New rules on cyber risk management across the European Union put executives firmly in the crosshairs for noncompliance and are likely to apply to a wider range of organizations than many business leaders may initially think. However, there are also concerns that the rules may become muddled as different countries interpret them and enforce them in different ways.

The EU’s Network and Information Security Directive (NIS2) requires operators of critical infrastructure and essential services–including those in energy and water, transport, banking and financial market infrastructures, healthcare, and digital infrastructure–to implement appropriate cybersecurity measures and report any incidents to the relevant authorities. The directive is not just about organizations ensuring their own security and resilience are adequate–but also those of suppliers.

Experts believe the new rules will become the de facto standard for flagging cyber threats in much the same way as the EU’s General Data Protection Regulation (GDPR) are the benchmark for data privacy around the world.