NIS2 readiness for European healthtech

No. Applicability depends on the sector, the type of services provided, size thresholds and each Member State’s implementation of the directive. Some healthtech companies fall directly within scope, while others are affected primarily through customer or supply-chain obligations rather than as regulated entities themselves.

They can be. Manufacturers of medical devices and in vitro diagnostic devices fall within the manufacturing categories used by NIS2, and certain critical medical devices receive additional treatment. Final classification follows the applicable national law and the entity’s activities, size and jurisdiction.

Essential entities are usually larger organisations in sectors of high criticality, plus specifically designated entities, and are subject to more proactive supervision and higher maximum fines. Important entities are commonly medium-sized organisations in high-criticality sectors or qualifying organisations in other critical sectors, supervised largely after evidence of non-compliance or an incident. Both must meet the core risk-management and reporting duties.

Yes. NIS2 uses size thresholds as a general rule, but Member States and the directive itself allow specific designations regardless of size, including for entities whose services are systemically important, sole providers or otherwise critical. A small company should not assume it is out of scope without checking national criteria.

Not automatically. Being a supplier to a hospital does not by itself make a software vendor a NIS2 entity. However, hospitals and other regulated customers must apply supply-chain security requirements, so vendors are commonly asked to demonstrate proportionate cybersecurity practices even when they are not directly regulated themselves.

No. ISO 27001 provides reusable security governance and evidence that supports NIS2 preparation, but it does not automatically establish NIS2 compliance. National authorities supervise NIS2 obligations under the applicable national law, including specific requirements on incident reporting, management responsibility and registration that are not part of an ISO 27001 audit.

For significant incidents, an early warning is required within 24 hours of awareness, an incident notification within 72 hours, intermediate information on request during the response and a final report within one month. Reporting uses the applicable national authority or CSIRT channel, and contractual notification deadlines may be shorter.

Management bodies must approve and oversee the cybersecurity risk-management measures and are expected to receive sufficient training to understand the organisation’s cyber risks and their consequences. Responsibility for NIS2 obligations cannot be outsourced to a security provider.

The Netherlands implements NIS2 through the Cyberbeveiligingswet, which enters into force on 15 August 2026 and uses the NCSC and sectoral authorities. Germany’s NIS2 implementation legislation entered into force on 6 December 2025, with in-scope companies using the BSI Portal for registration and incident reporting. Entity categories, authorities, terminology and procedures follow each national law.

No. There is no EU-wide NIS2 certificate or certification-body audit. National authorities supervise compliance under their implementing legislation. NIS2 readiness is an operational programme, not a legal assurance or certification.

A common EU-level control baseline can be reused across establishments, but each legal entity, jurisdiction and applicable national law must be assessed separately for registration, entity categorisation, reporting channels and supervision. Group governance should coordinate consistent controls while respecting national variations.

A scoped NIS2 readiness engagement is €6,900 when reusing an existing Asteron Compliance Core and €9,900 as a first Asteron engagement. Prices cover one legal entity, one principal jurisdiction and one agreed service scope, and exclude VAT where applicable. Multi-entity, multi-country or unusually complex environments are scoped separately.