The EU's NIS2 compliance deadline — October 17, 2024 — has come and gone, but the compliance work it triggered hasn't. Most member states have now transposed the directive into national law, registration windows have opened and closed, and 2026 is widely described as the year supervisory authorities move from guidance to active enforcement. Yet only 16% of businesses in scope say they're confident they're fully compliant. If your organization is still treating NIS2 as a deadline you either hit or missed, this guide walks through where enforcement actually stands in 2026, what's changed since the original rollout, and how to close the gap — including where a compliance audit fits into getting there.
The short version: NIS2's transposition deadline passed in October 2024, but national implementation has rolled out unevenly since — Germany's registration window closed July 31, 2026, the Netherlands enters full enforcement mid-2026, and Spain and France are still finalizing their national rules. The European Commission proposed further amendments to the directive in January 2026, and the adjacent Cyber Resilience Act adds its own reporting obligations starting September 11, 2026. NIS2 isn't a deadline you missed or made — it's an ongoing compliance posture regulators are now actively checking.
Where NIS2 Stands in 2026: From Deadline to Enforcement
NIS2 (the updated Network and Information Security Directive) was due to be transposed into the national law of all 27 EU member states by October 17, 2024. That date marked a legal deadline for governments to pass implementing legislation — not a single EU-wide date on which every covered business suddenly became compliant. In practice, transposition and enforcement have rolled out unevenly ever since:
Member state / groupStatus as of 2026Most of the EU (~22–24 of 27 states)Transposed into national law, with implementing legislation and competent authorities in placeGermanyAmended BSI Act in force since December 6, 2025; registration deadline extended once to July 31, 2026 — now closed. Late registration still carries its own fine of up to €500,000, separate from substantive-violation finesNetherlandsLaw enacted, with a staggered entry into full enforcement around mid-2026SpainStill in active legislative process; remains under the older NIS1-based Royal Decree 43/2021 regime pending completion, expected late 2026FranceTransposition act adopted; implementing decrees still being finalized
Adding to the moving target: the European Commission proposed targeted amendments to NIS2 in January 2026 as part of a broader EU cybersecurity package. The proposal would adjust the directive's scope — bringing submarine data-cable infrastructure operators in, taking chemical distributors out (manufacturers stay in scope), adding a requirement to disclose whether a ransom was demanded and paid after a significant ransomware incident, and expanding which companies must appoint an EU representative. None of this is finalized, but it underlines the point: NIS2 compliance in 2026 means tracking a directive that's still being tuned, not checking a box against a document that hasn't changed since 2024. Germany's BSI, for instance, publishes its own running guidance on which organizations must register under the national implementation — worth checking directly if you operate there, since the detail changes as the rules get finalized.
Whatever stage your country is at, the underlying obligation hasn't changed — businesses in scope need their digital infrastructure and data management practices to be secure, resilient, and adaptable to evolving threats, backed by evidence a regulator can actually review. For the official legal text, see Directive (EU) 2022/2555 on EUR-Lex.
Why NIS2 Still Matters for European Businesses
The case for NIS2 was never really about the October 2024 date — it's about the threat environment the directive was built to address, which has kept getting worse, not better. According to ENISA's Threat Landscape 2025 report, which analyzed 4,875 incidents across the EU between July 2024 and June 2025, public administration was the single most targeted sector at 38% of incidents, ransomware activity fragmented across 82 distinct variants rather than concentrating on a few dominant groups, and AI-enabled phishing made up more than 80% of observed social-engineering activity by early 2025.
That 16% figure comes from a survey of 670 business leaders across the UK, Poland, the Netherlands, Ireland, France, Germany, Denmark, and Belgium — and 11% of respondents said they were still unsure whether NIS2 even applied to their organization. That's the real 2026 story: not a deadline that already happened, but a compliance gap most businesses in scope still haven't closed, right as supervisory authorities shift from advisory guidance to active audits.
Which Industries Fall Under NIS2
NIS2 significantly broadened the sectoral scope of the original 2016 directive. Businesses now fall into one of two categories — "essential" or "important" entities — spanning sectors including energy, transport, banking, financial market infrastructure, health, drinking water and wastewater, digital infrastructure, ICT service management, public administration, and space, alongside a second tier covering postal and courier services, waste management, chemicals, food, manufacturing, and digital providers. Size thresholds generally apply (roughly 50+ employees or €10M+ turnover for important entities, 250+ employees or €50M+ turnover for essential entities), though certain critical providers are in scope regardless of size.
The practical effect for many businesses is indirect: NIS2 doesn't always name your industry outright, but if you provide hosting, cloud, data-center, or CDN services to a company that is named — or if you're a supplier deep in an essential entity's chain — NIS2 obligations can reach you through that relationship even when you're not separately listed.
NIS2 Fines and Penalties in 2026
The headline fine ceilings set by the directive haven't changed:
Entity typeMaximum fineOther consequencesEssential entitiesUp to €10 million or 2% of global annual turnover, whichever is higherPersonal liability can extend to management for serious non-complianceImportant entitiesUp to €7 million or 1.4% of global annual turnover, whichever is higherSame personal-liability exposure for managementLate registration (example: Germany)Up to €500,000A separate, standalone penalty — distinct from substantive control failures
What's changed is the enforcement posture around those numbers. Member states can set fine ceilings above the directive's floor — Germany does — so multi-country operators should check local caps rather than assuming the EU minimums are the actual worst case. And 2026 is the year several national authorities, including Germany's BSI, have moved from publishing guidance to actively auditing in-scope organizations. No wave of major published fines has landed as of this writing, but the shift from a grace period to active oversight is itself the headline: the deadline for having a compliance program was 2024; the deadline for having a defensible one is now.
