--- title: "NIS2 for UK Companies: Are You in Scope?" description: How the EU NIS2 directive reaches UK companies through customers, supply chains and EU operations, what the obligations are, and how to get ahead. image: https://www.cybercontrols.io/hubfs/blog-nis2-uk.jpg --- [Skip to content](https://www.cybercontrols.io/blog/nis2-for-uk-companies-you-are-not-in-the-eu-but-you-may-be-in-scope#main-content) [![Cybercontrols.io logo](https://www.cybercontrols.io/hs-fs/hubfs/cybercontrols-logo-white-bg-800.jpg?width=800&height=178&name=cybercontrols-logo-white-bg-800.jpg)Homepage](https://cybercontrols.io) - [Products](https://www.cybercontrols.io/blog/nis2-for-uk-companies-you-are-not-in-the-eu-but-you-may-be-in-scope#products) - [Services](https://www.cybercontrols.io/blog/nis2-for-uk-companies-you-are-not-in-the-eu-but-you-may-be-in-scope#services) - [Blog](https://www.cybercontrols.io/blog/nis2-for-uk-companies-you-are-not-in-the-eu-but-you-may-be-in-scope#blog) - [About](https://www.cybercontrols.io/blog/nis2-for-uk-companies-you-are-not-in-the-eu-but-you-may-be-in-scope#about) Get started - [Products](https://www.cybercontrols.io/blog/nis2-for-uk-companies-you-are-not-in-the-eu-but-you-may-be-in-scope#products) - [Services](https://www.cybercontrols.io/blog/nis2-for-uk-companies-you-are-not-in-the-eu-but-you-may-be-in-scope#services) - [Blog](https://www.cybercontrols.io/blog/nis2-for-uk-companies-you-are-not-in-the-eu-but-you-may-be-in-scope#blog) - [About](https://www.cybercontrols.io/blog/nis2-for-uk-companies-you-are-not-in-the-eu-but-you-may-be-in-scope#about) Get started ![Data centre racks and network cabling, blue duotone](https://www.cybercontrols.io/hs-fs/hubfs/blog-nis2-uk.jpg?width=1200&height=630&name=blog-nis2-uk.jpg) # NIS2 for UK Companies: You Are Not in the EU, but You May Be in Scope ![Marius van Aswegen](https://www.cybercontrols.io/hs-fs/hubfs/marius-van-aswegen.jpg?width=48&height=48&name=marius-van-aswegen.jpg) Marius van Aswegen September 13, 2026 [NIS2](https://www.cybercontrols.io/it-compliance/nis2) is an EU directive, and the UK is not in the EU, so a surprising number of UK boards have filed it under somebody else's problem. For many companies that is correct. For a significant minority, it is expensively wrong. Here is how the directive actually reaches UK businesses, and what to do about it. ## What NIS2 is NIS2 is the EU's updated network and information security directive. It widens the original NIS rules to many more sectors, including manufacturing, digital providers, food, waste and postal services alongside the classic energy, transport, health, water and digital infrastructure sectors, and it hardens the obligations: risk management measures, incident reporting on tight timescales, supply chain security, and personal accountability for management bodies, backed by substantial fines. Each EU member state transposes it into national law, so the detail varies by country, but the shape is consistent. ## Three ways it reaches a UK company - **You operate in the EU.** If you provide in-scope services within a member state, through a subsidiary, branch or direct offering, you can be regulated there directly, whatever your headquarters address says. Digital providers offering services into the EU can also be caught and may need an EU representative. - **Your customers are in scope.** This is the most common route. NIS2 makes regulated entities responsible for the security of their supply chains, so EU customers are pushing NIS2-shaped requirements into contracts and vendor assessments. You will not receive a letter from a regulator; you will receive a security questionnaire from your biggest client, and the commercial consequence of failing it is the same. - **Your group is in scope.