In today’s interconnected digital landscape, where information flows seamlessly across international borders, the need for robust cybersecurity measures has never been more pronounced.  

Recognising the critical importance of a united front against cyber threats, European policymakers have taken a significant leap forward with the introduction of two new pieces of legislation designed to protect the digital infrastructure of member states. 

The European Parliament has approved two new pieces of legislation – the Network and Information Security Directive 2 (NIS2) and the Digital Operational Resilience Act (DORA). Since 18 October 2024, European Union (EU) member states have been required to transpose NIS2 into national law, while DORA will come into force from 17 January 2025.  

The UK’s departure from the EU in 2020 means that these new pieces of EU legislation will not apply in themselves to organisations operating services solely within the UK, but will apply to UK and other organisations that operate essential services inside the EU.   

The UK government has signalled its intention to build on the foundations through a new Cyber Security and Resilience Bill, which aims to “strengthen our defences and ensure that more essential digital services than ever before are protected”.  

The new UK legislation, while containing some key differences to the new EU laws, will expand the remit of regulation to protect more digital services and supply chains than existing UK cyber regulations. So it seems likely that, as it has with its own version of EU GDPR (General Data Protection Regulations), the UK government will adopt the principles of NIS2 in future and may even adopt NIS2 itself.