NIS2, DORA, and the Cyber Resilience Act: Which Regime Applies
NIS2 no longer sits alone. Two adjacent EU regulations now overlap with it for a growing number of businesses, and 2026 is the year all three become operationally real at once:
RegulationWho it coversKey 2026 developmentNIS2Essential and important entities across critical sectors (energy, health, digital infrastructure, and more)National registration deadlines closing through 2026; supervisory authorities shifting to active enforcementDORAFinancial entities and their critical ICT third partiesFirst real supervisory enforcement cycle underway; Register of Information filings were due March 31, 2026, with incomplete third-party registers flagged as an enforcement priorityCyber Resilience Act (CRA)Manufacturers of products with digital elements sold in the EUVulnerability and incident reporting obligations take effect September 11, 2026 — over a year ahead of the CRA's full application in December 2027
The CRA's new reporting clock is tight: manufacturers must submit an early warning within 24 hours of becoming aware of an actively exploited vulnerability or severe incident, a detailed notification within 72 hours, and a final report once corrective measures are available. For businesses already carrying NIS2 and, in some cases, DORA third-party risk obligations, the practical challenge is that these regimes currently run on parallel reporting tracks with no single consolidated channel — which makes incident-response process design, not just underlying security controls, a genuine 2026 compliance problem in its own right.
How to Prepare for NIS2 Compliance
Whether your organization missed the original 2024 window entirely or has been working toward compliance since, the practical steps in 2026 look like this — or start with a structured self-assessment using our free NIS2 Compliance Checklist:
Confirm your registration status. If your country's national registration deadline has passed and you haven't registered with the competent authority, register now — late registration is typically treated more leniently than continued non-registration, but it isn't free (see Germany's €500,000 late-registration fine above).
Run a current risk assessment against NIS2's actual control requirements — not the 2024 version of your infrastructure, but what's running today.
Build or update your incident-reporting process to handle NIS2's notification timelines alongside any DORA or CRA obligations that apply to the same business, rather than maintaining separate, uncoordinated processes for each.
Review third-party and sub-processor relationships, particularly hosting, cloud, and data-center providers, since NIS2 obligations can reach your organization through those relationships even when you're not separately named in scope.
Get an independent technical read on where you actually stand — a compliance audit verifies the infrastructure behind your evidence, not just whether a policy document exists.
A few mistakes show up repeatedly in NIS2 readiness work:
Assuming the October 2024 deadline means the work is done. Transposition is a legal starting gun, not a finish line — enforcement is still ramping up in 2026.
Treating NIS2, DORA, and the CRA as separate projects when a business is in scope of more than one — the underlying security-control evidence overlaps significantly, and building one coordinated program is far more efficient than three parallel ones.
Skipping the registration step because the underlying security work feels more urgent — registration is a distinct, time-bound legal obligation with its own penalty, separate from your actual control maturity.
Not accounting for the moving target. With the Commission's January 2026 amendment proposal still working through the legislative process, scope and reporting requirements may shift again before the current cycle settles.
Organizations without an in-house compliance function often route this work through a managed partner rather than building it internally — see our guide to Compliance as a Service for MSPs for how that model works. Teams that want a more ISO 27001-aligned path into NIS2 readiness can also see our NIS2 compliance solution overview.
Choosing an EU Cloud Provider for NIS2 Compliance
Many businesses are consolidating data operations within the EU specifically to simplify NIS2 compliance and reduce their reliance on sub-processors outside Europe — fewer cross-border data flows to document, fewer third-party relationships to monitor, and a shorter chain between your infrastructure and the regulator's actual jurisdiction. When evaluating a provider against NIS2 requirements, prioritize transparent data-processing locations, minimal reliance on further sub-processors, a demonstrable compliance track record, and clear contractual commitments to EU-based data handling. For a deeper look at what that evaluation actually involves, see our guide to choosing an EU cloud provider.
Also, Gart Solutions, together with our partner — vBoxx, a renowned EU cloud solutions provider, offers a range of managed hosting and cloud server services that can significantly support businesses in their digital transformation journey.
1. Understanding the NIS2 Directive
The NIS2 Directive represents a significant evolution in EU cybersecurity regulation, broadening the scope of compliance requirements to include a wider array of sectors. This directive underscores the necessity of not only securing data but also understanding its entire journey.
Organizations must be vigilant about tracking their data flow to mitigate risks and meet the stringent new standards imposed by NIS2.
2. Comprehensive Data Tracking
Compliance with NIS2 requires an in-depth understanding of where and how data is processed, stored, and transferred. This involves documentation of every stage of the data lifecycle — from creation and processing to storage and eventual deletion. By mapping out the data journey, organizations can better identify vulnerabilities and ensure that all parties involved in data handling adhere to high security standards.
3. The Challenge of Sub-processors
One of the most complex challenges introduced by NIS2 is the need for organizations to maintain visibility over all sub-processors involved in data processing. Each sub-processor, regardless of their role, must meet the same rigorous cybersecurity standards. This requires thorough vetting and ongoing monitoring to ensure compliance, making it critical for businesses to establish strong relationships and clear communication channels with their sub-processors.
