The deadline passed almost two years ago. NIS2, the EU’s updated cybersecurity directive, had to be written into national law across the Union by 17 October 2024. Most member states have done so, and four that have not are now in court over it. If your organization runs essential services, or is a significant player in one of the covered sectors, the question is no longer whether the rules apply; it is whether you can show a regulator that your access controls meet them. And for the first time, that question lands on the management board, not only on the IT department.
Authentication is named in the law now, not just in the guidance
Earlier good-practice frameworks recommended multi-factor authentication. NIS2 goes further. Its baseline risk-management measures (Article 21) require organizations to put in place technical controls including access-control policies, cryptography, and — spelled out directly — the use of multi-factor authentication or continuous authentication solutions where appropriate.
In practice, a weak or optional second factor is no longer a defensible position. If an auditor asks how a privileged administrator signs in to your VPN, your Windows servers or your management console, “a password and sometimes an SMS code” is the answer that opens a finding.
What changed in 2026
Two things changed this year, and neither of them softens the authentication requirement.
- Four member states are in court. On 8 July 2026 the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for not having notified full transposition, after formal notices in November 2024 and reasoned opinions in May 2025 (Commission press release). Where national law is late, the obligations have been delayed, not removed.
- An amendment has been proposed. On 20 January 2026 the Commission proposed amending NIS2 to simplify it and align it with the Cybersecurity Act (COM(2026) 13). It simplifies jurisdiction rules, narrows a few sector definitions, adds detail to ransomware incident reporting, and creates a “small mid-cap” category: organizations with fewer than 750 employees and under €150 million in turnover, treated as important entities and supervised only after the fact. It is still a proposal and has not been adopted. The security measures in Article 21, multi-factor authentication included, are not among the things it sets out to change.
For authentication, then, the practical message is unchanged: if you are in scope, MFA on the access paths that matter is a legal duty today, and the proposed amendment does not set out to change that.
Who this applies to
NIS2 divides organizations into essential and important entities across a wide set of sectors: energy, transport, banking and financial market infrastructure, healthcare, drinking and waste water, digital infrastructure, public administration and more, with a second tier that pulls in postal services, waste management, manufacturing, food, chemicals and digital providers. Many organizations that sat outside the original NIS Directive are now firmly inside its successor.
As a rule of thumb, an organization in one of those sectors is in scope once it reaches medium size: 50 or more employees, or more than €10 million in annual turnover. Some types of entity are in scope regardless of size. The exact lines are drawn by each country’s national law.
Two changes push this past a compliance checkbox:
- Management accountability. Boards must approve and oversee cybersecurity risk-management measures, and can be held personally liable for failures.
- Real penalties. For breaches of the risk-management or reporting duties, national law must set a maximum fine of at least €10 million or 2% of global annual turnover, whichever is higher, for essential entities. For important entities the figures are €7 million or 1.4%. Countries may set the ceiling higher.
What “NIS2-grade” authentication actually looks like
Having some MFA is not the same as meeting the intent of the directive. Three things separate a control that satisfies an auditor from one that only looks good on a slide:
- Resistance to phishing and relay. SMS codes can be intercepted or SIM-swapped, and both they and one-tap push can be relayed in real time by an adversary-in-the-middle page. A key bound to hardware inside the user’s device, one that cannot be copied or replayed, removes interception and SIM swaps. Relay is harder: only site-bound methods such as FIDO security keys stop it outright, while an approval that shows where the request came from makes it visible to a user who looks. Push-fatigue is a separate problem, and no key or biometric stops it once the prompt reaches the phone. It is beaten only by what the prompt shows: a precise, readable description of exactly what is being approved, so nothing is ever approved blindly.
- Coverage of privileged and remote access. The requirement is not “MFA on the webmail.” It is every path an attacker would actually use: VPN, remote desktop, server logins, admin consoles.
- Evidence. NIS2 is as much about demonstrating control as having it. Each authentication should leave an auditable, tamper-evident record of who approved what, and when.
Where Notakey fits
Notakey is built for exactly this profile of organization: regulated, security-conscious, and answerable to auditors.
- The user’s key is generated inside the phone’s secure hardware and never leaves it. There is no shared secret to steal and no code to intercept.
- Every login and every transaction is a cryptographically signed, timestamped event: the audit trail a NIS2 assessment asks for, produced automatically instead of reconstructed after the fact.
- It covers the access paths that matter, over the protocols your systems already speak. See the practical guides for 2FA on a VPN over RADIUS, Windows remote desktop and Linux SSH.
- It runs in your own infrastructure or in the cloud, so authentication data can stay under your control, with PSD2, eIDAS and GDPR alignment built in rather than bolted on.
We are deliberately not going to tell you Notakey “makes you NIS2 compliant”; no product does that on its own. What it does is close the authentication-shaped part of the gap, and hand you the evidence to prove it.
Start with a pilot, not a policy document
The fastest way to find out whether your authentication meets NIS2 is to test it against your own environment: a real VPN, a real admin login, a handful of real users. That tells you more about your gap — and your evidence — in a week than a feature matrix tells you in a quarter.
Try the live demo to sign a transaction from your own phone in about two minutes, or request a demo and we will map your VPN, SSO or Windows access to a working pilot.
This article is general information, not legal advice. NIS2 is transposed into national law separately by each EU member state; confirm the specific obligations, thresholds and deadlines that apply to your organization with qualified counsel.