Cybersecurity ActDigital Omnibus Contents 1. [In brief](#in-brief) 2. [What the Commission proposed on 20 January 2026](#what-the-commission-proposed-on-20-january-2026) 3. [The main changes](#the-main-changes) 4. [Small mid-caps: who could move from essential to important](#small-mid-caps-who-could-move-from-essential-to-important) 5. [Incident reporting: a single entry point (Digital Omnibus)](#incident-reporting-a-single-entry-point-digital-omnibus) 6. [Where the procedure stands (as of 8 October 2026)](#where-the-procedure-stands-as-of-8-october-2026) 7. [What does not change today for Italian entities](#what-does-not-change-today-for-italian-entities) Anyone searching for "NIS 3" gets a simple answer: there is no NIS 3, and no EU institution uses the name. On 20 January 2026 the European Commission proposed targeted amendments to Directive (EU) 2022/2555, the NIS 2 Directive, in proposal [COM(2026) 13](https://data.consilium.europa.eu/doc/document/ST-5627-2026-INIT/en/pdf), presented together with the new Cybersecurity Act. This guide explains what would change, who would be affected, where the procedure stands and what remains in force today for Italian entities. ## In brief - There is no "NIS 3": proposal COM(2026) 13 amends some articles and the annexes of NIS 2, which remains the reference directive. - The change that matters most to companies is the small mid-cap category: in the Annex I sectors these companies would, as a main rule, be important entities rather than essential ones. - Electricity producers up to 1 MW and micro and small DNS service providers would leave the scope; providers of European Digital Identity Wallets and European Business Wallets and operators of submarine data transmission infrastructure would join it. - Ransomware notifications would carry harmonised data; ransom details would be shared only at the CSIRT's request. The 24 hour, 72 hour and one month deadlines do not change. - A separate proposal, the Digital Omnibus, provides for a single entry point run by ENISA for incident reporting, without changing the obligations. - As of 8 October 2026 the proposal is before the European Parliament and the Council: neither has adopted a position yet. Until the amendments are adopted and transposed, D.Lgs. 138/2024 and the determinations of the Italian National Cybersecurity Agency (ACN) remain in force. ## What the Commission proposed on 20 January 2026 The package presented in Strasbourg on 20 January 2026 holds two separate texts. The first is the Cybersecurity Act 2, [COM(2026) 11](https://data.consilium.europa.eu/doc/document/ST-5611-2026-INIT/en/pdf): a regulation on ENISA, European cybersecurity certification and ICT supply chain security, which we covered in our article on the [EU Cybersecurity Act revision](https://www.aegister.com/en/cms/insights/eu-cybersecurity-act-revision-2026/). The second is the directive amending NIS 2 "as regards simplification measures and alignment with" the Cybersecurity Act 2: COM(2026) 13, procedure 2026/0012(COD). The measures on high-risk suppliers in mobile networks are in the Cybersecurity Act 2, not in the NIS 2 amendment. The Commission presents the amendments as simplification. By its estimates they ease compliance for 28,700 companies, including 6,200 micro and small ones, and the new small mid-cap category lowers compliance costs for 22,500 companies ([Commission press release IP/26/105](https://ec.europa.eu/commission/presscorner/detail/en/ip_26_105); [questions and answers on the package](https://digital-strategy.ec.europa.eu/en/faqs/cybersecurity-package-questions-answers)). The proposal does not rewrite the directive. It changes definitions, scope, registration, ransomware reporting, certification and cross-border supervision. It leaves the core obligations untouched: management body accountability (Article 20), the cybersecurity risk-management measures listed in Article 21 and the notification of significant incidents under Article 23 stay as they are ([Directive (EU) 2022/2555](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022L2555)). ## The main changes The table sums up the changes in Article 1 of the proposal and its [annex](https://data.consilium.europa.eu/doc/document/ST-5627-2026-ADD-1/en/pdf), with the NIS 2 articles they touch. | Change | Article of the proposal | Who it affects | | --- | --- | --- | | New small mid-cap category: Annex I entities are essential only if they exceed the small mid-cap ceilings | Art. 1, points 2 and 4 (NIS 2 Arts. 3 and 6) | Companies in Annex I sectors that are