4. Strategic Shifts in the Market
In response to NIS2, many businesses are re-evaluating their reliance on third-party sub-processors, especially those located outside the EU. By consolidating data operations within the EU, organizations can better manage compliance and reduce the risk of data breaches.
This trend towards localized data handling is reshaping the market, as companies seek to simplify their data ecosystems and enhance security.
5. Practical Steps for Compliance
To align with NIS2, businesses must take proactive measures, such as engaging closely with their service providers, conducting comprehensive risk assessments, and considering a shift to EU-based data centers and services. These steps not only facilitate compliance but also strengthen the overall cybersecurity posture, ensuring that the organization is well-prepared to meet current and future regulatory demands.
How Not to Repeat Mistakes: Case of Microsoft
If you say, we are using public data providers, there’s still are pitfalls we have to consider.
Let’s take, for example, Microsoft. Microsoft's products continue to be widely used, but they present significant challenges in transparency and data security.
At the time of writing, Microsoft lists 47 subprocessors and 36 data centers, but details on their operations and data handling are unclear. This is concerning given Microsoft's ongoing GDPR violations and multiple security breaches last year.
Moreover, the global spread of subprocessors, often linked to parent companies in various countries, adds complexity and potential security risks, making it difficult for companies to verify compliance and data safety.
Final words
Prepare your business for the NIS2 compliance update with the expert guidance of Gart Solutions. Download our Free Checklist — a comprehensive guide to the NIS2 audit, and ensure your organization is ready for the upcoming changes.
NIS2-Compliance-Checklist-A-Comprehensive-Guide-to-Audit_Free-PDFDownload
Wanna know how? Contact us.
Schedule a Free Consultation
See how we can help to overcome the challenges of NIS2 compliance.
Contact us
You might also like
GDPR Compliance Checklist: What Compliance Automation Can (and Can't) Do
Why ISO 27001 Is a Crucial Step for Successful Companies
Compliance Monitoring: Ensuring Businesses Stay on the Right Side
SOC 2 Compliance: A Step-by-Step Guide to Preparing for Your Audit
PCI DSS Audit Preparation: A Step-by-Step Compliance Guide
Every enterprise running Microsoft 365 eventually asks the same question: do we keep certifying access with spreadsheets and email chains, or do we finally turn on Entra ID governance access reviews? The honest answer is more specific than "automate everything." Most organizations are already paying for a meaningful chunk of Entra ID Governance inside licenses they hold today — they just haven't switched it on. This breakdown puts real numbers next to both paths: the labor hours and error rates behind manual access reviews, what Entra ID's P1/P2/Governance tiers actually cost and include, and where the effort genuinely goes when you move from one to the other. If you're building the business case for your own rollout, Gart's security audit team runs this exact cost/effort analysis before recommending a licensing change, not after.
The comparison below isn't manual reviews versus a shiny new product. For most Microsoft 365 E5 customers, it's manual reviews versus activating identity governance access reviews already sitting inside a license line they're already paying for — and only reaching for the standalone Entra ID Governance add-on once that owned capability runs out of road.
Why Access Reviews Are Suddenly a Boardroom Topic
Access reviews used to be a quarterly checkbox for the identity team. They aren't anymore. Every excess entitlement sitting on an account is a reachable attack path, and the numbers behind that risk have gotten hard to ignore: IBM's Cost of a Data Breach Report 2025 found that malicious-insider incidents — the category most directly tied to over-permissioned or stale accounts — carry the highest average cost of any breach type, at $4.92 million per incident, well above the $4.44 million global average. When a credential is compromised, attackers don't need to be sophisticated; they need the account to still have access it should have lost months earlier.
At the same time, the compliance side of the equation has gotten stricter. SOX, GLBA, ISO 27001, and — for organizations in scope — NIS2 all expect documented, recurring evidence that access to sensitive systems is actively recertified, not just granted once and forgotten. A pile of approved spreadsheets from last quarter doesn't hold up well under audit scrutiny if nobody can explain why a given approval was granted.
⚠️ The real question isn't "manual or automated"For Microsoft-centric enterprises, it's usually "manual, or the identity governance capability you're already paying for inside Microsoft 365 E5." That distinction changes the entire cost conversation, and it's the one most vendor comparisons skip.
What Entra ID Governance Access Reviews Actually Do
Microsoft defines access reviews as a way to efficiently manage group memberships, access to enterprise applications, and privileged role assignments on a recurring basis, so that only the people who still need access keep it — see Microsoft's official access reviews overview for the full feature reference. In practice, that means a named reviewer — a manager, a resource owner, or the requester themselves — periodically confirms or revokes continued access to a specific group, application, or privileged role, with the decision, timestamp, and justification captured automatically as audit evidence.
Entra ID governance access reviews sit at the intersection of three Microsoft Entra licensing tiers, and which capabilities you get depends entirely on which tier a given user is licensed under. P1 handles conditional access, self-service password reset, and hybrid identity, with no access review capability on its own. P2 is the tier that actually matters for this comparison — it adds risk-based identity protection, Privileged Identity Management (PIM), and access reviews on groups, enterprise applications, and privileged roles. Entra ID Governance is a separate paid layer on top of P2 that adds entitlement management (access packages, approval workflows), automated lifecycle workflows for joiners/movers/leavers, and AI-assisted recommendations that flag stale or anomalous access during a review.
