NIS2: Your Calibration Records Are Now In Scope

Someone in your IT or security function has spent the last year on NIS2 — the risk assessments, the incident-response runbook, the board sign-off. You, on the quality side, filed it under "not my directive." Calibration is metrology; NIS2 is firewalls. Two different worlds. That assumption is the one worth checking before your next audit, because the directive does not draw the line where most quality teams assume it does. Your calibration and quality records live on network and information systems, and if your plant is an in-scope entity, those systems — and the data inside them — are squarely within what NIS2 asks you to secure.

This is not a theoretical horizon anymore. The NIS2 Directive’s transposition deadline was 17 October 2024; by mid-2026, 23 of 27 member states report full transposition, and on 8 July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for failing to notify complete transposition, asking for lump-sum and daily financial penalties. For a manufacturer in Iberia or DACH, the headline is not Brussels — it is that enforcement has moved into the hands of your national regulator, and an estimated 160,000-plus entities across the Union now sit inside the regime.

Why calibration data is in scope at all

NIS2 does not classify data by sensitivity the way GDPR does. It does not ask whether a calibration certificate is "personal" or "confidential." It asks a blunter question: are you an essential or important entity, and if so, have you secured the network and information systems you depend on? Manufacturing sits explicitly in the directive’s list of important sectors — the manufacture of medical devices, computers and electronics, electrical equipment, machinery, motor vehicles and other transport equipment. If your company clears the size threshold — broadly, 50 or more staff or €10 million-plus turnover — you are almost certainly in.

Once you are in, the obligations attach to your systems, not to a curated subset of "critical" files. Your calibration platform holds the evidence that your measurement processes are under control. It records who performed a calibration, the as-found and as-left results, the pass/fail decision, the certificate, the instrument’s custody history. Article 21 of the directive spells out the risk-management measures that must protect systems like that one: access control, incident handling, business continuity, supply-chain security, cryptography, and multi-factor authentication among them. None of those clauses contain an exemption for the quality department.

The supplier question you will be asked

There is a second, sharper edge. Article 21 requires you to manage the security of your supply chain — including your direct software suppliers. Your calibration SaaS vendor is one of them. That turns a procurement decision into a compliance artefact: you now have to be able to state where your calibration records are hosted, who at the vendor can reach them, how access is controlled, and how quickly you would learn if something went wrong.

Article 23 sharpens it further. An in-scope entity must issue an early warning of a significant incident within 24 hours, a fuller notification within 72 hours, and a final report within a month. Run that clock against a calibration tool hosted in a US region, administered from a timezone six to nine hours behind you, with support that answers overnight. If an incident touches the system holding your quality evidence, the 72-hour window is not generous — and "we are waiting to hear back from the vendor" is not a sentence that fits inside it. Add Article 20, which makes management bodies personally accountable for approving and overseeing these measures, and the exposure stops being abstract.

The objection: "calibration data isn’t critical infrastructure"

The reasonable pushback is that a micrometer’s calibration history is hardly the power grid. True — but NIS2 does not scope by drama. It scopes by entity and by system. If you are an important entity, the directive expects a coherent security posture across the information systems that run your operation, and your quality system is one of them. Regulators assessing risk-management measures will look for the ordinary controls: is access role-based and least-privilege, is there an audit trail that cannot be quietly edited, is the data recoverable, do you know where it physically resides. A calibration platform that cannot answer those is a gap in the very estate you are being asked to defend — not because the records are secret, but because they sit on systems you are now obliged to secure.

What "in scope" looks like when the tooling holds

This is where an EU-native calibration system earns its place. PrüfMittel keeps calibration and quality records resident in the EU, which answers the data-location question before it is asked. Access is role-based, so a technician logging an as-left result and a manager approving a check-out see and do only what their role permits — that is Article 21 access control expressed in the product. Every pass/fail decision, allocation and location change is captured in a full possession and activity audit trail, so "who did what, and when" is a record you can produce rather than reconstruct — the raw material of a credible incident report inside the 72-hour window. And because overdue blocking keeps an instrument from being used past its calibration due date, the evidence you are defending stays current instead of quietly lapsing.

The takeaway

Treat your calibration platform as part of your NIS2-in-scope IT estate, because your regulator now will. Before your next surveillance audit — or the first inquiry from a national authority — confirm three things about the system holding your quality evidence: that its data lives in the EU, that access and change history are controlled and immutable, and that you could actually report an incident within the directive’s clock without waiting on a vendor an ocean away. Those are not features to admire; they are obligations to meet, and they are exactly the ground PrüfMittel was built to hold.