How Often Must NIS2 Training Run? ‘Annually’ Appears 3 Times in the CIR — None of Them About Training

Short answer: no EU text requires NIS2 training once a year. The Directive asks for training without an interval. The Implementing Regulation asks for awareness activities that are “repeated”, training that is “regular” and a programme “run periodically”. The phrase “at least annually” appears three times in that Regulation, and all three cover reviews of policies, risks and role assignments. None of them is about training. The yearly figure most compliance pages quote comes from ENISA’s guidance, and it refers to reviewing your training programme, not to how often staff sit through it.

That leaves the interval to you. Once you write an interval into your policy, though, auditors will measure you against it. And the research on how fast awareness fades suggests that a single annual session is a weak interval to choose.

Which Text Sets Your Training Clock?

Before you pick an interval, work out which layer of law binds you. Three layers can apply, and only one of them is detailed.

Layer	Who it binds	What it says about timing
NIS2 Directive, Articles 20(2) and 21(2)(g)	All essential and important entities, via national law	Management bodies “are required to follow training”. Entities are encouraged to train employees “on a regular basis”. No interval.
Implementing Regulation (EU) 2024/2690, Annex section 8	Eleven provider types only: DNS, TLD registries, cloud, data centres, CDNs, MSPs, MSSPs, online marketplaces, search engines, social networks, trust service providers	“Repeated”, “planned intervals”, “regular”, “periodically”. No number.
National transposition law	Entities in that member state	Varies. Germany’s BSIG § 38(3) requires management to train “regelmäßig” (regularly).

If you are a manufacturer, hospital or utility, the Regulation’s Annex does not bind you directly. National authorities and auditors still read it as the most detailed statement of what Article 21(2)(g) means, so it is the benchmark you will usually be measured against. For the full list of what the training obligation covers, see our guide to NIS2 training requirements. For the hygiene practices the awareness programme has to teach, and the Annex point behind each one, see the NIS2 cyber hygiene map.

What the Implementing Regulation Actually Says About Timing

We ran a word count over the official English text of Implementing Regulation (EU) 2024/2690. “At planned intervals” appears 30 times. “Periodically” appears once, in the training section. “At least annually” appears three times, and here is where.

Annex point	What it covers	Timing wording (verbatim)
8.1.2(a)	Awareness programme for all employees, including management bodies	“scheduled over time, so that the activities are repeated and cover new employees”
8.1.3	Updating the awareness programme	“updated and offered at planned intervals taking into account changes in cyber hygiene practices, and the current threat landscape”
8.2.1	Staff in roles needing security skills	“ensure that they receive regular training”
8.2.4	Staff moving into such roles	Event-driven: on transfer to the new position or role
8.2.5	The role-based training programme	“updated and run periodically taking into account … known cyber threats and technological developments”
1.1.2	Network and information security policy	Reviewed by management bodies “at least annually”
2.1.4	Risk assessment results and risk treatment plan	“at planned intervals and at least annually”
10.1.3	Assignment of personnel to security roles	“at planned intervals and at least annually”

The drafters used “at least annually” three times for governance reviews and left it out of every training clause. Our reading is that this was deliberate. Article 2(2) of the Regulation tells entities to scale measures to their “exposure to risks, their size and the likelihood of occurrence of incidents and their severity”. A fixed training calendar would cut across that, because a 40-person MSP and a hyperscaler don’t face the same threat churn.

Two parts of the training wording do bind you without any hedge. Under 8.1.2(a), the awareness programme has to repeat and has to reach new joiners, so a one-off rollout fails. Under 8.2.3, the effectiveness of role-based training “shall be assessed”. The awareness programme gets the softer test in 8.1.3: it is tested for effectiveness only “where appropriate”. That asymmetry matters for cadence, as the evidence section below shows.

Where “Annual Training” Comes From

If the law doesn’t say annual, why does nearly every compliance page? Most of it traces back to three guidance documents. In each one, the annual figure is attached to something other than delivering training.

Source	Binding?	What it makes annual	What it says about delivery
ENISA Technical Implementation Guidance (June 2025), under 8.1.3 and 8.2.5	No	“Review and update the awareness-raising programme at least annually”; “Review and update the training programme at least annually”	“Offer cybersecurity awareness raising programmes periodically”; “Provide cybersecurity training periodically”
BSI (Germany), NIS-2 training info pack	No	“Annual information on current developments”, on top of induction training	Induction training, plus posters or campaigns as reminders
Ireland NCSC draft guidance (June 2025)	No (draft)	Staff acknowledge policies “when first hired, contracted, annually, or whenever a policy is updated”	Board training “should be repeated as necessary”

The ENISA Technical Implementation Guidance is the main source of the confusion. Under both training points, the same block of guidance says two different things: deliver training periodically, and review the programme at least annually. Somewhere along the way, people merged the two into “train everyone once a year”. The guidance is also non-binding. ENISA presents it as its own view of how to implement the Regulation.

