NIS2's national transposition deadline passed on 17 October 2024 — but transposition remains uneven, so what applies to you is set per Member State.
Status note. Transposition status continues to move; check the current state per Member State rather than relying on a snapshot.
What changed
Directive (EU) 2022/2555 (NIS2) required Member States to transpose its rules into national law by 17 October 2024. NIS2 widens cybersecurity obligations to a larger set of 'essential' and 'important' entities across sectors including energy, transport, health, digital infrastructure and ICT service management, and strengthens incident reporting, supply-chain security and management accountability — including personal responsibility of management bodies for approving and overseeing risk-management measures. Because transposition has been uneven — the Commission opened infringement procedures against 23 Member States in November 2024 (separate item) — the obligations that actually bind an entity today depend on each national implementing law.
Why it matters
NIS2 is not one EU deadline but a per-country patchwork: an organisation operating in five Member States can face five different transposition states, registration duties and enforcement regimes at once. Waiting for the slowest country is the common failure mode — national laws can land with little runway.
Who is affected
Essential and important entities across the covered sectors and their key suppliers — with the compliance burden typically shared between security teams (measures) and legal teams (per-country classification and registration).
Rolessecurity teamscompliance teamslegal teams
Organisationsessential entitiesimportant entitiescritical sectorsdigital service providers
What to check next
- Identify the national transposition law and its status in each Member State where you operate
- Map your entity classification (essential vs important) under each national law, including registration duties
- Review management-accountability requirements — NIS2 puts obligations on management bodies personally
- Prepare against the directive text where transposition is still pending rather than waiting for the national law
Key dates
- 2024-10-17Transposition deadline for Member States
Source. EUR-Lex — Directive (EU) 2022/2555 (NIS2) ↗
Document: Directive (EU) 2022/2555 — CELEX 32022L2555
Verified by Trusq against this source on 4 Jul 2026. Trusq publishes only what it can trace to an official source; the source text prevails. Not legal advice.
Document: Directive (EU) 2022/2555 — CELEX 32022L2555
Verified by Trusq against this source on 4 Jul 2026. Trusq publishes only what it can trace to an official source; the source text prevails. Not legal advice.