Since 12 August 2026, the new EU Packaging and Packaging Waste Regulation, known as the PPWR, has generally applied across the European Union. Its first immediately visible requirement is highly concrete: food-contact packaging may no longer be placed on the EU market if it reaches or exceeds certain PFAS concentration limits.

For many companies, packaging regulation may initially sound like an environmental, product or procurement issue. In reality, however, the PPWR is a classic GRC topic. It affects product design, supplier management, material data, technical documentation, conformity evidence, ESG strategy, audit readiness and market access. Any company selling packaged products in the EU will increasingly need to know not only which packaging is used, but also whether it can prove that this packaging meets the new requirements.

Key Takeaways

The PPWR entered into force on 11 February 2025 and has generally applied since 12 August 2026. It covers packaging and packaging waste regardless of material or origin and sets requirements for manufacturing, composition, reusability, recoverability and waste management.

The most urgent requirement concerns PFAS restrictions for food-contact packaging. Since 12 August 2026, such packaging may no longer be placed on the EU market if it reaches or exceeds 25 ppb for individual PFAS, 250 ppb for the sum of certain PFAS, or 50 ppm for total PFAS.

There is no general stock-depletion grace period for already manufactured food-contact packaging containing PFAS. Packaging that was placed on the market before 12 August 2026 may remain on the market. Packaging placed on the market after that date must comply with the limits.

For GRC leaders, this means that packaging compliance must become manageable across suppliers, materials, products, documentation, controls and evidence.

Why the PPWR Is More Than Environmental Regulation

The PPWR aims to reduce packaging waste, strengthen recycling, save primary resources and simplify the EU internal market through more harmonised rules. The regulation creates a framework for the entire packaging lifecycle, from product design to waste treatment. This includes restrictions on certain single-use plastics, requirements for takeaway containers, recyclability requirements and the reduction of problematic substances such as PFAS in food-contact packaging.

The GRC impact lies exactly in this breadth. Packaging is not just a shell around a product. It is part of product conformity, supply chain governance, sustainability strategy and market access. A change in material can affect suppliers, costs, shelf life, food safety, transport, brand presentation, recyclability and regulatory documentation.

This makes the PPWR a cross-functional topic. Legal teams need to understand the requirements. Procurement needs to engage suppliers. Product management needs to review packaging design and material decisions. ESG teams need reliable data for sustainability and circular economy goals. Compliance and internal audit need to ensure that evidence is available and robust.

PFAS: The First Concrete Compliance Test

PFAS are often referred to as “forever chemicals” because they are highly persistent and can accumulate in the environment and living organisms. In packaging, they have been used, among other things, for their water-, grease- and dirt-repellent properties. Examples can include coated fast-food packaging, takeaway containers, baking paper, food wrappers and other packaging with grease-barrier functionality.

The PPWR addresses this directly. Article 5 contains specific concentration limits for food-contact packaging. Market surveillance authorities can verify compliance with these PFAS limits. Since there is currently no fully harmonised EU testing methodology for PFAS in food-contact packaging, the quality of internal evidence becomes even more important.

Companies need to show which materials are used, which supplier declarations are available, which tests have been performed, which batches are affected and how decisions were documented. PFAS compliance is therefore not a one-off material check. It is a process involving supplier requests, risk assessment, testing, approval, documentation and ongoing monitoring.

Why Supplier Risk Now Becomes Packaging Risk

Many companies do not manufacture packaging themselves. They source boxes, films, labels, coatings, trays, cups, bags or composite materials from external suppliers. In many cases, packaging is further processed by converters, printers, logistics partners or co-packers.

This is exactly where the GRC risk arises. A company can only be confident that its packaging is PPWR-compliant if it understands its supply chain sufficiently. This applies not only to direct suppliers, but also to material sources, coatings, additives, recycled content and, where relevant, sub-suppliers.