Germany’s BSI training info pack comes closest to an annual delivery figure. It calls it “advisable” (zweckmäßig) to train new staff at induction and add yearly information on current developments. That is a recommendation, and it describes a short update rather than a full course. The Irish NCSC’s draft risk-management guidance never uses “at least annually” for anything. Its one “annually” covers policy acknowledgements, not training.

The Management-Body Clock Runs Separately

Board training has its own legal basis, and some member states give it a number. In Article 20(2) of the Directive, members of management bodies “are required to follow training”. The words “on a regular basis” sit in the next clause, which is about offering similar training to employees. So the Directive makes board training mandatory but sets no interval for it.

Germany filled that gap. BSIG § 38(3) requires management to take part in training “regelmäßig”. The explanatory memorandum to the government bill (Bundestag printed paper 21/1501, 8 September 2025) then says training counts as “regular” if it is offered “at least every 3 years”. An explanatory memorandum guides interpretation but isn’t statute. The BSI’s own management training handout (version 1.0, 17 April 2026) says the BSIG sets no concrete interval beyond “regularly”. It recommends a thorough initial course followed by regular follow-ups, sized to the entity’s risk exposure. It also lists the events that should prompt a new session:

• a change in management
• significant changes to business processes
• significant changes in risk exposure
• significant changes to the risk-management measures in place or planned

For boards, then, annual training sits well above the only national floor we found in a published legislative document. Many boards will still pick a yearly cycle, because it lines up with the annual policy review in point 1.1.2, which management bodies have to carry out themselves anyway. Our guide to Article 20(2) board training covers content and documentation.

Is Once a Year Enough? What the Decay Research Shows

Legally, an annual cycle is defensible if you can justify it. As a way to change behaviour, it is weak, and the two best-known field studies show why.

Reinheimer and colleagues (SOUPS 2020) tracked 409 employees of a German public administration after an awareness programme. Their phishing detection was better straight after the training and still better at four months. By six months the gain had gone. The authors recommend reminding users after about half a year. Video and interactive reminders worked best, and their effect lasted at least another six months.

A larger study at UC San Diego Health followed more than 19,500 employees in an eight-month randomised experiment. As UC San Diego reported, it found “no significant relationship” between recently completing annual, mandated training and falling for phishing.

This is where the 8.2.3 asymmetry matters. If you have to assess whether role-based training works, and your own quiz or incident data shows knowledge fading after four to six months, an annual interval becomes hard to defend in your next programme review. You don’t need longer sessions. Short, frequent reminders between full sessions are what the evidence supports. One caveat: both studies looked at phishing in a single organisation each. They don’t measure secure-configuration or incident-handling skills, so treat the six-month figure as a good starting assumption rather than a law of nature.

How to Set a Defensible Training Cadence

Because the Regulation says “planned intervals”, you choose the interval, and from then on it binds you. In practice, an auditor checks you against the interval you wrote down. A policy that promises quarterly refreshers, followed by nine months of silence, is a finding against your own document even though the law never required quarterly. So set intervals you will actually keep, and record why you chose them. The training policy template shows where the frequency field and its rationale go.

The table below is a starting point we’d suggest, not a legal requirement. The intervals are practitioner suggestions based on the decay research above. The legal hooks and triggers come from the Annex.

Audience	Legal hook	Event triggers	Suggested interval (practitioner, not law)	Evidence to keep
All staff (awareness)	8.1.2(a), 8.1.3	New threat pattern, policy change, incident lessons	Short reminder every 4–6 months; full session yearly	Schedule, completion logs, quiz results
New joiners	8.1.2(a) “cover new employees”	Start date	Before or soon after first system access	Dated induction record
Security-relevant roles (admins, developers, SOC)	8.2.1, 8.2.3, 8.2.5	New technology deployed, new threat briefing	Role course yearly, threat briefings as threats change	Role list, training-needs matrix, assessment results
Staff changing roles	8.2.4	Transfer date	At transfer, before new access is granted	Transfer training log
Management body	Art. 20(2); national law (e.g. BSIG § 38(3))	Change in management, significant risk change	Yearly is common; the German memorandum’s floor is every 3 years	Personal, dated records per member
Direct suppliers and service providers	8.1.2 “where appropriate”, 5.1.4(b)	Contract start or renewal	Set in the contract clause	Contract clause, supplier attestations

Two scheduling choices make the evidence easier to defend.

