NIS2 requirements: how to document the training

Since July 1, 2025, management in companies covered by NIS2 must take courses in cybersecurity. Employees must be trained too. And all of it must be documentable.

Many have not noticed yet. By the October 1, 2025 deadline, only 1,889 organizations had registered. If an inspection comes, the question is not whether you held a course. It is whether you can show who attended, what they learned, and when.

Here are the three training requirements and a four-step plan for documenting them.

Status as of September 24, 2026.

1. Management must take courses. Under section 7(2) of the Danish NIS2 Act, members of management must participate in relevant cybersecurity courses. Not everyone needs the same course. But management as a whole must be able to assess risks and make decisions.
2. Employees must be trained. Management must encourage that other employees are offered similar courses. Basic cyber hygiene and cybersecurity training is also one of the measures you must have in place (section 6(1), no. 7).
3. It must be documentable. The Danish Agency for Societal Security (Styrelsen for Samfundssikkerhed) mentions course certificates or a confirmation of participation.

The law does not say how often you must train. But knowledge about threats ages quickly. A fixed rhythm is the safe choice.

NIS2 applies to selected sectors, such as energy, transport, health, water, food, waste, manufacturing, and digital services. As a general rule, the company must also have at least 50 employees or revenue and a balance sheet above 10 million euros.

No authority will tell you whether you are covered. You must assess it yourselves and register.

If you supply a company covered by NIS2, you become part of its risk. That means contract requirements, questionnaires, and audits. Then it helps to answer yes to two questions: Are your employees trained in cybersecurity? And can you show it?

According to DI (the Confederation of Danish Industry), fines can reach 10 million euros or 2 percent of global revenue. The higher amount applies.

Management can also be held accountable. Ultimately, a director can receive a temporary ban on holding management positions. That only happens if other measures fail, and only in private companies.

1. Write a training policy. Who should learn what, and how often? Management, IT, and the other employees have different needs.
2. Train management first. Choose a course in managing cyber risks, and save the certificate for each member.
3. Train everyone in cyber hygiene. Phishing, passwords, updates, and what to do in an incident. Short courses with a quiz are easy to complete and easy to document.
4. Repeat and follow up. Let the certificate expire after a year, and send a reminder well in advance. That keeps the documentation always up to date.

In Skillflow, you build your own cyber hygiene course, including with help from AI. You assign it to the right groups, and each employee receives a certificate when the course is passed. When expiry approaches, a reminder goes out. And you can always see who is missing.

If the authorities or a customer asks, you have the answer ready: who, what, and when.

• The Danish NIS 2 Act, Act no. 434 of May 6, 2025 (Retsinformation)
• The Danish Agency for Societal Security: The role and tasks of management (guidance, May 2025)
• KL (Local Government Denmark): The NIS2 Act and guidance
• PwC: When is an organization covered by the NIS2 Act?
• DI (the Confederation of Danish Industry): The NIS2 guide
• Grant Thornton: The NIS2 Act and the supplier chain