In practice, requesting a generic sustainability statement will not be enough. Companies need specific, current and product-related evidence. For food-contact packaging, this is especially important: Which PFAS risks exist? Which materials and coatings are used? Which tests or certificates are available? Which supplier obligations apply? And how is it ensured that material changes are communicated?

Vendor risk management is therefore moving to a new level. It is no longer only about the financial stability, information security or data protection posture of a supplier, but also about material and product conformity.

PPWR Readiness Requires Data Governance

The PPWR shows very clearly that ESG and product regulation are becoming increasingly data-driven. Companies need to manage not only objectives, but also material data, packaging types, supplier information, technical documents and evidence.

This starts with basic questions: Which products use which packaging? Which packaging comes into contact with food? Which materials contain barrier coatings? Which suppliers provide which components? Which version of a packaging item is currently on the market? Which stocks were placed on the market before or after 12 August 2026?

This turns packaging compliance into a data and process issue. Without clear master data, ownership, versioning and evidence, a company will struggle to prove which packaging was placed on the market, when and under which conditions.

2028 and 2030: The Next Requirements Are Coming

The PFAS restrictions are only the beginning. From 2028, harmonised packaging labels are expected to help consumers sort packaging correctly. These labels will create new requirements for packaging data, material classification and design coordination.

From 2030, the PPWR will intervene even more strongly in packaging design. The regulation includes requirements for packaging minimisation. Manufacturers or importers must ensure that the weight and volume of packaging are reduced to the minimum necessary for its functionality.

For grouped packaging, transport packaging and e-commerce packaging, a maximum empty space ratio of 50 percent is also foreseen once the relevant requirements become applicable.

For companies, this means that waiting until every detail requirement becomes directly applicable is risky. Packaging design, supplier contracts, material changes, testing, labels, product approvals and data models all require lead time.

Why Excel Quickly Reaches Its Limits in Packaging Compliance

Many companies will initially try to manage PPWR requirements through Excel, supplier questionnaires and email approvals. That is understandable, but risky in the long term.

The challenge lies in the dynamics. Packaging changes. Suppliers switch materials. New tests become necessary. Authorities publish guidance. Labels are harmonised. Further requirements follow in 2030. At the same time, companies must be able to explain in an audit why a packaging item was classified as compliant and which evidence supported that decision.

If packaging data, supplier confirmations, tests, risk assessments, product approvals and remediation measures sit in separate files, an evidence problem emerges. This is typical of mature GRC topics: the challenge is not only to achieve compliance, but to make it repeatable, auditable and manageable.

What Companies Should Do Now

Companies should first clarify whether they place food-contact packaging on the EU market or use such packaging in their products. They should then assess whether PFAS-relevant materials, coatings or supplier risks exist. Crucially, this should not be treated as a one-time supplier request, but as part of an ongoing control process.

At the same time, companies should build or update their packaging inventory. Without visibility into packaging types, materials, suppliers, products and markets, a reliable PPWR roadmap is difficult to create. Documentation of the placing-on-the-market date is particularly important, because companies must distinguish between packaging placed on the market before and after 12 August 2026.

The next step is a gap assessment for upcoming requirements. 2028 and 2030 may sound far away, but they are not. Packaging changes require design decisions, supplier qualification, testing, budget, communication and operational implementation.

Conclusion: The PPWR Turns Packaging Into a GRC Data Topic

The new EU packaging rules show how strongly sustainability, product safety and compliance are converging. The PFAS restrictions for food-contact packaging are the first visible implementation test. Further requirements on labels, recyclability, recycled content, reuse and packaging minimisation will follow.

For GRC leaders, the key message is clear: packaging compliance is not an isolated environmental project. It requires clear ownership, reliable supplier data, documented risk assessments, controls, technical evidence and audit-ready decisions.

Companies that start now can reduce regulatory risk and create better transparency across products, supply chains and ESG data. Zazoon helps companies build PPWR readiness as an integrated GRC practice: from requirements and risks to suppliers, controls, evidence and audit trails.

