NIS2 Transposition Status: Where EU Member States Actually Stand
The 17 October 2024 transposition deadline came and went with most member states still finalizing their national laws. Here's why that matters for your actual compliance date.
October 21, 2026
v1
2 min
NIS2 Transposition Status: Where EU Member States Actually Stand
Directive (EU) 2022/2555 — NIS2 — set 17 October 2024 as the deadline for every EU member state to transpose the directive into national law. Unlike a regulation, a directive isn't directly binding until a country's own legislature acts on it, and a large share of member states missed that deadline.
What this means in practice
The European Commission opened infringement proceedings against member states that missed the deadline — a normal, expected mechanism for enforcing directive transposition, not a sign NIS2 itself is in doubt. National laws are landing on a rolling basis, and several countries' transposing statutes differ in scope details even though the directive sets a common floor.
- Confirm the transposing statute's actual effective date in every EU country your organization or your critical vendors operate in.
- Don't assume "essential" vs. "important" entity classification is identical across countries — some national laws add sector-specific detail.
- Track this at the legal-entity level, not the group level — a subsidiary can be in scope even if the parent isn't.
Explore NIS2
Hub overview →
Related Executive Guides
All ten minimum measure categories Article 21(2) requires, as a working checklist rather than a paragraph of prose.
Everything a CISO, compliance director, or board member needs to know about the EU's revised Network and Information Security Directive — scope, governance, reporting obligations, and a real implementation roadmap.
What the CRA actually requires, who it applies to, and the concrete deadlines security, compliance, and product leaders need on their calendar.
Management-body liability is the detail that changes NIS2 from an IT compliance project into a governance question every board should already be asking about.