not SMEs but stay below 750 employees and the financial ceilings | | Electricity producers with a total generation capacity up to 1 MW excluded | Annex, point 1(a) | Small electricity producers | | Micro and small DNS service providers excluded | Art. 1, points 1 and 2 (NIS 2 Arts. 2 and 3) | DNS service providers; top-level domain name registries stay in scope regardless of size | | Providers of European Digital Identity Wallets and European Business Wallets essential regardless of size | Art. 1, points 1 and 2; Annex, point 1(e) | Digital wallet providers | | Operators of submarine data transmission infrastructure and strategic dual-use infrastructure brought into scope | Art. 1, points 1, 2 and 4; Annex, point 1(e) | Operators of submarine cables, landing stations and related infrastructure; infrastructure identified under a military mobility regulation still under negotiation | | Entries redefined for hydrogen, intelligent transport systems, healthcare providers and chemicals | Annex, points 1 and 2 | Companies in these sectors, which would need to recheck their classification | | Harmonised data on ransomware attacks | Art. 1, point 8 (new Art. 23(12) and (13)) | Essential and important entities hit by ransomware | | Certificate on the cyber posture | Art. 1, point 9 (new Art. 24(4), (5) and (6)) | Essential and important entities, once a European scheme exists | | Maximum harmonisation for implementing acts on security measures | Art. 1, points 3 and 7 (Arts. 5 and 21(5)) | Entities covered by a Commission implementing act | | ENISA registry of all essential and important entities; changes notified within two weeks | Art. 1, points 2 and 11 (Arts. 3(4) and 27) | All entities | | ENISA support for mutual assistance between authorities on cross-border entities | Art. 1, point 12 (new Art. 37a) | Entities operating in more than one Member State | | Jurisdiction rules for air carriers and for entities not established in the EU | Art. 1, point 10 (Art. 26) | Airlines; non-EU providers, which designate a representative in the Union | | Migration to post-quantum cryptography in national strategies | Art. 1, point 5 (Art. 7(2)) | Member States | ### Ransomware: what would be reported When the Commission adopts the implementing act on the content of notifications, it would have to require three items: whether the entity detected a ransomware attack, the attack vector and whether mitigation measures were implemented. For a significant incident caused by ransomware, the entity would also state, but only at the request of the CSIRT or the competent authority, whether it received a ransom demand and from whom, whether it paid, the amount, the means of payment and the recipient, including the crypto-asset and the crypto-asset service provider ([COM(2026) 13, new Article 23(12) and (13)](https://data.consilium.europa.eu/doc/document/ST-5627-2026-INIT/en/pdf)). The proposal does not ban ransom payments. Under recital 11, reporting this information should not by itself result in additional obligations under the directive. ### Certification: a future tool, not an exemption Member States could require entities to obtain a certificate on their cyber posture under a European scheme adopted under the Cybersecurity Act 2. Where the certificate demonstrates compliance with the requirements of the measures, the authority would not subject the entity to additional security audits on those requirements (NIS 2 Articles 32(2)(b) and 33(2)(b)). Responsibility for complying with the directive stays with the entity. No such scheme has been adopted yet: certification could become a way to demonstrate compliance once a European scheme is available. Already now, an ISO/IEC 27001 certificate is not a presumption of NIS 2 compliance, as we explain in our [NIS 2 and ISO 27001 guide](https://www.aegister.com/en/cms/insights/nis2-vs-iso-27001-mapping-gaps/). ### Security measures and suppliers Where the Commission adopts implementing acts on the technical, methodological or sectoral requirements of the measures, Member States could not impose further requirements on the entities those acts cover. For other Italian entities the measures remain those set by ACN, today the [NIS 2 baseline measures](https://www.aegister.com/en/cms/insights/nis2-basic-measures-acn/), while ACN has opened a consultation on the [reinforced security measures](https://www.aegister.com/en/cms/insights/nis-reinforced-security-measures-acn-consultation/). For companies that supply NIS entities, the explanatory memorandum announces Commission guidelines