FAQ

What is the PPWR?

The PPWR is the new EU Packaging and Packaging Waste Regulation. It replaces the previous Packaging Directive in many areas and creates a more harmonised framework for packaging and packaging waste in the EU.

Since when does the PPWR apply?

The PPWR entered into force on 11 February 2025 and generally applies from 12 August 2026. Some requirements apply later, including certain labelling and design requirements.

What changes for PFAS?

Since 12 August 2026, food-contact packaging may no longer be placed on the EU market if it reaches or exceeds certain PFAS concentration limits. The limits apply to individual PFAS, the sum of certain PFAS and total PFAS.

Is there a grace period for old stock?

There is no general stock-depletion grace period for food-contact packaging containing PFAS. Packaging placed on the market before 12 August 2026 may remain on the market. Packaging placed on the market after that date must comply with the limits.

Which companies are affected?

Affected companies include those placing packaging or packaged products on the EU market. This can include manufacturers, importers, distributors, brand owners, food companies, e-commerce providers and Swiss exporters.

Why is the PPWR a GRC topic?

The PPWR connects product compliance, ESG, supplier management, data governance, technical documentation, internal controls and audit readiness. Companies must not only understand the requirements, but also prove their implementation.

How does Zazoon support PPWR readiness?

Zazoon helps companies centrally manage requirements, risks, suppliers, controls, actions and evidence. This makes packaging compliance traceable, efficient and audit-ready.

The EU AI Act is becoming operational. One of the first areas companies need to address is transparency. Under Article 50, certain AI systems must clearly inform people when they are interacting with AI or when content has been generated or manipulated by AI.

This affects more companies than many expect. The rules are not limited to high-risk AI systems. Chatbots, virtual assistants, AI-generated marketing content, synthetic images, audio, video and certain deepfake use cases can all trigger transparency obligations.

For GRC teams, this marks an important shift. AI governance is no longer just about principles, policies or innovation control. It now requires concrete inventories, clear roles, risk assessments, approval processes, controls and evidence.

Key Takeaways

Transparency obligations under the EU AI Act apply to specific AI systems and use cases, including interactive AI systems such as chatbots, AI-generated or AI-manipulated content, deepfakes and certain biometric or emotion-related systems.

The core idea is simple: people should be able to recognise when they are interacting with AI or when content has been artificially generated or manipulated. In practice, however, this requires much more than adding a disclaimer.

Companies need to understand where AI is used, who owns each use case, which obligations apply, how users are informed and how implementation is documented. This makes transparency a classic governance, risk and compliance topic.

Why Article 50 Matters

Many AI Act discussions focus on high-risk AI. Article 50 shows that even companies without high-risk systems may still be affected. A customer service chatbot, an AI assistant on a website, AI-generated product images or synthetic video content may already be enough to create transparency requirements.

The aim is to prevent people from being misled. Customers, employees, partners or the public should not be left uncertain about whether they are interacting with a person or a machine, or whether a piece of content is authentic or AI-generated.

That sounds straightforward, but implementation can be complex. AI tools are often introduced quickly and decentralised across teams. Marketing uses generative content tools. Customer service pilots chatbots. HR tests AI assistants. Product teams integrate AI features. Without central oversight, companies quickly lose visibility.

Transparency Is More Than a Disclaimer

A common mistake is to treat AI transparency as a wording task. Add a label, update a footer, include a short notice and move on. That is not enough.

Transparency needs to be embedded in processes. Companies must know which AI systems are in use, what they do, who is responsible, which users are affected, whether content is generated or manipulated and which disclosure obligation applies.

A disclaimer may be the visible output. The actual GRC work happens behind the scenes: classification, approval, risk assessment, control design, documentation and review.

Chatbots and Interactive AI Systems

Chatbots and virtual assistants are among the most obvious examples. If customers interact with an AI system, they generally need to be informed that they are dealing with AI.

