Operators who concluded that NIS2 did not apply because gambling is not listed in the Directive’s annexes have had that argument overtaken.
The scoping logic runs through the infrastructure layer. Cloud services, content delivery networks, and data centres are listed as in-scope sectors. They are also the delivery layer for nearly every licensed online gambling product. An operator whose technology stack depends on those services is inside the NIS2 framework regardless of what its gaming licence category is.
The implications are substantive. Board members carry personal accountability for cyber risk management under NIS2. That obligation cannot be delegated to the IT department. For a mid-sized operator, a first-year compliance programme involves legal scoping across multiple member state transpositions, gap analysis against 10 minimum security measures, and an incident reporting pipeline that must produce a 24-hour early warning and a 72-hour notification.
From September 2026, the Cyber Resilience Act adds a parallel obligation for software vendors deploying products into gambling infrastructure.
The registration window that passed in April was the visible deadline. Whether operators can demonstrate good-faith remediation before enforcement begins is the less visible one.
What Elite Members See
The full intelligence record for this event includes the named operators, platforms, and regulatory bodies involved, complete jurisdictional context, board-level strategic implications, and cross-vertical dependency analysis.
- Named operators, platforms, and vendors involved
- Full jurisdictional and regulatory context
- Board-level strategic implications and decision framing
- Cross-vertical impact assessment across all seven TGB research verticals
Access the Full Intelligence Report
The Gaming Boardroom tracks this and 27 other intelligence signals each month across seven industry verticals. Elite membership gives you complete named analysis, full jurisdictional depth, and board-level strategic assessment for every signal, delivered on the first of every month.