Regulatory Update · 2 min read

NIS2 Transposition Status: Where EU Member States Actually Stand

The 17 October 2024 transposition deadline came and went with most member states still finalizing their national laws. Here's why that matters for your actual compliance date.

By SecuryxAI Research Team

September 12, 2026

Regulatory

Directive (EU) 2022/2555 — NIS2 — set 17 October 2024 as the deadline for every EU member state to transpose the directive into national law. Unlike a regulation, a directive isn't directly binding until a country's own legislature acts on it, and a large share of member states missed that deadline.

The practical consequence

If you operate in multiple EU countries, "NIS2 compliance" isn't one date — it's however many dates your operating countries' own transposing statutes set. Check each jurisdiction directly rather than assuming a single EU-wide effective date.

What this means in practice

The European Commission opened infringement proceedings against member states that missed the deadline — a normal, expected mechanism for enforcing directive transposition, not a sign NIS2 itself is in doubt. National laws are landing on a rolling basis, and several countries' transposing statutes differ in scope details even though the directive sets a common floor.

Confirm the transposing statute's actual effective date in every EU country your organization or your critical vendors operate in.
Don't assume "essential" vs. "important" entity classification is identical across countries — some national laws add sector-specific detail.
Track this at the legal-entity level, not the group level — a subsidiary can be in scope even if the parent isn't.