This is particularly relevant for customer support, online banking, insurance portals, HR helpdesks, e-commerce and SaaS platforms. The key issue is not only whether the chatbot says “I am an AI assistant”. Companies also need to ensure that the information is provided at the right moment, in a clear way and consistently across channels.

GRC teams should therefore treat chatbot deployment as a controlled process. Before go-live, the use case should be documented, transparency requirements assessed, content reviewed and ownership assigned.

AI-Generated Content and Deepfakes

The AI Act also addresses AI-generated and AI-manipulated content. This includes synthetic images, videos, audio files and deepfakes. For companies, this can affect marketing campaigns, social media, product visuals, training videos, recruitment content or public communications.

The risk is not only regulatory. It is also reputational. If customers or employees feel misled by synthetic media, trust can be damaged quickly. Transparent use of AI therefore protects both compliance and brand credibility.

Companies should define when AI-generated content needs review, approval and labelling. External agencies and service providers should also be included, because AI-generated content is often created outside the organisation.

The Role of an AI Inventory

The practical starting point is an AI inventory. Without one, companies cannot reliably identify which transparency obligations apply.

An effective AI inventory should capture the AI system, purpose, business owner, provider, user groups, data involved, output type, regulatory role, risk level, required disclosures, controls and available evidence.

For smaller and mid-sized companies, this does not need to be overly complex. But it needs to be structured, maintained and connected to responsibilities. Otherwise AI use will grow faster than governance can follow.

Conclusion: Transparency Is the First Step Toward Trustworthy AI Governance

The EU AI Act makes transparency one of the first practical AI governance obligations for many companies. Chatbots, AI-generated content and deepfakes are no longer just innovation or communication topics. They require clear ownership, controls and evidence.

For GRC leaders, this is an opportunity to build AI governance pragmatically. The first step is not a perfect AI strategy. It is visibility: knowing where AI is used, which obligations apply and how the company can prove compliance.

Zazoon supports companies in building this foundation by connecting AI use cases, risks, controls, responsibilities and evidence in one central GRC system.

FAQ

What are AI Act transparency obligations?

They are requirements that ensure people can recognise when they interact with certain AI systems or when content has been generated or manipulated by AI.

Which AI systems are relevant?

Typical examples include chatbots, virtual assistants, AI-generated content, synthetic media, deepfakes and certain biometric or emotion-related systems.

Why is transparency a GRC topic?

Because transparency requires more than a label. Companies need inventories, responsibilities, risk assessments, controls, approvals and evidence.

What should companies do first?

They should create or update an AI inventory and identify use cases that may trigger transparency obligations.

How does Zazoon help?

Zazoon helps companies manage AI use cases, risks, controls, responsibilities, vendor dependencies and evidence in one central GRC platform.

The European Banking Authority (EBA) has revised its Product Oversight and Governance Guidelines for retail banking products. The updated guidelines place a stronger focus on products with environmental, social or governance characteristics and on the risk of greenwashing.

For banks, financial service providers and other regulated companies, this is an important signal. ESG compliance is becoming more operational. It is no longer enough to mention sustainability features in marketing materials or product information. Companies need to demonstrate how ESG claims are created, reviewed and monitored throughout the product lifecycle.

Key Takeaways

The EBA published its revised Product Oversight and Governance Guidelines on 30 June 2026. They explicitly address ESG characteristics and greenwashing risks and are expected to apply from 11 January 2027.

For GRC leaders, this means ESG product governance needs to be more closely integrated with risk management, internal controls, approval processes, documentation and ongoing monitoring.For GRC leaders, this means ESG product governance needs to be more closely integrated with risk management, internal controls, approval processes, documentation and ongoing monitoring.

Why the EBA Is Addressing Greenwashing More Closely

ESG-related products are no longer a niche topic in the financial sector. Banks and financial service providers increasingly offer loans, accounts and other products with sustainability-related features.

