Logo: to the web site of Uppsala University

The revised NIS 2 Directive, which came into force in January 2023, is part of the EU’s broader initiative to enhance cybersecurity and digital resilience across member states. The directive expands the responsibilities of organizations, requiring not only internal security controls but also oversight of their supply chains. For small and medium-sized enterprises (SMEs), these demands present significant organizational and economic challenges.

This study investigates the specific impact of NIS 2 on SMEs operating in the EU. The study is based on a qualitative literature review following a Systematic Literature Review (SLR) approach. Key themes include supply chain risk management, incident reporting obligations, scope interpretation, and the evolving role of organizational leadership in cybersecurity compliance.

The findings indicate that SMEs frequently lack the technical infrastructure and administrative capacity to fully comply with NIS 2 requirements. Difficulties include verifying supplier security, managing tight incident reporting deadlines, and assessing whether their operations fall under the directive. Furthermore, compliance is shown to be not merely a technical process, but an institutional and cultural practice shaped by norms, legitimacy, and stakeholder expectations.

The study recommends the development of tailored tools such as sector-specific guidelines, simplified contracts, and maturity assessments to support SMEs. It also calls for further research on the intersection of NIS 2 and the EU’s AI Act—particularly how automated decision-support tools can be lawfully and effectively integrated into cybersecurity reporting and supplier evaluation.

In conclusion, the NIS 2 Directive acts as a systemic reform of cybersecurity governance in Europe. While it poses major challenges for SMEs, it also offers an opportunity to professionalize security practices—provided that proportional and practical support mechanisms are put in place.