Review the programme in the same month as the policy. Points 8.1.2(b) and 8.2.2 require training to be “in line with” the network and information security policy, which management reviews at least annually under 1.1.2. If you review the training programme in the same cycle, policy changes reach the syllabus at the same time.

Rerun the role list when you review role assignments. Point 10.1.3’s annual review of who holds which security role is a good moment to refresh the 8.2.1 list of people who need role-based training. Strictly, 10.1.3 covers the roles defined under point 1.2, so this pairing is a practical choice, not a legal link. To see how these fixed review dates fit with the other 38 open-ended ones in the Annex, read our guide to the continuous improvement programme.

What this means for your role:

• CISO or IT security lead: the unhedged 8.2.3 effectiveness test applies to your admins and developers. Plan briefings that react to threats, and keep assessment results as well as attendance.
• Compliance officer: replace “annual training” in your policies with “at planned intervals of [X], plus event triggers [list]”. Cite ENISA’s yearly figure as a programme review, not as a legal training rule.
• SME owner outside the eleven CIR provider types: your duty comes from Article 21(2)(g) through national law. Check that law first. If it is silent, a documented, risk-based cadence is enough.
• Board members: your training is personal and mandatory under Article 20(2). Keep individual dated records. A change in board membership should prompt training for the new member.

To check the rest of the programme against what auditors ask for, use the training audit checklist. If you’re comparing a platform against a policy-led approach, see which of the 13 training requirements a platform export can prove.

Frequently Asked Questions

Does NIS2 require annual security awareness training?

No. Neither the Directive nor Implementing Regulation 2024/2690 sets an annual interval for training. The Regulation requires awareness activities that repeat and reach new joiners (8.1.2(a)), plus “regular” role-based training (8.2.1). The only “at least annually” duties cover policy, risk and role-assignment reviews (1.1.2, 2.1.4, 10.1.3).

Where does the “at least annually” figure for training come from?

Mostly from ENISA’s June 2025 guidance, which recommends reviewing and updating the training programme at least annually. The same guidance says to deliver training “periodically”. It is non-binding.

How often must board members be trained under NIS2?

The Directive sets no interval. Germany’s BSIG requires management training “regularly”, and the government’s explanatory memorandum reads that as at least every three years. Other member states may differ, so check your national law.

Is quarterly phishing simulation required?

No EU text names phishing simulations or a simulation frequency. They can provide effectiveness evidence, but your interval should come from your risk assessment and from your own data on how quickly results fade.

This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.

How This Guide Was Verified

We counted timing phrases in the official English EUR-Lex text of Implementing Regulation 2024/2690 and read Article 20 of the Directive in full. ENISA’s wording was checked against pages 111–115 of the June 2025 PDF. The German bill text and the BSI handout were read in the original German on 9 October 2026, and the translations here are ours. Where a recommendation rests on practitioner judgement rather than binding text, the article says so.

Sources

1. Commission Implementing Regulation (EU) 2024/2690, Articles 1–2 and Annex points 1.1.2, 2.1.4, 5.1.4, 8.1.1–8.2.5, 10.1.3 — EUR-Lex
2. Directive (EU) 2022/2555 (NIS2), Articles 20(2) and 21(2)(g) — EUR-Lex
3. ENISA, Technical Implementation Guidance on cybersecurity risk-management measures, version 1.0, June 2025 (points 8.1–8.2)
4. BSI, #nis2know info pack: NIS-2-Schulungen
5. BSI, Handreichung NIS-2-Geschäftsleitungsschulung, version 1.0, 17 April 2026
6. Deutscher Bundestag, Drucksache 21/1501, government bill implementing NIS2, 8 September 2025 (explanatory memorandum on § 38(3))
7. BSI-Gesetz (BSIG) § 38 — gesetze-im-internet.de
8. National Cyber Security Centre Ireland, NIS2 Draft Risk Management Measures Guidance, June 2025
9. Reinheimer, B. et al., “An investigation of phishing awareness and education over time: When and how to best remind users”, SOUPS 2020, USENIX
10. UC San Diego Today, “Cybersecurity training programs don’t prevent employees from falling for phishing scams”, 17 September 2025