At the same time, the risk is growing that ESG claims are too broad, misleading or insufficiently supported. The EBA therefore wants sustainability characteristics to be clearly defined, reviewed and monitored rather than used purely as a communication tool.

Greenwashing is consequently becoming not only a marketing or reputational risk, but also a governance and control issue.

ESG Claims Need Robust Governance

Any company describing a product as sustainable, green or ESG-oriented should be able to explain which criteria and data support that claim and who reviewed it.

Companies also need to understand where customers could misinterpret sustainability statements and which controls prevent exaggerated or unsupported claims.

These questions should not be limited to marketing approval. They need to be embedded in the organisation’s broader governance framework.

Product Governance Is Becoming an Evidence Issue

The EBA guidelines cover the entire product lifecycle, from development and approval to distribution, monitoring and adjustment.

For ESG-related products, sustainability characteristics should be clearly defined during product development. Sales and marketing communications must remain consistent with those characteristics, while complaints, market developments and regulatory changes should feed into ongoing monitoring.

This makes ESG product governance an evidence issue. In an audit or regulatory review, companies need to show that sustainability claims were part of a controlled and documented process.

What GRC Leaders Should Review Now

Companies should first identify which products use ESG characteristics or sustainability claims. They should then review who is responsible for defining, checking and approving those claims and where greenwashing, compliance or reputational risks could arise.

Controls around data quality, accuracy and documentation are equally important.

Ultimately, organisations should be able to answer one simple question: Can we demonstrate why an ESG claim was accurate, who reviewed it and which controls supported it?

Why Excel and Email Approvals Quickly Reach Their Limits

Many companies still manage product approvals, risks and evidence through Excel files, emails and separate document repositories.

With ESG claims, however, complex dependencies can quickly emerge between data sources, internal criteria, legal assessments, approvals and marketing materials.

If this information is not connected, it becomes increasingly difficult to demonstrate how decisions were made and which controls were applied.

Conclusion: Greenwashing Prevention Starts with Governance

The revised EBA guidelines make one thing clear: ESG claims need to be manageable, verifiable and supported by evidence.

Greenwashing prevention is therefore no longer just a communication task. It is becoming an important part of modern Governance, Risk and Compliance.

Companies should review whether their ESG-related product processes are sufficiently documented, controlled and audit-ready.

Zazoon helps organisations centrally manage ESG product governance, risks, controls and evidence and turn manual processes into a more robust GRC practice.

FAQ

What has the EBA published?

The EBA has published revised Product Oversight and Governance Guidelines for retail banking products. They explicitly address ESG characteristics and greenwashing risks.

Which companies are affected?

The guidelines apply to manufacturers and distributors of products within the EBA’s remit, including mortgages, personal loans, deposits, payment accounts, payment services and electronic money.

Why is this relevant for GRC?

Because ESG claims need to be supported organisationally. Companies require clear responsibilities, risk assessments, controls, approvals and evidence.

What is greenwashing in financial products?

Greenwashing occurs when sustainability claims are misleading, exaggerated, unclear or insufficiently supported.

How does Zazoon support ESG product governance?

Zazoon connects risks, controls, responsibilities, policies and evidence in one central GRC system, making ESG-related product processes more transparent and easier to audit.

With NIS360 2026, ENISA has published the third edition of its report on the cybersecurity maturity of critical EU sectors. The report assesses how mature individual sectors of high criticality are in managing cyber risks and how critical they are to society, the economy and public safety.

For companies, this is more than just another industry analysis. NIS360 indicates where NIS2 implementation is heading: away from simply determining whether an organisation falls within the scope of NIS2 and towards measurable cybersecurity maturity. The decisive question is no longer only whether a company is subject to NIS2. What increasingly matters is how transparently and systematically risks, controls, responsibilities and evidence are managed.

