NIS2’s extended scope takes a deep dive: Unpacking the EU Commission’s proposed expansion to Submarine Data Transmission Infrastructure

2026-02-24 · Source: Technology's Legal Edge · Field: Technology & Digital — Cybersecurity & Data Privacy, Cloud Computing & IT Infrastructure · Depth: Intermediate, quick

Summary

The EU's NIS2 Directive, a key cybersecurity regulation, is expanding its scope, contrary to hopes for regulatory simplification. The European Commission has proposed extending NIS2 to include Submarine Data Transmission Infrastructure, specifically targeting operators of submarine cables and associated landing stations. This expansion aims to enhance the resilience and security of critical digital infrastructure, recognizing the vital role these cables play in global data transmission. The proposal underscores a continued focus on strengthening cybersecurity across essential services within the EU, potentially increasing compliance obligations for entities involved in this sector.

Key takeaway

For CTOs and VPs of Engineering overseeing critical infrastructure, particularly those with operations involving submarine data transmission, you should immediately assess your organization's exposure to the proposed NIS2 expansion. Understand the new compliance obligations for submarine cables and landing stations to ensure your cybersecurity frameworks are robust and aligned with the evolving regulatory landscape, mitigating potential risks and penalties.

Key insights

NIS2's proposed expansion to submarine data transmission infrastructure aims to bolster critical digital infrastructure cybersecurity.

Principles

• Cybersecurity scope is expanding, not simplifying.
• Critical infrastructure includes submarine data cables.

In practice

• Assess current cybersecurity posture against NIS2.
• Identify assets related to submarine data transmission.

Topics

• NIS2 Directive
• EU Cybersecurity
• Submarine Data Infrastructure
• Regulatory Compliance

Best for: CTO, VP of Engineering/Data, Executive, Security Engineer, Policy Maker, Legal Professional

Related on AIssential

• From Zero Trust to the UN: The Cybersecurity Policy Trends Shaping International Relations — Zero Trust is now a national security doctrine and international relations operating philosophy, driven by persistent state-sponsored cyber threats.
• Dragos acquires Phosphorus to expand xOT device security — Dragos's acquisition of Phosphorus extends OT security to "xOT," securing critical infrastructure's invisible connected devices.
• Brace for the patch tsunami: AI is unearthing decades of buried code debt — AI-driven vulnerability discovery will expose decades of technical debt, necessitating a rapid, large-scale patching response.
• Cyber Resilience Act: the fine line between SaaS and digital products — The CRA distinguishes between software as a product and SaaS based on market presentation and essentiality to core product functionality.
• Data leaks are finally on the radar of politicians. — France's recurring data breaches highlight a critical technical command deficit within the State's digital infrastructure.
• And once militaries and security services run on the cloud—once policing runs on platform data, sensors, and “AI”—the cloud, the platform, and the supply chain stop being neutral. — Silicon Valley's infrastructure, once neutral, is now strategic terrain, making it a target in both interstate conflict and domestic legitimacy struggles.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Technology's Legal Edge.