.png&w=3840&q=75&dpl=dpl_Ba6pf7ueYcNioUvDkWkKkJsULeG7)
Does NIS2 apply to Swiss companies?
Direct answer
Not directly. NIS2 binds organisations in the EU, so a company established only in Switzerland is not itself in scope. It still reaches Swiss companies in three ways: through an EU subsidiary in a covered sector, through the EU representative that Swiss digital providers serving the EU must name, and through supply chain requirements passed on by EU customers.
Not directly. NIS2 binds organisations in the EU, so a company established only in Switzerland is not itself in scope. It reaches Swiss companies in three ways: an EU subsidiary in a covered sector is in scope in its own country, Swiss digital providers such as cloud, data centre or managed security services that serve the EU must name an EU representative, and EU customers pass NIS2 supply chain requirements on to their Swiss suppliers.
Who NIS2 covers
Article 2 of NIS2 (Directive (EU) 2022/2555) applies to medium-sized and larger entities in the sectors of Annexes I and II that provide their services or carry out their activities in the EU, plus some entities regardless of size. Article 26 places each entity under the law of the member state where it is established. Switzerland is not an EU or EEA member and has not taken over NIS2, so the directive itself sets no duties for a company established only in Switzerland.
Three ways NIS2 still reaches Swiss companies
- EU subsidiaries and establishments. A subsidiary in Germany, France or another member state that meets the sector and size tests is in scope under that country’s NIS2 law, whoever owns it.
- Digital providers serving the EU. DNS providers, TLD registries, domain registrars, cloud computing, data centre and content delivery providers, managed service and managed security service providers, online marketplaces, search engines and social networks that are not established in the EU but offer services there must designate a representative in a member state (Article 26(3)), and fall under that state’s law.
- Suppliers to EU entities. Article 21(2)(d) requires in-scope entities to manage the security of their supply chain. A Swiss supplier of an EU hospital, energy company or manufacturer usually meets NIS2 through contract clauses, security questionnaires and audit rights.
What Swiss law asks instead
Switzerland has its own reporting duty. Since 1 April 2025, the Information Security Act requires operators of critical infrastructure to report cyberattacks to the Federal Office for Cybersecurity (BACS) within 24 hours of discovery. Financial institutions supervised by FINMA also report cyberattacks to FINMA. There is no Swiss equivalent of the NIS2 risk-management catalogue or of its management-body liability, so a Swiss group with EU entities usually applies the NIS2 baseline group-wide to keep one programme.
Running NIS2 next to Swiss rules in Acuna GRC
In Acuna GRC you adopt NIS2 in Comply next to ISO 27001, the Swiss FADP or any other framework you follow. Common Measures are mapped across frameworks, so one measure counts for every requirement it meets, and scopes such as a legal entity or a country let you apply NIS2 only to the entities in scope. Incidents are logged as issues with a dated timeline, and suppliers are assessed with questionnaires in TPRM. See the Comply workspace.
How Acuna GRC handles it
In Acuna GRC you can run NIS2 next to the Swiss rules that apply to you, with one set of measures.
- Solution
NIS2
Put NIS2 measures in place with owners, reuse your ISO 27001 controls, check suppliers, follow incidents and vulnerabilities, and keep proof in one place.
- Core workspace
Comply
The frameworks you select, the scopes and tags that segment your organization, the common measures library and the mapping of measures across frameworks.
- Service
CISO as a service
A virtual CISO from Swiss experts: risk reviews, BIA and policy reviews run in Acuna GRC all year, while you review and decide. Your audit stays independent.
Sources
- Directive (EU) 2022/2555 (NIS2), Articles 2, 21 and 26
- BACS, mandatory reporting of cyberattacks on critical infrastructure
This page explains the rules in general terms and is not legal advice.
Frequently asked
Our Swiss company sells software to EU customers. Are we in scope?
Not as a software vendor alone. If you provide a covered digital service in the EU, such as cloud computing or managed security services, you must designate an EU representative and comply. Otherwise NIS2 reaches you through your customers’ supply chain requirements.
Do Swiss companies have to report incidents under NIS2?
Only through an in-scope EU entity or an EU representative. A Swiss critical infrastructure operator reports cyberattacks to BACS within 24 hours under the Information Security Act.
Will Switzerland adopt NIS2?
Switzerland is not bound to adopt EU directives. It regulates cybersecurity through its own laws, such as the Information Security Act.
See how Acuna GRC runs this.
Tell us your frameworks and your team. We show you how Acuna GRC runs the program.
Hosted in Switzerland, the EU or the US