This moves NIS2 even further into the core of governance, risk and compliance. Companies that do not know their maturity level will struggle to set priorities, explain weaknesses clearly and meet audit or regulatory requirements without significant effort.

Key Takeaways

ENISA NIS360 2026 assesses the cybersecurity maturity and criticality of sectors of high criticality under NIS2.

The report shows that cybersecurity maturity in Europe is improving, but significant differences between sectors remain.

The comparison between criticality and maturity is particularly relevant. Sectors with high importance but comparatively low maturity are likely to face increased attention.

For GRC professionals, this means that NIS2 is becoming increasingly measurable. Maturity models, control evidence, risk registers, responsibilities and management reporting are becoming more important.

Companies should not treat their NIS2 implementation merely as a compliance project, but as a permanent governance framework for cyber resilience.

What Is ENISA NIS360 2026?

ENISA NIS360 is a report published by the European Union Agency for Cybersecurity. It assesses the cybersecurity maturity of sectors that fall within the sectors of high criticality covered by the NIS2 Directive.

The assessment goes beyond technical security. ENISA considers the entire sectoral context, including competent authorities, affected entities, regulatory requirements, operational capabilities, maturity levels, dependencies and societal importance.

NIS360 therefore provides an overview of how well individual sectors are prepared for cyber risks. At the same time, the report identifies areas that are particularly critical because disruptions could have significant consequences for society and the economy.

For companies, this is important because it provides an indication of the expectations that regulators, customers, auditors and business partners may increasingly impose in the future.

Why NIS360 Is Relevant for Companies

At first glance, NIS360 assesses entire sectors rather than individual companies. Nevertheless, the report is highly relevant to organisations.

It shows which industries are receiving greater regulatory, political and operational attention. When a sector is considered particularly critical, pressure on individual companies within that sector generally increases as well. This does not only affect operators of critical infrastructure, but also service providers, suppliers and digital partners.

Companies therefore need to prepare for increasing demand for evidence. Simply describing individual security measures is no longer sufficient. Organisations are increasingly expected to provide a clear picture of how cyber risks are managed, which controls are effective and how their cybersecurity maturity improves over time.

NIS360 therefore makes one point particularly clear: NIS2 compliance is not a one-time status. It is becoming a continuous maturity process.

From NIS2 Compliance to Cybersecurity Maturity

Many companies initially approached NIS2 by asking one question: Are we affected or not? This question remains important, but it is no longer sufficient.

The next phase of NIS2 implementation is about maturity and effectiveness. Companies must not only understand the requirements but also demonstrate how these requirements have been implemented in practice.

This includes clear governance structures, documented risks, defined measures, effective controls, verifiable evidence and regular management reporting. These elements determine whether an organisation can credibly demonstrate its cybersecurity maturity.

A low maturity level does not automatically mean that a company is non-compliant. However, it highlights where gaps exist, where priorities need to be set and where risks may not yet be managed adequately.

Why Maturity Assessment Is Becoming Critical for GRC Professionals

GRC professionals increasingly need to build bridges between regulatory requirements, technical security measures, operational risks and management decisions.

NIS360 shows that cybersecurity cannot be viewed in isolation. Cyber risks affect supply chains, business processes, crisis management, responsibilities, internal controls and strategic investments.

A maturity assessment helps bring these areas together in a structured way. It answers key questions:

How well prepared is the company for cyber risks?

Which controls are in place, and how effective are they?

Which risks have been accepted, mitigated or remain unresolved?

Which measures should be prioritised?

What evidence is available in the event of an audit?

How does the organisation’s maturity develop over time?

This makes maturity assessment a management and governance tool. It makes progress visible and helps organisations justify investments more effectively.

What Companies Can Learn from NIS360 2026

The key message from NIS360 2026 is clear: cybersecurity maturity is improving, but not evenly. Some sectors are already comparatively advanced, while others remain vulnerable despite their high criticality.

