If you run IT or security at a manufacturing company in Romania, Poland or Czech Republic, NIS2 is no longer a future problem. It is a present one. Romania transposed the directive via GEO 155/2024, in force since 31 December 2024 and confirmed by Law 124/2025. Poland's amended National Cybersecurity System Act entered into force on 3 April 2026. The Czech Republic's new Cybersecurity Act (No. 264/2025 Coll.) has applied since 1 November 2025, supervised by NÚKIB.

Enforcement is active. Regulators are beginning to assess compliance. And yet most mid-sized manufacturers we speak to have not completed a formal gap assessment, and many are not even sure whether they fall in scope.

This guide answers the most common questions we receive and gives you a practical starting point.

"The three most common NIS2 gaps we find at manufacturers are: no formal asset inventory, no documented incident response procedure, and no supplier security questionnaire process. All three are fixable in under 90 days with the right support."

Does Your Manufacturing Company Fall Under NIS2?

NIS2 applies to companies in certain sectors that meet a size threshold. For manufacturing, the directive covers companies including:

  • Manufacture of medical devices and in vitro diagnostic medical devices
  • Manufacture of computers and electronic products
  • Manufacture of machinery and equipment
  • Manufacture of motor vehicles and parts
  • Chemical and pharmaceutical manufacturing
  • Food processing at scale

The size threshold is: 50+ employees OR more than €10M annual turnover. Manufacturers in these sectors that meet it are classified as Important Entities, whatever their size above the threshold. National laws can add stricter cases, so check the rules in your country.

What NIS2 Requires: The 5 Core Obligations

1. Risk Management and Security Policies

You must have a documented cybersecurity risk management framework. This includes an asset inventory, a risk register, and written security policies covering at minimum: access control, encryption, network security, and physical security of IT systems.

2. Incident Reporting

Under Romania's GEO 155/2024 and equivalent laws, significant incidents must be reported to DNSC (Romania), the competent CSIRT (Poland) or NÚKIB (Czech Republic). An early warning is due within 24 hours of becoming aware, an incident notification within 72 hours and a final report within one month. Most manufacturers do not have a documented procedure for deciding what counts as a "significant incident". This is one of the first things to fix.

3. Business Continuity and Disaster Recovery

NIS2 requires documented business continuity plans covering your critical IT and OT systems. This includes backup procedures, recovery time objectives (RTOs), and regular testing of recovery procedures.

4. Supply Chain Security

This is the obligation that catches most manufacturers off guard. NIS2 requires you to assess and manage the cybersecurity risks of your suppliers and service providers, including cloud services, industrial software vendors, and logistics platforms. You need a process for evaluating new suppliers and reviewing existing ones.

5. Access Control and Privileged Access Management

NIS2 lists multi-factor authentication among the required measures. In practice that means MFA on all remote access and administrative accounts. User access must be reviewed regularly and limited to what each role requires.

NIS2 by Country: Where Things Stand

🇷🇴 Romania

Romania transposed NIS2 via GEO 155/2024, which entered into force on 31 December 2024 and was confirmed by Law 124/2025 in July 2025. In-scope companies must register with DNSC and meet the full range of obligations. Enforcement is active. Fines reach up to €10 million or 2% of global turnover for essential entities, and €7 million or 1.4% for important entities.

🇵🇱 Poland

Poland's amended National Cybersecurity System Act (KSC), signed in February 2026, entered into force on 3 April 2026. In-scope entities had to apply for registration by 3 October 2026. Administrative fines only apply after a two-year buffer, but the security obligations apply now. Polish manufacturers with OT environments should prioritise IT/OT segmentation first.

🇨🇿 Czech Republic

The Czech Republic implemented NIS2 through a new Cybersecurity Act (No. 264/2025 Coll.), in force since 1 November 2025 and supervised by NÚKIB. Automotive Tier 1 and 2 suppliers face additional pressure: OEM customers are beginning to require NIS2 compliance as a procurement condition.

OT Security: The Manufacturing-Specific Challenge

Unlike financial services or retail, manufacturers often run Operational Technology (OT) environments, production control systems, SCADA, PLCs, that were never designed with cybersecurity in mind. NIS2 requires these systems to be assessed and protected alongside traditional IT infrastructure.

A pragmatic NIS2 approach for manufacturers focuses on network segmentation (isolating OT from IT), anomaly monitoring, and compensating controls rather than forcing patches onto legacy industrial systems.

Where to Start: A Practical 4-Step Approach

  1. Confirm you are in scope: review your sector, headcount, and turnover against NIS2 thresholds in your country.
  2. Complete a gap assessment: compare your current security posture against NIS2 requirements to get a prioritised remediation roadmap.
  3. Fix the highest-risk gaps first: incident reporting procedures, asset inventory, and MFA on remote access can typically be implemented within 30 days.
  4. Document everything: NIS2 enforcement is evidence-based. Regulators ask to see documentation. Start building your compliance file from day one.