That licensing structure is the whole story of why a straight "manual vs. Entra ID Governance" comparison is misleading for most enterprises — the middle tier, P2, already includes real access review capability, and a lot of organizations own it without using it. More on that below.
The Real Cost of Manual Access Reviews
"Manual" access reviews usually means a spreadsheet or CSV export sent to dozens of managers, each expected to look through a flat list of usernames and entitlements with no context on login frequency, role peers, or how the access was originally granted. Under deadline pressure, the natural response is to approve everything — the rubber-stamp review that satisfies an audit checkbox without actually reducing risk.
Industry benchmark data from identity governance vendor BalkanID's analysis of enterprise access review deployments puts real numbers on that gap, modeled on a representative 10,000-user, 200-application organization running a quarterly review cycle:
MetricManual review cycleAutomated review cycleCompletion time4-8 weeks per cycle3-5 daysTotal effort1,200-1,800 FTE hoursUnder 200 FTE hoursReviewer effort per 100 users~12 hours~1 hourHuman error rate8-12% mis-classified or incompleteUnder 2%Audit exceptions per cycle2-30-1, with full traceabilityAnnual review cost$150K-$250K$30K-$50KRevocation time after a "reject" decision5-10 daysUnder 24 hoursThe Real Cost of Manual Access Reviews
The completion-rate gap matters as much as the labor cost. Where automated, evidence-backed reviews routinely reach 98% genuine completion, manual processes tend to cap out around 60% real completion — the rest is technically "done" in the sense that a manager clicked approve, without anyone actually verifying the access was still needed.
What Entra ID Governance Costs — And the Licensing Trap Most Enterprises Fall Into
Here's where the cost/effort math gets more interesting than a simple per-seat price tag. Entra ID P1 ships inside Microsoft 365 E3 and Business Premium; Entra ID P2 — the tier that includes access reviews, PIM, and risk-based protection — ships inside Microsoft 365 E5. Entra ID Governance is priced as a separate standalone add-on layered on top of P2, adding entitlement management and lifecycle automation that P2 alone doesn't cover.
That structure creates a specific, well-documented overspend pattern. Independent licensing analysis from Redress Compliance's Entra ID Pricing Buyer Guide, based on roughly 25-35 Microsoft identity licensing engagements reviewed in 2024-2025, found three recurring patterns:
Double payment. Standalone Entra P1 or P2 seats overlapped with entitlements already included in E3 or E5 on 15-25% of reviewed users — organizations were paying twice for identity capability their existing suite already granted.
Unused capability. P2 capabilities such as access reviews and Privileged Identity Management sat switched off on 40-60% of E5 estates that already owned them — the single largest finding in the engagement.
Governance bought too early. In roughly a third of cases, organizations purchased the standalone Entra ID Governance add-on while the P2 access reviews and PIM controls that ship inside their existing E5 license were never even activated.
The practical takeaway: before treating Entra ID Governance as a new purchase, most Microsoft-centric enterprises should confirm whether they're already licensed for P2 through E5 — and if so, whether access reviews are actually turned on. For many organizations, the highest-leverage first move costs nothing beyond configuration time: activate the group, application, and privileged-role access reviews already included in the license, prove the coverage gap that remains, and only then scope Governance for the specific entitlement-management or lifecycle-automation capability P2 genuinely doesn't provide.
Cost/Effort Comparison: Manual vs. Unused P2 vs. Activated P2 vs. Governance
Put the labor-hour data and the licensing reality side by side, and the decision looks less like "buy software" and more like a four-stage maturity path most enterprises should walk in order:
StageNew license costWhere the effort goesWhat you get1. Manual reviewsNone — but 1,200-1,800 FTE hours/cycleReviewer time, chasing approvals, compiling audit evidence by hand~60% real completion; 20-25% of high-risk entitlements missed2. P2 owned, unusedNone — already inside your E5 licenseZero — this is the risk state most E5 estates are actually inNothing; you're paying for a control that isn't running3. P2 activatedNone beyond existing E5Configuration: defining review scope, cadence, reviewers, recommendationsAccess reviews on groups, apps & privileged roles; automated audit trail4. Entra ID GovernanceStandalone add-on, scoped to needDeploying entitlement management, access packages, lifecycle workflowsSelf-service access requests, joiner/mover/leaver automation, AI recommendationsCost/Effort Comparison: Manual vs. Unused P2 vs. Activated P2 vs. Governance
Notice that the biggest jump in outcome — from a rubber-stamp manual cycle to a defensible, evidence-backed review — happens between Stage 1 and Stage 3, and Stage 3 doesn't require a new purchase for most E5 organizations. Stage 4 is a real and often justified investment, but it solves a different problem: self-service entitlement requests and lifecycle automation, not the base act of reviewing who has access to what.
Where the Risk Hides: What Manual Reviews Miss
A flat list of usernames and permissions gives a reviewer no context on whether access is still justified. Without that context, the same categories of risky access slip through review after review:
Dormant accounts with no login activity in 90+ days that still hold live entitlements.
Privilege creep — users who changed roles internally but kept access tied to their previous position, the exact failure mode Gart's least-privilege access model playbook is built to prevent.
