No, an NIS2 certificate does not exist. There is no body — no certification authority, no supervisory authority, no industry association — that issues a mark of approval or certificate by which a company can demonstrate that it is "NIS2-certified". Anyone offering or selling such a certificate is selling something that does not actually exist within the framework of the Directive.
This is no minor distinction. NIS2 is a Directive that Member States transpose into national legislation, containing an obligation to put in place appropriate technical and organisational measures to manage risks to networks and information systems. Supervisory authorities check whether an organisation meets that obligation, not whether there is a certificate on the wall. There is therefore no examination, no mark of approval and no stamp that the law itself prescribes or recognises.
Why the question keeps coming up
The confusion is understandable. With other regulations — think of certain quality standards in construction or food safety — there is indeed a certification process with an independent auditor and a valid certificate. Providers wanting to make commercial gain from uncertainty around NIS2 play on this: they suggest that a comparable process exists, with an audit, a report and a nice document at the end. It sounds reassuring, especially for a director or office manager who has just heard that something is "coming" and is looking for a quick checklist.
The problem is that such a certificate, however convincing it looks, has no legal status under the Directive or its national transposition. A supervisory authority does not ask for a certificate; it looks at the measures themselves, how they are documented and who is responsible for them.
What does exist: recognised standards, not an NIS2 stamp
There are internationally recognised standards for information security, with a certification process through an accredited body. Such a certificate demonstrates that an information security management system has been set up and is regularly audited. This is valuable and can ease the conversation with a supervisory authority or a customer, because it provides structure and evidence. But it is a different framework, with its own scope and its own auditor, and it does not automatically cover every measure that the obligation to put in place appropriate measures expects. For those who want to fully understand this distinction, the comparison can be found in the overview of topics per situation.
What a supervisory authority or customer actually expects
Rather than a certificate, the obligation to put in place appropriate measures requires demonstrability: can the organisation show which measures have been taken, who is responsible for them and what evidence goes with them. This is less a mark of approval and more a living register — a file that moves with the organisation, with a status and an owner for each measure. For those who do not yet know whether this is relevant for their own organisation, the first step is usually simple: look at sector, size and role in the supply chain. This can be done free of charge and without an account via a few questions that immediately give an indication.
Towards customers who send a security questionnaire, a certificate is also not the shortest route. Customers typically want to see concrete answers: which measures are in place, how are they allocated, what happens in the event of an incident. A certificate can help, but it does not replace the underlying evidence.
If a supplier nevertheless offers an "NIS2 certificate"
If a certification program is offered specifically under the name NIS2, it is wise to look critically at who issues it and on what basis. Ask about the accreditation, the precise scope, and what the certificate does and does not cover. An audit, a penetration test, or a certification against a recognized standard is specialist work — this is distinctly different from preparing policies, records and questionnaires. How such preparation looks and where the sources used come from is explained on the page on how the information is structured.
For your own situation, and for the question of whether an offered certificate aligns with what the law in your country specifically requires, a lawyer or the competent supervisory authority remains the right point of contact. If you are uncertain whether a certificate, a standard or a questionnaire is relevant to your organization, then the overview of frequently asked questions often already provides a first answer.
Do you want to know exactly where your organization stands, without sales talk about certificates that do not exist? Take the free NIS2 check or browse through the knowledge base — both are accessible without an account.