By July 8, 2026, 23 of 27 EU member states had notified full NIS2 transposition, and the European Commission took the other four to the EU Court of Justice.
NIS2 requirements are the cybersecurity obligations that 23 national laws place on organizations in 18 critical sectors, including control over code signing keys and reporting of their misuse. For signing teams, compliance comes down to evidence: the records an auditor or a national computer security incident response team (CSIRT) can ask to see.
Key takeaways
- Under NIS2, code signing teams need a management-approved cryptography policy, multi-factor authentication (MFA) on signing access, signature checks on supplier code and patches, and signing records that support Article 23 incident reports.
- Implementing Regulation (EU) 2024/2690 lists twelve key management methods, from key generation to audit logging, and any organization under NIS2 can use them as a code signing checklist.
- Decide whether internal signing keys should meet the certified-hardware standard that CA/Browser Forum rules set for publicly trusted code signing keys.
- NIS2 reaches code signing teams at medium-sized and larger organizations in 18 sectors, software vendors through their customers’ supply chain checks, and hardware makers that sign firmware.
What the NIS2 requirements cover
Directive (EU) 2022/2555, known as NIS2, succeeded the 2016 NIS Directive. Article 41 set the transposition deadline for October 17, 2024. The 2016 directive was repealed the next day.
The directive gives organizations four duties: registration with a competent authority, the risk-management measures in Article 21, incident reporting under Article 23, and management approval and oversight under Article 20. Member states had until April 17, 2025, to list their essential and important entities under Article 3(3).
Which organizations are covered by NIS2
Public and private entities in the sectors listed in Annexes I and II fall under the directive once they reach medium size. The EU definition of small and medium-sized enterprises (SMEs) puts that line at 50 employees, or at turnover and balance sheet totals both over €10 million. Trust service providers, DNS service providers, and top-level domain registries are in scope at any size through Article 2(2).
Under Article 3, large organizations in Annex I sectors generally count as essential entities, which regulators supervise proactively. Other covered organizations are important entities and face supervision after the fact. Maximum fines under Article 34 reach at least €10 million or 2% of worldwide annual turnover for the first group and €7 million or 1.4% for the second, whichever is higher.
Vendors of installed software come under NIS2 through their customers because Article 21(3) makes those customers weigh the security practices of direct suppliers. Annex II brings in manufacturers of computer and electronic products, electrical equipment, machinery, and motor vehicles. Firmware signing at many of those hardware makers falls in scope as a result.
Which Article 21 measures apply to code signing
Six of the ten minimum measures in Article 21(2) reach code signing directly. Risk analysis, business continuity, effectiveness reviews, and cyber hygiene training make up the remaining measures and sit at the organization level.
Table 1. The signing control behind each Article 21(2) measure
| Article 21(2) measure | Signing control |
| (b) Incident handling | Response plan for a misused or stolen signing key |
| (d) Supply chain security | Signature checks on third-party components and updates |
| (e) Acquisition, development, and maintenance | Release signing in continuous integration and continuous delivery (CI/CD) pipelines |
| (h) Cryptography | Approved signing algorithms, key sizes, and key lifecycle rules |
| (i) Access control and asset management | Signing roles and an inventory of keys and certificates |
| (j) Multi-factor authentication | MFA on signing requests and signing policy changes |
Figure 1. Where NIS2 controls sit in a code signing pipeline
What the implementing rules say about signing keys
Implementing Regulation (EU) 2024/2690, adopted on October 17, 2024, sets the technical requirements behind Article 21 for cloud, managed service, DNS, trust service, and other digital providers. Evidence examples for each requirement come from technical implementation guidance that the EU Agency for Cybersecurity (ENISA) published on June 26, 2025. Both texts work as a benchmark for entities outside the regulation’s scope.
Section 9 of its annex requires a cryptography policy that sets protocols, algorithms, and cipher strength by asset classification and follows a crypto-agility approach where appropriate. Generating, distributing, storing and accessing, changing, revoking, recovering, backing up or archiving, and destroying keys account for eight of the policy’s twelve key management methods. The other four deal with public key certificates, compromised keys, audit logging, and activation and deactivation dates.
Point 6.6 of the annex asks for patches from trusted sources with an integrity check. A verified signature provides that check for patches and supplier code alike. In ENISA’s 2025 survey of 1,080 organizations, 50% named patching as a hard NIS2 area to implement, and 37% named supply chain risk management.
Each entity picks its own storage technology under the regulation. Since June 1, 2023, CA/Browser Forum (CA/B Forum) rules have required certified hardware for keys behind code signing certificates from public certificate authorities (CAs). The modules must meet Federal Information Processing Standard (FIPS) 140-2 Level 2, Common Criteria Evaluation Assurance Level (EAL) 4+, or an equivalent level. The same hardware requirements make a workable baseline for internal signing keys.
The EU’s post-quantum cryptography roadmap, published on June 23, 2025, sets first steps for member states by the end of 2026 and migration of high-risk use cases by the end of 2030. Applied to signing, crypto-agility means an algorithm inventory and a replacement plan paced by the roadmap’s milestones.