Orphaned service accounts with no clear HR or business owner to confirm they're still needed.
Toxic access combinations, such as a single account holding both "create" and "approve" permissions in a financial system.
None of these show up cleanly in a spreadsheet — see Gart's step-by-step breakdown of how to run a user access review without spreadsheets for the process that catches them. They show up in identity governance tooling that correlates login telemetry, role peers, and ownership lineage — exactly the context P2 access reviews and Governance's AI-assisted recommendations are built to surface automatically instead of leaving it to a manager's memory.
🔍 An access review is only as good as its evidenceA completed review that can't show why an approval was made — no login history, no peer comparison, no justification — provides audit comfort without actually reducing risk. Gart's infrastructure audit engagements routinely find this gap: reviews that are technically "done" but functionally unverifiable.
A Phased Rollout From Manual Reviews to Entra ID Governance
The lowest-risk path from spreadsheets to a mature Entra ID governance access reviews program doesn't require a big-bang re-platform. It looks more like this:
Inventory what you already own. Cross-reference standalone Entra seats against E3/E5 entitlements to confirm you're not double-paying, and identify exactly which users are licensed for P2.
Activate P2 access reviews on the highest-risk scope first. Start with privileged roles (via PIM) and access to your most sensitive applications, not the entire directory at once.
Define reviewers and cadence deliberately. Resource owners, not IT generically, should review access to the resources they actually understand — quarterly is the right default cadence for anything compliance-sensitive, though see why quarterly access reviews commonly fail and how to fix it before assuming cadence alone solves the completion-rate problem.
Feed in identity telemetry from a properly configured Entra ID tenant so reviewers see login frequency and role context, not just a name and a permission.
Scope Governance only against the gap P2 doesn't cover — typically self-service access requests and joiner/mover/leaver automation — once the activated P2 reviews prove where that gap actually is.
This is also where integrating access governance into CI/CD and infrastructure-as-code pipelines pays off for engineering-heavy organizations: access reviews shouldn't stop at directory groups when service accounts and pipeline credentials often carry more standing privilege than any individual employee.
When Manual Reviews Still Make Sense
Automation isn't the right call for every organization on day one. Manual, spreadsheet-based reviews remain reasonable when the organization is small enough — well under a few hundred identities — that the 1,200-1,800 hour benchmark above doesn't apply at meaningful scale, when there's no Microsoft 365 E5 or standalone P2 licensing in place yet and the immediate need is a one-time compliance evidence gap rather than an ongoing program, or when access sprawl is genuinely limited: few applications, few privileged roles, low employee turnover.
Even then, the moment audit findings start citing SOX, ISO 27001, or NIS2-adjacent obligations — see Gart's breakdown of why ISO 27001 certification matters for growing companies and how NIS2 compliance obligations reach organizations through their infrastructure and hosting relationships — the completion-rate and evidence gaps in manual reviews become a documented finding, not just an internal inefficiency.
Identity Governance & Access Review Strategy
Not sure whether you're already paying for the access reviews you need?
Gart Solutions runs a licensing and access-review audit before recommending a single new purchase — mapping what your Microsoft 365 E3/E5 estate already includes, activating owned P2 controls, and scoping Entra ID Governance only for the specific gap it needs to fill.
Security Audit
Infrastructure Audit
Compliance Audit (SOX, ISO 27001, NIS2)
DevSecOps Consulting
IT Infrastructure Consulting
Cybersecurity Monitoring
Talk to an identity governance specialist
Explore our IT audit services →
You might also like
IT Infrastructure Components: The Complete Guide for Modern Enterprises
Compliance Audit Services
ISO 27001 vs SOC 2: Which Access Controls Do You Actually Need?
Infrastructure Audit: Process, Examples, Cost & ROI
Strengthen Your Information Security With a NIS2 Compliance Solution
Roman Burdiuzha
Co-founder & CTO, Gart Solutions · Cloud Architecture Expert
Roman has 15+ years of experience in DevOps and cloud architecture, with prior leadership roles at SoftServe and lifecell Ukraine. He co-founded Gart Solutions, where he leads cloud transformation and infrastructure modernization engagements across Europe and North America. In one recent client engagement, Gart reduced infrastructure waste by 38% through consolidating idle resources and introducing usage-aware automation. Read more on Startup Weekly.
If you run or host an online casino, sportsbook, or iGaming platform serving European players, two EU laws now define whether your infrastructure is legally defensible: the GDPR and the NIS2 Directive. They are not optional add-ons to a licensing checklist. GDPR and NIS2 compliance for casino hosting means your data centre, cloud provider, and application architecture all have to satisfy data protection law and cybersecurity risk-management law at the same time — and the two frameworks don't always pull in the same direction.
Most operators discover this the hard way: a GDPR data-retention policy that says "delete what you don't need" collides with a NIS2 logging requirement that says "keep evidence for forensics." This guide breaks down exactly where GDPR and NIS2 apply to casino hosting, who is actually in scope (the operator, the hosting provider, or both), what technical controls satisfy both regulators, and how Gart's compliance and infrastructure engineering practice helps gaming platforms get audit-ready without slowing down releases.