on the security information entities request from their suppliers. The stated aim is to cut down heterogeneous, repeated questionnaires and to prevent NIS 2 obligations from being passed on unduly to companies outside the scope (recital 9). ## Small mid-caps: who could move from essential to important Today Annex I entities, the sectors of high criticality such as energy, transport, health and digital infrastructure, are essential when they exceed the ceilings for medium-sized enterprises set by [Recommendation 2003/361/EC](https://eur-lex.europa.eu/eli/reco/2003/361/oj): 250 employees, or EUR 50 million turnover and EUR 43 million balance sheet total ([D.Lgs. 138/2024, Art. 6](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2024-09-04;138~art6)). The proposal moves the threshold: Annex I entities would be essential when they exceed the small mid-cap ceilings. [Recommendation (EU) 2025/1099](https://eur-lex.europa.eu/eli/reco/2025/1099/oj) defines a small mid-cap as an enterprise that is not an SME, employs fewer than 750 persons and has an annual turnover not exceeding EUR 150 million or an annual balance sheet total not exceeding EUR 129 million. Under recital 2 of the proposal, these companies would as a main rule be important entities. An Annex I operator with 400 employees and EUR 120 million turnover, essential today, would therefore as a rule become important. The difference matters. An important entity is supervised only ex post, when the authority has evidence suggesting an infringement, and the maximum fines are lower (D.Lgs. 138/2024, [Art. 36](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2024-09-04;138~art36) and [Art. 38](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2024-09-04;138~art38)). The ACN measures differ too: Annex 1 applies to important entities, Annex 2 to essential ones. The differences are set out in our guide to [essential and important entities](https://www.aegister.com/en/cms/insights/nis2-essential-vs-important-entities-baseline-differences/). Three limits apply: - no one leaves NIS 2 because of this category: a small mid-cap already exceeds the medium-sized ceilings and stays in scope, as an important entity; - the other routes by which an entity is essential regardless of size remain, such as identification as a critical entity or designation by the authority, which in Italy are set out in Article 6 of D.Lgs. 138/2024; - Annex II entities are already, as a rule, important and would not be affected by this change. ## Incident reporting: a single entry point (Digital Omnibus) The single entry point is not in COM(2026) 13 but in the [Digital Omnibus, COM(2025) 837](https://data.consilium.europa.eu/doc/document/ST-15698-2025-INIT/en/pdf) of 19 November 2025, which would add an Article 23a to NIS 2. ENISA would develop and maintain one entry point for the notifications required by NIS 2 and, with the same report, those required by the GDPR, DORA, the eIDAS Regulation and the CER Directive, on a "report once, share many" principle. The entry point could build on the Cyber Resilience Act single reporting platform and would be used only after a pilot and an assessment by the Commission. The Commission writes that the proposal leaves unchanged the underlying legal requirements for incident reporting: recipients and deadlines stay as they are, and for Italian entities notifications still go to CSIRT Italia. The single entry point is proposed by the Commission; in the Council, national entry points are also being discussed. For the procedure in force today, see our guide to [NIS 2 Article 25 incident notification](https://www.aegister.com/en/cms/insights/nis2-article-25-incident-notification/). ## Where the procedure stands (as of 8 October 2026) - **European Parliament.** The committee responsible is ITRE, with rapporteur Markéta Gregorová, appointed on 26 February 2026; the IMCO committee gives an opinion. The draft report is dated 24 September 2026 and the procedure is "awaiting committee decision" ([European Parliament Legislative Observatory](https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2026/0012(COD))). Among national parliaments, the Italian Chamber of Deputies sent a contribution on 12 May 2026. - **Council.** The Presidency's progress report of 22 May 2026 announced that the examination of the NIS 2 simplification measures would start at the end of May and that the Irish Presidency would continue the work ([progress report 9399/26](https://data.consilium.europa.eu/doc/document/ST-9399-2026-INIT/en/pdf)). The Council has not adopted a general approach. - **Negotiations.