** UK subsidiaries of EU parents, and vice versa, frequently inherit group-wide NIS2 programmes and reporting lines. ## What the obligations look like in practice Strip away the directive language and NIS2 asks for things a well-run security programme already does: risk analysis and security policies, incident handling with rapid reporting, business continuity and crisis management, supply chain security, secure development and vulnerability handling, testing of your measures, cryptography and access control, and training for management, who are personally accountable for oversight. If that list sounds familiar, it should: it maps closely onto [ISO 27001](https://www.cybercontrols.io/it-compliance/iso-27001-certification) with business continuity depth behind it. ## The sensible UK response First, establish scope honestly: an afternoon's structured analysis of your EU footprint, sectors and customer base settles whether NIS2 is a direct obligation, a contractual one, or genuinely not your problem. Second, if it reaches you by either route, resist the temptation to build a bespoke NIS2 programme. Implement or extend an ISO 27001 management system, with incident response and continuity given real weight, and map its controls to the NIS2 measures and to each customer questionnaire once. One system, evidenced many ways, is the difference between compliance as a project and compliance as a permanent tax. And a word on the home front: the UK is pursuing its own strengthening of cyber legislation for essential services, so the direction of travel is the same on both sides of the Channel. Work done now is not wasted either way. Cybercontrols helps UK companies scope NIS2 exposure and build the management system that answers it, alongside ISO 27001, [DORA](https://www.cybercontrols.io/it-compliance/dora-resilience) and the rest of the alphabet. A free 30-minute scoping call will tell you which side of the line you sit on. Not sure whether NIS2 reaches you? [Book a free scoping call](https://www.cybercontrols.io/contact) and we will map your exposure. ## Share this post [mailto:https%3A%2F%2Fwww.cybercontrols.io%2Fblog%2Fnis2-for-uk-companies-you-are-not-in-the-eu-but-you-may-be-in-scope](mailto:https%3A%2F%2Fwww.cybercontrols.io%2Fblog%2Fnis2-for-uk-companies-you-are-not-in-the-eu-but-you-may-be-in-scope) ## Keep reading ### [![Tony's auditor quote of the day: A nonconformity isn't a failure. It's free advice with a deadline. What Clause 10.2 asks of you: react and correct, find the real cause, act so it cannot recur, review and record. Cybercontrols.io](https://www.cybercontrols.io/hs-fs/hubfs/Cybercontrols%20blog%20-%20Nonconformity%20-%20header%201600x800.png?width=1600&height=800&name=Cybercontrols%20blog%20-%20Nonconformity%20-%20header%201600x800.png) A Nonconformity Isn't a Failure: How to Handle ISO Audit Findings Well](https://www.cybercontrols.io/blog/a-nonconformity-isnt-a-failure-how-to-handle-iso-audit-findings-well) ### [![Where do your people's health records actually live? Four things UK GDPR and ISO 27701 expect: a lawful basis and an Article 9 condition, an appropriate policy document, need-to-know access, and retention you actually apply.](https://www.cybercontrols.io/hs-fs/hubfs/Cybercontrols%20blog%20-%20Employee%20health%20data%20-%20header%201600x800.png?width=1600&height=800&name=Cybercontrols%20blog%20-%20Employee%20health%20data%20-%20header%201600x800.png) Employee Health Data and UK GDPR: Where Do Your People's Health Records Actually Live?](https://www.cybercontrols.io/blog/employee-health-data-and-uk-gdpr-where-do-your-peoples-health-records-actually-live) [![Cybercontrols.io logo](https://www.cybercontrols.io/hs-fs/hubfs/cybercontrols-logo-white-bg-800.jpg?width=800&height=178&name=cybercontrols-logo-white-bg-800.jpg "Cybercontrols.io logo")](https://cybercontrols.io) - [Products](https://www.cybercontrols.io/blog/nis2-for-uk-companies-you-are-not-in-the-eu-but-you-may-be-in-scope#products) - [Services](https://www.cybercontrols.io/blog/nis2-for-uk-companies-you-are-not-in-the-eu-but-you-may-be-in-scope#services) - [Blog](https://www.cybercontrols.io/blog/nis2-for-uk-companies-you-are-not-in-the-eu-but-you-may-be-in-scope#blog) - [About](https://www.cybercontrols.io/blog/nis2-for-uk-companies-you-are-not-in-the-eu-but-you-may-be-in-scope#about) --- Privacy Policy · Legal · © 2026 CyberControls. All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Marius van Aswegen", "url" : "https://www.cybercontrols.io/blog/author/marius-van-aswegen" }, "dateModified" : "2026-09-14T06:17:35.249Z", "datePublished" : "2026-09-13T23:05:21.000Z", "headline" : "NIS2 for UK Companies: Are You in Scope?", "image" : [ "https://www.cybercontrols.io/hubfs/blog-nis2-uk.jpg" ], "mainEntityOfPage" : { "@id" : "https://www.cybercontrols.io/blog/nis2-for-uk-companies-you-are-not-in-the-eu-but-you-may-be-in-scope", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.cybercontrols.io/hubfs/cybercontrols-logo-white-bg-800.jpg" }, "name" : "CyberControls" } } ```