For companies, this means that their own maturity should not only be assessed internally. It also needs to be understood within the context of the relevant industry. A company operating in a particularly critical sector is likely to face stricter expectations than one operating in a less sensitive environment.

This is not only about technical security measures. The decisive factor is whether cybersecurity is embedded within the organisation. Are responsibilities clearly defined? Are risks assessed regularly? Can measures be tracked? Are incidents managed systematically? Is senior management involved? Are supplier risks considered?

Companies that cannot answer these questions clearly have a governance problem, even if individual technical controls are already in place.

The Role of Governance in NIS2

NIS2 makes cybersecurity a management responsibility. This means that cyber risks cannot remain solely within the IT department. They must become part of corporate governance and management.

Governance provides the framework that defines responsibilities, decision-making processes and control mechanisms. Without clear governance, typical weaknesses emerge: unclear responsibilities, fragmented documentation, incomplete tracking of measures and insufficient transparency for management.

Effective NIS2 governance should define who is responsible for cyber risks, how risks are assessed, which controls apply, how measures are prioritised and how progress is reported.

NIS360 reinforces this perspective. Organisations that want to demonstrate their maturity need more than individual security projects. They need a system for managing, monitoring and continuously improving cybersecurity.

Why Evidence Is Becoming a Bottleneck

Many companies already have security policies, risk assessments, training programmes, technical controls and incident management processes. The problem is often not that nothing exists. The problem is being able to prove it.

Information is frequently distributed across different tools, Excel files, email threads, ticketing systems, audit folders and departments. In day-to-day operations, this may work to some extent. During an audit or regulatory request, however, it can quickly become a major challenge.

NIS2 and the associated focus on maturity increase the pressure for centralised evidence management. Companies need to demonstrate which risks have been assessed, which measures resulted from those assessments, who is responsible, which controls have been implemented and when those controls were reviewed.

Evidence therefore becomes a fundamental component of cybersecurity maturity. Without evidence, maturity remains merely a claim.

Which Areas Companies Should Review Now

Companies should use NIS360 2026 as an opportunity to systematically assess their NIS2 readiness. This should go beyond a legal assessment of whether the company falls within the scope of NIS2. The more important question is how robust the organisation’s governance and management framework actually is.

Five areas are particularly important:

First: governance and responsibilities. Companies should clearly define who monitors cyber risks, who approves measures and how senior management is involved.

Second: risk management. Cyber risks should be assessed regularly, prioritised and linked to specific measures.

Third: control management. Security measures must not only exist; they need to be documented transparently and reviewed regularly.

Fourth: incident management and crisis preparedness. Companies should understand how they detect, assess, report and follow up on incidents.

Fifth: supplier and third-party risks. Many cyber risks originate outside the organisation itself. Critical service providers, dependencies and supporting evidence therefore need to be integrated into NIS2 governance.

What an Effective NIS2 Maturity Process Needs to Achieve

A strong maturity process begins with transparency. Companies need to understand which requirements apply, which risks exist and which controls are already in place.

The next step is assessment. Not every gap has the same level of criticality. A maturity model helps organisations classify weaknesses and set priorities. The focus should not only be on formal compliance, but also on actual effectiveness.

Connecting information is equally important. Risks, controls, measures, responsibilities and evidence must not be managed in isolation. Only when these elements are linked can an organisation develop a realistic picture of its cybersecurity maturity.

Finally, regular updates are essential. Cyber risks, threats, systems, supply chains and regulatory expectations continuously change. A maturity assessment is therefore not a one-time check, but part of a continuous improvement process.

Common Mistakes in NIS2 Implementation

One common mistake is focusing exclusively on requirement catalogues. Companies may check which requirements exist while losing sight of effectiveness, prioritisation and evidence.

Another mistake is separating compliance from cybersecurity. If compliance teams only document requirements while IT teams only implement technical measures, there is often no common governance framework. NIS2, however, requires an integrated approach combining risk, controls, technology, organisation and management.