Why GDPR and NIS2 Both Govern Casino Hosting
Online casino and sportsbook platforms sit at the intersection of two regulatory concerns that European lawmakers deliberately separated into two directives: protecting the personal data of individuals (GDPR) and protecting the network and information systems that critical digital services depend on (NIS2). A casino platform processes both — KYC documents, payment details, gameplay and betting history, and responsible-gambling behavioural data — on infrastructure that, by its nature as always-on, real-money, high-availability digital infrastructure, looks a lot like the kind of service NIS2 was written to protect.
The practical result is that a casino hosting stack is rarely evaluated against just one framework. Regulators, payment processors, and licensing bodies increasingly expect operators to demonstrate both data protection compliance and cybersecurity risk management maturity, and to be able to prove it with evidence, not policy documents.
🎯 The key distinction operators missGDPR protects people — it applies the moment you process the personal data of anyone in the EU, regardless of your size or sector. NIS2 protects infrastructure — it applies based on your sector, size, and role in the digital supply chain. A small casino operator might not trigger NIS2 directly, but the cloud provider, data centre, or content delivery network hosting that casino almost certainly does, because cloud computing, data centre, and CDN services are named explicitly in NIS2 Annex I as "digital infrastructure."
Does NIS2 Apply to Online Casinos? Scope for Operators and Hosting Providers
The NIS2 Directive (EU) 2022/2555 does not list "gambling" or "gaming" as one of its named sectors in Annex I or Annex II. That leads a lot of operators to conclude, incorrectly, that NIS2 doesn't concern them. In practice, casino and iGaming businesses are pulled into scope through two separate paths.
Path 1: The casino operator as a digital service provider
If your platform functions as an online marketplace, offers social or community features, or otherwise resembles the "digital provider" categories in NIS2 Annex II, you may be classified as an important entity in your own right, subject to the size thresholds (roughly 50+ employees or €10M+ turnover for medium enterprises, 250+ employees or €50M+ turnover for large ones).
Path 2: Your hosting provider as critical digital infrastructure
This is the path that matters for almost every casino platform, regardless of size. NIS2 Annex I explicitly names cloud computing service providers, data centre service providers, and content delivery network providers as "digital infrastructure" — a highly critical sector subject to the strictest obligations. If your casino platform runs on a qualifying EU cloud or data centre provider, that provider is contractually and legally obligated to run NIS2-grade risk management, incident reporting, and supply-chain security — and those obligations flow down to you through the hosting agreement, whether or not your own company is separately in scope.
Several EU member states have already transposed NIS2 into national law with gambling-specific relevance. Italy's Legislative Decree No. 138/2024 (effective 18 October 2024) expanded cybersecurity obligations with a structured registration and compliance timeline. Malta — home to a large share of EU-licensed gambling operators — enacted Legal Notice 71 of 2025, replacing its previous NIS1 regime with self-registration through the Critical Infrastructure Protection Department and a dedicated national CSIRT. As DLA Piper's analysis of NIS2 and gambling puts it, gambling operators and their suppliers "must promptly assess their eligibility under the Directive" rather than assume the absence of an explicit sector listing means the absence of obligations.
📋 What this means in practiceBefore you can answer "are we NIS2 compliant," you need a scoping exercise across three questions:
(1) does our own platform meet an Annex II digital-provider definition,(2) is our hosting/cloud/CDN provider an Annex I essential entity, and (3) does our national gambling regulator layer additional cybersecurity conditions onto our licence, independent of NIS2 itself. Gart's infrastructure assessment is typically where this scoping starts.
GDPR Requirements for Casino and iGaming Platforms
Unlike NIS2, there's no ambiguity about GDPR's applicability: if your platform processes the personal data of anyone in the EU — players, affiliates, employees — GDPR applies, regardless of where your company or servers are based. For casino hosting specifically, four requirements come up repeatedly in regulatory guidance and enforcement actions.
A Data Protection Officer is effectively mandatory
Gambling operators typically carry out large-scale, systematic monitoring of individuals (fraud detection, responsible-gambling monitoring, behavioural profiling) and process special-category data for anti-money-laundering purposes. Both conditions independently trigger the GDPR Article 37 requirement to appoint a Data Protection Officer.
DPIAs for profiling and AML/CFT processing
Two categories of processing that are core to how casino platforms operate require a Data Protection Impact Assessment as a matter of course: systems that identify excessive or at-risk gambling behaviour, and systems that support anti-money-laundering and counter-terrorist-financing (AML/CFT) checks. Both involve profiling with potentially significant effects on the individual — precisely the trigger GDPR Article 35 is built around.
Consent, cookies, and marketing
GDPR Article 7 requires that consent for gambling marketing — emails, SMS, targeted advertising, retargeting pixels — be freely given, specific, informed, and as easy to withdraw as it was to give. Cookie consent banners that pre-tick marketing categories, or that make declining harder to find than accepting, are a recurring enforcement target across EU data protection authorities.
Data residency and international transfers
Many casino platforms run analytics, fraud-scoring, or customer-support tooling on US-based SaaS vendors. Since the invalidation of Privacy Shield (Schrems II), transfers of EU player data to the US require Standard Contractual Clauses plus a documented transfer impact assessment — not just a checkbox in a vendor's terms of service. This is one of the more concrete reasons operators are re-evaluating EU-based hosting and digital sovereignty rather than defaulting to US hyperscalers.
France's gambling regulator (ANJ) and data protection authority (CNIL) jointly published a 59-page GDPR compliance guide for licensed gambling operators in May 2026, addressing exactly this intersection of licensing obligations and data protection law — a strong signal that regulators are converging on sector-specific GDPR guidance rather than leaving operators to interpret general-purpose text.