How incident reporting works after a key compromise
Three deadlines follow a significant incident under Article 23(4): an early warning within 24 hours of awareness, an incident notification within 72 hours, and a final report one month later. A national CSIRT or competent authority may also request an intermediate status report under Article 23(4)(c). For digital providers, the implementing regulation’s Article 3 adds a financial trigger: a direct loss, actual or potential, over €500,000 or 5% of the previous year’s turnover, whichever is lower.
Hypothetical example: a managed service provider with €40 million in annual turnover confirms a significant incident at 10:00 CET on Monday, November 9, 2026, after its update-signing key signed an unapproved binary. At €40 million in turnover, 5% equals €2 million, which leaves €500,000 as the lower figure and the trigger that applies. Each deadline runs from the moment of awareness, and the final report counts calendar months.
Table 2. Reporting deadlines in the hypothetical example
| Stage | Deadline | What the signing team supplies |
| Early warning | Tuesday, November 10, 2026, 10:00 CET | Key and certificate IDs, misuse window, suspected malice, and countries receiving signed files |
| Incident notification | Thursday, November 12, 2026, 10:00 CET | Hashes of affected files, revocation status, and an initial severity assessment |
| Final report | Saturday, December 12, 2026, if the notification goes out at its deadline | Root cause, rotated keys, policy changes, and remaining mitigation (or a progress report for an open incident) |
AppViewX Code Signing traces every signature to a key, a project, and a person. Joined to release data, those records show which countries received files from the misused key.
How NIS2 compares with the CRA and DORA
Code signing also answers to the Cyber Resilience Act (CRA) and the Digital Operational Resilience Act (DORA).
Table 3. CRA and DORA duties for code signing
| Rule | Who it binds | What it asks of code signing | Key dates |
| Cyber Resilience Act, Regulation (EU) 2024/2847 | Manufacturers of products with digital elements | Integrity protection, secure updates, and 24-hour reporting of actively exploited vulnerabilities | Reporting from September 11, 2026, and full application from December 11, 2027 |
| DORA technical standards, Delegated Regulation (EU) 2024/1774 | Banks, insurers, and other financial entities, where DORA takes precedence over NIS2 | Key lifecycle controls and a register of certificates and certificate-storing devices | DORA applies from January 17, 2025 |
One set of signing records can serve NIS2, CRA, and DORA reviews.
Figure 2. Dates to plan around. Sources: European Commission, EUR-Lex, and CA/B Forum
What a signing platform needs to produce NIS2 evidence
During a trial, ask each vendor to produce the record behind every capability it claims.
Table 4. Signing platform capabilities ranked for NIS2 evidence
| Capability | Priority | Record it produces |
| Key custody in a hardware security module (HSM) | Must-have | Proof that private keys stay in certified hardware |
| Approval with MFA | Must-have | An approval trail for every signing request |
| Per-signature logs tied to key, project, and person | Must-have | The file list behind an early warning |
| Timestamping | Must-have | Signing times that stay verifiable after a certificate expires |
| Revocation workflow | Must-have | Revoked certificates and re-signed releases after a misuse |
| CI/CD integration | Must-have | Pipeline signing requests routed through one service |
| Reports mapped to Article 21(2) measures | Nice-to-have | Audit summaries in one export |
| A dedicated HSM per developer | Overkill | Extra hardware cost for the same NIS2 evidence |
Next steps for NIS2 code signing with AppViewX
Teams build NIS2 signing evidence in sequence. Fixing key custody before writing policy lets the policy describe controls already in place.
- Inventory every signing key and code signing certificate, and name an owner for each. Use certificate discovery to find certificates outside a central service.
- Move private keys from developer machines and build agents into HSM-backed storage.
- Route pipeline signing through one service with role-based approval and MFA, in line with code signing best practices.
- Write a signing policy that names approved algorithms, key sizes, approvers, and a review date.
- Run a tabletop exercise that times the team against the 24-hour and 72-hour reporting deadlines.
Transport Layer Security (TLS) certificates fall under the same NIS2 measures, and AppViewX’s post on NIS2 certificate controls covers them.
Code signing keys are machine identities, and AppViewX Code Signing manages them in one service. The service’s policy engine enforces role-based access and approvals, and its audit logs record every signed file with the signing time, timestamp use, certificate, and key. Private keys stay in HSMs certified to FIPS 140-2 Level 3, which exceeds the Level 2 floor that CA/B Forum rules set. Teams can deploy the service on-premise or as SaaS. AppViewX already issues certificates for internal post-quantum code signing, and the policy engine enforces algorithm and key size rules today.
Disclaimer: Sources were checked on October 26, 2026. Legal counsel can confirm how NIS2 affects a specific organization.
Frequently asked questions
1. Does NIS2 apply to companies outside the EU?
NIS2 applies to companies outside the EU when they provide services in the EU in a covered sector and meet any size rules. Listed digital providers established outside the EU, such as cloud and DNS providers, must also designate a representative in a member state where they offer services.
2. Who supervises NIS2 compliance?
Each member state designates one or more competent authorities to supervise NIS2 compliance and at least one CSIRT to handle incident reports. A single point of contact in each state coordinates cross-border cases with the other member states.