** Trilogues between Parliament, Council and Commission have not started, and the text can still change. Adoption is not expected before the end of 2026; transposition will then have 12 months from the entry into force of the amending directive ([COM(2026) 13, Art. 2](https://data.consilium.europa.eu/doc/document/ST-5627-2026-INIT/en/pdf)). In Italy the changes would arrive through an amendment to D.Lgs. 138/2024. ## What does not change today for Italian entities Until the amendments are adopted and transposed, D.Lgs. 138/2024 and the ACN determinations remain in force. In practice: - registration on the ACN platform from 1 January to 28 February, the additional data from 15 April to 31 May and notice of any change within fourteen days ([D.Lgs. 138/2024, Art. 7](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2024-09-04;138~art7)); the EU proposal sets similar rules, with a two-week deadline; - the classification as an essential or important entity communicated by ACN, on today's thresholds: the small mid-cap category does not apply until it is transposed; - the baseline measures, within the deadline set for your cohort; - notification of significant incidents to CSIRT Italia: pre-notification (early warning) within 24 hours, incident notification within 72 hours and a final report within one month of the notification ([D.Lgs. 138/2024, Art. 25](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2024-09-04;138~art25)); - the accountability of management bodies and the penalties set by the decree. The rules to follow are today's: if you want to check where your company stands against D.Lgs. 138/2024 and the ACN measures, we support you through [NIS 2 compliance](https://www.aegister.com/en/solutions/compliance/nis2/). This article was reviewed with AI tools for proofreading and error checking. Despite these checks it may contain inaccuracies: for compliance decisions, always refer to the official texts. Self-assessment · NIST CSF 2.0 · ISO 27001 ### Cyber Check-up A self-assessment that returns your company's cyber profile: its security posture and the recommendations to mitigate risks and start your cybersecurity journey. [Start the Cyber Check-up](https://www.aegister.com/en/assessment/) Our service ### NIS 2 We guide you to compliance with the NIS 2 Directive: requirements analysis, security measures, incident notification and documentation audit. [Learn more](https://www.aegister.com/en/solutions/compliance/nis2/) Share this post: Self-assessment ### Cyber Check-up Answer the questionnaire and get your company's cyber profile: security posture and recommendations to mitigate risks. [Start the Cyber Check-up](https://www.aegister.com/en/assessment/) ### NIS 2 We guide you to compliance with the NIS 2 Directive: requirements analysis, security measures, incident notification and documentation audit. [Learn more](https://www.aegister.com/en/solutions/compliance/nis2/) ## Related news February 05, 2026 ### [EU Cybersecurity Act Revision - COM(2026) 11: What Changes and Why It Matters](https://www.aegister.com/en/cms/insights/eu-cybersecurity-act-revision-2026/) The European Commission's January 2026 proposal to revise the EU Cybersecurity Act: supply-chain risk governance, simplified certification (ECCF), EN… [NIS 2](https://www.aegister.com/en/cms/keyword/nis-2/) [Supply chain](https://www.aegister.com/en/cms/keyword/supply-chain/) [ISO 27001](https://www.aegister.com/en/cms/keyword/iso-27001/) +10 January 31, 2026 ### [Cybersecurity Monthly Report - January 2026 (Italy, EU, Global)](https://www.aegister.com/en/cms/insights/cybersecurity-monthly-report-january-2026/) Aegister’s January 2026 monthly cybersecurity report: EU cybersecurity package with Cybersecurity Act revision and NIS 2 simplification amendments, D… [NIS 2](https://www.aegister.com/en/cms/keyword/nis-2/) [Incident notification](https://www.aegister.com/en/cms/keyword/incident-notification/) [Governance](https://www.aegister.com/en/cms/keyword/governance/) +19 October 10, 2026 ### [ACN supervision under NIS 2: inspections, orders and fines](https://www.aegister.com/en/cms/insights/acn-nis2-supervision-inspections-penalties/) For entities placed on the NIS list in April 2025, ACN gives October 2026 as the deadline for the baseline measures. How ACN supervises after that: m… [NIS 2](https://www.aegister.com/en/cms/keyword/nis-2/) [NIS 2 baseline measures](https://www.aegister.com/en/cms/keyword/nis-2-baseline-measures/) [ACN](https://www.aegister.com/en/cms/keyword/acn/) +7