NIS2 · DIRECTIVE (EU) 2022/2555
NIS2 is the EU cybersecurity directive, applied through national laws in Czechia since 1 November 2025 and in Germany since 6 December 2025. A free assessment tells you whether and how it applies, with obligations and deadlines; implementation starts at €3,900 excl. VAT.
Quick and free:NIS2 applicability checkThe obligations already apply. National laws in Germany and Czechia are in force and their registration deadlines have passed. Late registration is still better than none.
ReferencesT-Systems · Olingo Medical · Rowan Legal
Leave your number, I'll call you
Krystof Olik · founder and CEO
Same working day (CET), otherwise the next working morning.
We are engineers: we document the measures and set them up with your IT.
NIS2 (Directive (EU) 2022/2555) is the EU cybersecurity directive; Germany implements it in the BSIG, Czechia in Act No. 264/2025 Coll. It applies to you if you operate in one of its 18 sectors and are at least a medium-sized enterprise, or provide a service covered regardless of size.
Essential entities are generally large companies in the high-criticality sectors; important entities are the other covered medium and large companies.
Cybersecurity risk management owned by management, and the ability to report incidents on time.
OFFER
Step 1 · Start here
You know whether and how NIS2 applies and what lies ahead.
Free
What you get
Step 2
Documentation and measures plan finished within 90 days of receiving your input; we handle registration and set up the technical measures with your IT.
from €3,900excl. VAT, one-off
What you get
Step 3
Measures stay valid as your IT and the rules change.
from €390 per monthexcl. VAT
What you get
GUARANTEE
If documentation and the measures plan are not finished 90 days after we receive your input, we keep working at no extra cost until they are. Technical setup also depends on your IT, so the deadline covers our part. The deadline guarantee applies to the "NIS2 implemented in 90 days" package.
Leave your number, I'll call you
Krystof Olik · founder and CEO
Same working day (CET), otherwise the next working morning.
PROCESS
Sector, size, services. No access to your systems.
In writing: entity class, obligations, deadlines and a fixed price.
Systems review, documentation and technical measures, weekly status.
Quarterly review, updates, incident support.
REFERENCES
Compliance platform for the Cyber Resilience Act: requirement mapping, repository checks, vulnerability monitoring.
More than 10 hospitals and clinics use our clinical documentation AI; in two university hospitals it runs entirely inside their network. Hospitals are regulated entities themselves.
Case studyOur partner law firm for the CRA and NIS2: it validates our work and prepares the contracts. We also built AI for the firm that runs on its own servers, with no external APIs.
rowan.legalCONTACT
We talk briefly about your company and services and send your entity class, obligations, deadlines and a quote for implementation in writing within 48 hours. Free, no commitment.
Leave your number, I'll call you
Krystof Olik · founder and CEO
Same working day (CET), otherwise the next working morning.
FAQ
We build on your information security management system. During implementation we compare your existing measures with the national requirements and add only what is missing. Existing documentation is extended, not rewritten.
No. A call about your sector, size and services is enough. We review systems and infrastructure only in the paid implementation, with the access you give us.
The initial assessment is free. Implementation, including the detailed systems review, starts at €3,900 excl. VAT, depending on the number of services and the state of your IT. You get a fixed-price quote in writing with the assessment.
No. We are engineers who implement measures and documentation. Legal validation and contracts come from the lawyers of our partner firm Rowan Legal; we also work with your own auditor or lawyer.
Under Art. 23 NIS2: early warning within 24 hours of becoming aware of a significant incident, notification within 72 hours, final report within one month of the notification.
MORE SERVICES