Where GDPR and NIS2 Overlap — and Where They Pull Apart
The two frameworks reinforce each other on security fundamentals — encryption, access control, incident response — but they diverge sharply on data retention, and that divergence is exactly where casino hosting architectures get into trouble.
DimensionGDPR positionNIS2 positionData retentionStorage limitation principle — keep personal data only as long as necessary for the stated purposeEncourages retaining logs, audit trails, and forensic evidence long enough to detect and investigate incidentsPrimary objectiveProtect the rights and freedoms of individuals whose data is processedProtect the availability, integrity, and confidentiality of network and information systemsWho it applies toAny controller/processor handling EU personal data, regardless of sectorEntities in named sectors (Annex I/II) above size thresholds — including hosting/cloud/CDN providersBreach/incident reporting72 hours to the supervisory authority; affected individuals notified if high risk24-hour early warning, 72-hour detailed report, final report within one month to the national CSIRTGovernanceData Protection Officer oversight; accountability principle (Article 5(2))Management-body approval and oversight of cybersecurity measures; personal liability for gross negligenceWhere GDPR and NIS2 Overlap — and Where They Pull Apart
The practical fix is architectural, not political: separate personal data from security telemetry at the schema level. Audit logs, IDS/IPS alerts, and access logs used for NIS2 incident forensics should be pseudonymised and retained under a security-specific retention schedule, distinct from the player-data retention schedule your GDPR Record of Processing Activities defines. Trying to run one retention policy for both purposes is the single most common source of audit friction Gart sees in iGaming infrastructure reviews.
Choosing GDPR- and NIS2-Ready Hosting Infrastructure
Where you host a casino platform is no longer a pure cost-and-latency decision — it's a compliance decision with legal consequences. Three factors determine whether a hosting environment actually helps you meet GDPR and NIS2 obligations, or quietly works against you.
EU data residency and sub-processor transparency
Hosting player data on EU soil, with an EU-based cloud provider that publishes a complete, current sub-processor list, removes an entire category of GDPR international-transfer risk. Operators are increasingly comparing providers like Hetzner and IONOS specifically on data-sovereignty grounds — see Gart's Hetzner vs. IONOS comparison for how these EU-native providers differ on compliance-relevant criteria like data centre location, certification scope, and contractual DPAs.
Provider-level NIS2 posture
Ask any hosting or cloud provider directly: are you classified as an essential entity under NIS2 in your jurisdiction of establishment, and can you share your incident-reporting SLAs and supply-chain security attestations? A provider that can't answer this clearly is a supply-chain risk you're inheriting without visibility into it — and NIS2 explicitly makes supply-chain security a first-class obligation for entities in scope.
Architecture that supports both regimes at once
Network segmentation that isolates wallet, KYC, and payment services from public-facing game clients serves GDPR's data-minimization-by-design principle and NIS2's risk-management requirements simultaneously — a single architectural decision satisfying two regulators. Gart's DevOps practices for iGaming, casinos, and sports betting platforms cover this kind of compliance-aware Kubernetes and network design in more depth.
Technical Controls That Satisfy Both Regulations
Rather than building two parallel compliance programs, most of the technical work overlaps. The table below maps common infrastructure controls to the specific GDPR and NIS2 obligations they help satisfy.
ControlSatisfies GDPR by...Satisfies NIS2 by...Encryption at rest and in transitMeeting Article 32 "appropriate technical measures" for security of processingMeeting the baseline cryptography requirement under Article 21 risk-management measuresRole-based access control (RBAC)Enforcing data minimization and the "need to know" principle for staff access to player dataSupporting access-control policy requirements under Article 21(2)(i)Immutable audit loggingDemonstrating accountability (Article 5(2)) — who accessed what data, whenProviding the forensic evidence trail required for incident investigation and reportingNetwork segmentation / Kubernetes NetworkPolicyReducing the blast radius of a breach involving payment or KYC dataLimiting lateral movement — a named risk-management measure under Article 21Vulnerability management & patching cadencePreventing the kind of unpatched-system breach that triggers Article 33 notificationMeeting the explicit vulnerability-handling requirement in Article 21(2)(e)Vendor / sub-processor due diligenceSatisfying Article 28 processor obligations and transfer impact assessmentsMeeting the supply-chain security requirement in Article 21(2)(d)Automated compliance-as-code (OPA/Gatekeeper)Preventing configuration drift that could expose personal data by accidentProviding continuous evidence of risk-management measures for auditsTechnical Controls That Satisfy Both Regulations
Incident Response and Breach Notification Timelines
One of the most common operational failures Gart sees during compliance reviews isn't a missing control it's a missing playbook that tells the on-call engineer which clock is ticking. GDPR and NIS2 run on different notification timelines, to different authorities, and a casino platform breach can trigger both at once.