Decentralised documentation is another problem. When risks, measures and evidence are distributed across multiple locations, it becomes difficult to establish a reliable picture of maturity.

A fourth mistake is underestimating supplier risk. Critical digital dependencies in particular can significantly affect an organisation’s own cybersecurity maturity. Companies that do not understand these dependencies cannot credibly manage their cyber resilience.

Why NIS2 Maturity Assessment Also Matters for Companies Not Directly Subject to NIS2

Not every company falls directly within the scope of NIS2. Nevertheless, NIS360 2026 can also be highly relevant for organisations that are only indirectly affected.

Many companies are part of supply chains, provide services to regulated customers or offer digital services. In such cases, customers may increasingly demand evidence of cybersecurity maturity even when there is no direct legal obligation.

This is particularly relevant for IT service providers, cloud providers, software companies, consultancies, managed service providers and specialised suppliers. Companies serving critical customers will increasingly need to explain how they manage cyber risks.

NIS2 therefore extends beyond its direct legal scope. Its requirements are increasingly finding their way into contracts, supplier assessments, procurement processes and customer audits.

Conclusion

ENISA NIS360 2026 clearly shows that NIS2 is evolving from a regulatory obligation into a measurable maturity framework for cybersecurity and GRC.

For companies, this means that cybersecurity can no longer be treated solely as a technical issue or temporary project. What increasingly matters is whether risks, controls, responsibilities and evidence can be managed centrally and systematically.

The most important step is transparency. Companies need to understand where they currently stand, which gaps exist and which measures will have the greatest impact. Maturity assessment provides the foundation for this.

Companies that treat NIS2 merely as a checklist are likely to face increasing pressure over time. Organisations that understand NIS2 as a governance and maturity process can connect regulatory requirements, cyber resilience and management oversight in a meaningful way.

FAQ: ENISA NIS360 2026 and NIS2 Maturity

What is ENISA NIS360 2026?

ENISA NIS360 2026 is a report published by the European Union Agency for Cybersecurity. It assesses the cybersecurity maturity and criticality of sectors of high criticality covered by the NIS2 Directive.

Why is NIS360 important for companies?

The report shows how expectations around cybersecurity and NIS2 implementation are evolving. For companies, it demonstrates that maturity, evidence and governance structures are becoming increasingly important.

What does cybersecurity maturity mean?

Cybersecurity maturity describes how advanced an organisation or sector is in managing cyber risks. It includes risk management, controls, processes, responsibilities, incident management and continuous improvement.

How is NIS360 related to NIS2?

NIS360 examines sectors that fall within the sectors of high criticality covered by the NIS2 Directive. The report helps organisations better understand the maturity and criticality of these sectors.

Why is an NIS2 gap analysis not enough?

A gap analysis identifies which requirements have not yet been fulfilled. However, it often provides limited information about how effective controls are, how well risks are managed and whether evidence is available in an audit-ready format.

What role does governance play in NIS2?

Governance ensures that responsibilities, decision-making processes, controls and reporting are clearly defined. Without effective governance, NIS2 often remains an isolated technical project rather than becoming a manageable business process.

Why is evidence so important?

Evidence demonstrates that risks have been assessed, measures have been implemented and controls have been reviewed. Without evidence, it is difficult to credibly demonstrate maturity to management, auditors, customers or regulators.

Does NIS2 also affect suppliers?

Yes. Suppliers and service providers play an important role. Even if a company does not fall directly within the scope of NIS2, it may be indirectly affected through customer requirements, contractual obligations or audits.

What should companies do now?

Companies should assess their NIS2 maturity, identify key risks, clarify responsibilities, document controls, structure their evidence and incorporate supplier risks into their governance framework.

Is NIS2 compliance a one-time project?

No. NIS2 compliance is a continuous process. Threats, systems, supply chains and regulatory expectations are constantly evolving. Cybersecurity maturity therefore needs to be assessed and improved on a regular basis.