In a nutshell: NIS2 requires automotive manufacturers and their suppliers to implement risk management and reporting obligations along with personal management board liability, while corporate group structures raise additional delineation questions.
The law firm Noerr points to the particular challenges of NIS2 implementation for companies in the automotive industry. Both manufacturers and suppliers are affected, and must grapple with new reporting, documentation and liability obligations.
The EU NIS2 Directive significantly expands the range of companies subject to cybersecurity obligations, thereby also covering large parts of the automotive industry. According to Noerr’s assessment, this affects not only vehicle manufacturers themselves but also numerous suppliers along the value chain, provided they meet the thresholds regarding size and revenue or are classified as critical to supply security.
For the compliance function within affected companies, this results in several concrete obligations: implementing risk management measures for IT security, introducing reporting processes for security incidents within tight statutory deadlines, and registering with the competent national authorities. Particular emphasis is placed on the personal liability of management, which is held responsible for implementing and monitoring security measures. Violations can result in significant fines as well as civil liability risks.
An additional layer of complexity for corporate group structures lies in the question of which group companies each independently qualify as entities obligated under NIS2, and how group-wide security standards are to be reconciled with local implementation obligations in the individual member states, since the national transposition of the directive varies in progress across EU states. Compliance officers in the automotive industry are therefore advised to conduct an early assessment of which individual companies are affected, clarify responsibilities within the supply chain, and align internal reporting channels with the respective deadlines set by the competent supervisory authorities.
Source: news.google.com · Published August 4, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.