Since NIS2 came into force, essential and important entities have been obliged to report significant incidents within 24 hours. What the text does not say is whether they must disclose a ransom payment. The 2022 Directive is silent on this point. The amendment proposal published by the European Commission on 20 January 2026 closes that gap.
What NIS2 says today, and what the amendment changes
The current NIS2 Directive requires reporting any incident with a significant impact. It sets out the deadlines, the recipients and the minimum content of these notifications. It does not ask whether you have paid a ransom. This silence was deliberate: the negotiators preferred not to fix a position on a subject on which Member States still diverge.
The Commission's proposal of 20 January 2026 fills this gap. For ransomware attacks qualified as significant, entities will now have to include the following in their incident report: confirmation that a ransomware attack has been detected, the attack vector used, and the mitigation measures put in place. And, if a ransom was demanded, whether a payment was made, its amount and the method of settlement.
On the explicit request of the competent authority, the entity will also have to identify the recipient of the payment. This wording matters. Spontaneous disclosure covers the fact of the payment and its amount. Identification of the beneficiary wallet or account applies only if the authority formally requests it.
What this means concretely for your decision-making process
Until now, the decision to pay a ransom has been treated in most organisations as an internal decision, arbitrated between the executive board, the legal department and the CISO. Business continuity on one side, the risk of repeat attacks and ethical considerations on the other. Regulation rarely featured in this discussion beyond the prohibition on paying sanctioned entities under OFAC or European equivalents.
The amendment adds a dimension that many teams have not yet integrated: the payment becomes regulated information. If you pay, you will have to declare it to the national NIS2 supervisory authorities. This information will feed into a coordinated collection framework between ENISA and Europol, whose mandate is to improve statistical knowledge of the ransomware phenomenon in Europe.
According to Coveware data published in the first quarter of 2026, 46% of organisations hit by ransomware in Europe paid at least once between 2023 and 2025. The median payment stood at EUR 480,000 for mid-sized entities. These figures currently feed the analyses of ENISA teams. Tomorrow, they will be produced, at least in part, by the declarations that entities subject to NIS2 will be obliged to submit.
The particular case of insurance contracts
Cyber insurance policies often contain confidentiality clauses around ransom payments. Some insurers contractually require that the fact of a payment not be disclosed, for reasons linked to reinsurance and to countering serial fraudulent claims. These clauses may come into direct tension with the emerging regulatory disclosure obligation.
This potential conflict is documented in the observations submitted to the European Parliament in March 2026 by several European insurance federations. The legislative discussions have not yet settled the point. But the risk is real: an organisation that honours its insurance clause by keeping the payment confidential could simultaneously fail its NIS2 reporting obligation. The hierarchy of norms argues for the primacy of European law over the contractual clause, but this reasoning will need to be validated by your legal department.
For existing incident notification procedures and the operational pitfalls of NIS2 deadlines, see the article on the 5 pitfalls of NIS2 24-hour incident notification: the tensions described here add to those that article documents.
The negotiation timetable
The proposal of 20 January 2026 has entered the ordinary legislative procedure. Negotiations between the European Parliament and the Council are expected to run until the second half of 2027. After adoption, Member States will have a transposition period of twelve months. In practice, the new obligations would take effect in most Member States between late 2027 and early 2028.
This timetable may suggest the subject can wait. That would be a timing mistake. First, some national supervisory authorities already question entities on their ransomware practices as part of routine inspections, without waiting for legislative formalisation. Second, internal governance processes around the decision to pay take time to stabilise: they involve the executive board, legal, the insurer and the CISO. Building them in an emergency during an incident is a bad idea.
Three adjustments to make now
First adjustment: formalise the decision to pay as a documented governance moment. Who can authorise a payment? Under which process? With what traceability? These answers must exist in writing before an incident, not be improvised under pressure.
Second adjustment: review your cyber insurance contracts to identify confidentiality clauses on ransom payments. Assess with your legal department whether these clauses would survive a disclosure request from the NIS2 authority of your Member State. Anticipate a possible amendment.
Third adjustment: update your incident response plans to explicitly include the ransomware scenario with payment. The plan must describe who notifies the competent authority, within what deadline, with which elements, and who keeps the record of exchanges with the insurer. These are not details: they are the evidence you will produce if the authority opens an investigation.
What does not change
The amendment does not create a prohibition on paying. No European provision does so at this stage, even though some Member States are discussing it. It creates an obligation of transparency towards the authorities. This transparency is the price of the decision: if you pay, you bear it within the regulatory framework. If you do not pay, you have nothing to disclose on this point.
The underlying measure remains what it has always been: reduce the likelihood of becoming a ransomware victim, and reduce the impact if you do. Tested backups, network segmentation, privilege management and early detection remain the only means of not being placed before the choice of paying. The NIS2 amendment does not change the answer to this question. It only complicates its consequences.