3. What counts as a significant incident under NIS2?
An incident is significant under Article 23(3) of the directive when it causes, or can cause, severe operational disruption or financial loss for the entity, or considerable material or non-material damage to others. A stolen signing key used to sign malware can meet both tests, since customers who install the files absorb the damage.
4. Are the NIS2 requirements changing?
The requirements may change, since the Commission proposed targeted amendments to NIS2 in January 2026. The European Parliament’s procedure file showed the proposal awaiting committee decision on October 15, 2026, after a committee draft report on September 24, 2026. Current rules apply in the meantime.
Sources
- European Commission, Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice for failing to transpose the rules on cybersecurity, July 8, 2026, https://digital-strategy.ec.europa.eu/en/news/commission-refers-ireland-spain-france-and-netherlands-court-justice-failing-transpose-rules
- European Commission, NIS2 Directive: securing network and information systems, July 2, 2026, https://digital-strategy.ec.europa.eu/en/policies/nis2-directive
- EUR-Lex, Directive (EU) 2022/2555 (NIS 2 Directive), December 14, 2022, https://eur-lex.europa.eu/eli/dir/2022/2555
- European Commission, SME definition, accessed October 15, 2026, https://single-market-economy.ec.europa.eu/smes/sme-fundamentals/sme-definition_en
- AppViewX, Code Signing in DevOps, accessed October 15, 2026, https://www.appviewx.com/education-center/code-signing-in-devops/
- EUR-Lex, Commission Implementing Regulation (EU) 2024/2690, October 17, 2024, https://eur-lex.europa.eu/eli/reg_impl/2024/2690/oj
- ENISA, NIS2 Technical Implementation Guidance, June 26, 2025, https://www.enisa.europa.eu/publications/NIS2-technical-implementation-guidance
- ENISA, What’s Driving Cybersecurity Investments and where lie the challenges?, December 8, 2025, https://www.enisa.europa.eu/news/whats-driving-cybersecurity-investments-and-where-lie-the-challenges
- CA/Browser Forum, Baseline Requirements for the Issuance and Management of Publicly-Trusted Code Signing Certificates, accessed October 15, 2026, https://cabforum.org/working-groups/code-signing/requirements/
- AppViewX, Stronger Private Key Protection For Code Signing: Are You Compliant With The Latest CA/B Forum Requirements?, June 12, 2024, https://www.appviewx.com/blogs/stronger-private-key-protection-for-code-signing-are-you-compliant-with-the-latest-ca-b-forum-requirements/
- European Commission, A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography, June 23, 2025, https://digital-strategy.ec.europa.eu/en/library/coordinated-implementation-roadmap-transition-post-quantum-cryptography
- AppViewX, Crypto-Agility and Post-Quantum Cryptography Readiness, July 7, 2026, https://www.appviewx.com/solutions/crypto-agility-and-post-quantum-cryptography-readiness/
- AppViewX, The EU Just Released a New Post-Quantum Cryptography (PQC) Roadmap: Here’s What You Need to Know, July 2, 2025, https://www.appviewx.com/blogs/the-eu-just-released-a-new-post-quantum-cryptography-pqc-roadmap-heres-what-you-need-to-know/
- AppViewX, Code Signing, October 13, 2026, https://www.appviewx.com/products/code-signing/
- European Commission, Commission publishes new guidance to support businesses’ implementation of the Cyber Resilience Act, July 27, 2026, https://digital-strategy.ec.europa.eu/en/news/commission-publishes-new-guidance-support-businesses-implementation-cyber-resilience-act
- EUR-Lex, Regulation (EU) 2022/2554 (Digital Operational Resilience Act), December 14, 2022, https://eur-lex.europa.eu/eli/reg/2022/2554/oj
- AppViewX, What is the Cyber Resilience Act?, September 4, 2026, https://www.appviewx.com/blogs/what-is-the-cyber-resilience-act/
- EUR-Lex, Commission Delegated Regulation (EU) 2024/1774, March 13, 2024, https://eur-lex.europa.eu/eli/reg_del/2024/1774/oj
- AppViewX, Certificate Discovery, April 9, 2024, https://www.appviewx.com/education-center/what-is-certificate-discovery/
- AppViewX, The Importance of Code Signing Best Practices in the Software Development Lifecycle, March 19, 2025, https://www.appviewx.com/blogs/the-importance-of-code-signing-best-practices-in-the-software-development-lifecycle/
- AppViewX, The NIS2 Compliance Deadline Is Nearing. Are You Prepared?, May 7, 2024, https://www.appviewx.com/blogs/the-nis2-compliance-deadline-is-nearing-are-you-prepared/
- AppViewX, Machine Identity Management, April 13, 2026, https://www.appviewx.com/education-center/machine-identity-management/
- AppViewX, Post-quantum code signing guide, October 21, 2026, https://www.appviewx.com/blogs/post-quantum-code-signing-guide/
- AppViewX, Request a Demo, June 17, 2026, https://www.appviewx.com/live-demo/
- European Parliament, Procedure file 2026/0012(COD), accessed October 15, 2026, https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2026%2F0012%28COD%29
Tags
About the Author