MilestoneGDPR (Article 33/34)NIS2 (Article 23)Who you notifyNational data protection supervisory authority; affected individuals if high riskNational CSIRT or competent cybersecurity authorityFirst notificationWithout undue delay, within 72 hours of becoming awareEarly warning within 24 hours of becoming awareDetailed reportIncluded in the initial 72-hour notification (nature, scope, likely consequences)Incident notification within 72 hours, updating the initial assessmentFinal reportNot separately mandated, but documentation must be maintained under Article 33(5)Final report within one month of the incident notificationTrigger thresholdA breach likely to result in a risk to individuals' rights and freedomsAn incident with a "significant impact" on service provisionIncident Response and Breach Notification Timelines
Building one incident response runbook that maps a single security event to both timelines — rather than maintaining separate GDPR and NIS2 procedures that different teams own — is the difference between a controlled disclosure and a missed deadline discovered during an audit.
Penalties, Enforcement, and Personal Liability
The financial exposure under both regimes is large enough to change board-level risk appetite, and neither framework limits itself to fining the company.
GDPR: up to €20 million or 4% of total worldwide annual turnover for the most serious infringements — unlawful processing, breach of data subject rights, or unauthorized international transfers — whichever amount is higher.
NIS2 essential entities (including in-scope cloud, data centre, and CDN providers): up to €10 million or 2% of global annual turnover, whichever is higher.
NIS2 important entities: up to €7 million or 1.4% of global annual turnover, whichever is higher, with fines doubling for a repeat offence within three years.
NIS2 also introduces something GDPR enforcement rarely reaches for in practice: personal liability. Article 32(6) empowers national authorities to hold management bodies accountable for gross negligence, including administrative fines against individual executives and, for essential entities, temporary bans from management functions. Combined with the ENISA guidance on NIS2 implementation, this makes cybersecurity governance a board-level obligation, not a delegated IT function — a shift that gambling operators, with their traditionally licensing-focused compliance functions, are still adjusting to.
⚖️ Licence risk compounds financial riskFor a casino platform, a GDPR or NIS2 enforcement action rarely stays contained to the fine itself. Regulators such as the Malta Gaming Authority can treat a data protection or cybersecurity failure as evidence of inadequate operational controls under the gaming licence itself — turning a compliance fine into a licence review.
Compliance Checklist for Casino Hosting
AreaActionPriorityScopingDetermine whether your platform and/or your hosting provider fall under NIS2 Annex I or II🔴 CriticalGDPR governanceAppoint a DPO and complete DPIAs for problem-gambling detection and AML/CFT profiling🔴 CriticalHostingConfirm EU data residency and request your provider's NIS2 classification and sub-processor list🔴 CriticalIncident responseBuild one runbook covering both the GDPR 72-hour and NIS2 24/72-hour/1-month timelines🔴 CriticalArchitectureSegment wallet, KYC, and payment services from public-facing game clients🟠 HighData lifecycleSeparate personal-data retention schedules from security-log retention schedules🟠 HighConsent managementAudit cookie banners and marketing consent flows for pre-ticked boxes or dark patterns🟠 HighSupply chainExtend NIS2 supply-chain security assessments to payment, KYC, and analytics vendors🟡 MediumGovernanceBrief the management body on NIS2 personal-liability exposure and require sign-off on the risk register🟡 MediumCompliance Checklist for Casino Hosting
Case Study: Regulatory-Ready Infrastructure for a Sportsbook Platform
One of Gart's iGaming engagements involved migrating a US-facing sportsbook to AWS while meeting state-by-state data residency rules — a compliance problem with the same shape as GDPR/NIS2 data-residency requirements in the EU. The team designed a multi-region architecture with jurisdiction-specific VPCs and data controls enforced through Service Control Policies, paired with an Infrastructure-as-Code approach covering 100% of production resources, so every environment change was auditable by design rather than by afterthought.
Results: deployment time dropped from 4 hours to 22 minutes, feature delivery sped up by 60%, and the platform improved performance by 30–40% — all while making regulatory infrastructure reviews a matter of pulling Terraform state and Git history, not reconstructing what changed from memory.
Read the full case study: AWS Migration & Infrastructure Localization for Sportsbook Platform
Compliance-Ready Infrastructure for iGaming
Need casino hosting that passes a GDPR and NIS2 audit — not just a licensing check?
Gart designs and operates infrastructure for casino, sportsbook, and iGaming platforms with data protection and cybersecurity risk management built in from the architecture up — EU data residency, segmented environments, immutable audit trails, and incident-response runbooks that satisfy both regulators.
NIS2 Compliance & Gap Assessment
GDPR-Ready Infrastructure Design
EU Data Residency & Sovereign Cloud
DevSecOps & Compliance-as-Code
IT Infrastructure Assessment
Incident Response & Monitoring
iGaming & Casino DevOps
Talk to a compliance specialist
Explore our NIS2 compliance services →
You might also like
Strengthen Your Information Security with NIS2 Compliance Solutions
Digital Sovereignty of Europe: Choosing the EU Cloud Provider
DevOps Practices in iGaming, Casinos, and Sports Betting Companies
What Is DevSecOps? Integrating Security into Your DevOps Pipeline
Free NIS2 Compliance Checklist (PDF Guide)
Roman Burdiuzha
Co-founder & CTO, Gart Solutions · Cloud Architecture Expert
Roman has 15+ years of experience in DevOps and cloud architecture, with prior leadership roles at SoftServe and lifecell Ukraine. He co-founded Gart Solutions, where he leads cloud transformation and infrastructure modernization engagements across Europe and North America. In one recent client engagement, Gart reduced infrastructure waste by 38% through consolidating idle resources and introducing usage-aware automation. Read more on Startup Weekly.
