NIS2 explained: the Article 21 measures, the reporting clock, and where all 27 member states stand

Instrument

Directive (EU) 2022/2555

Transposition deadline

17 October 2024

Legal form

Directive — your national implementing law is what binds you

Scope

18 sectors, split into essential and important entities

Reporting clock

Early warning at 24 hours · notification at 72 hours · final report within a month

Maximum fine

€10 million or 2% of global turnover for essential entities

In force as at 2 August 2026

21 of 27 member states

Enacted or phased, not yet fully applicable

3: Austria, Malta and the Netherlands

Still no law in force

3: France, Ireland and Spain

What NIS2 is, and what actually binds you

NIS2 is a directive rather than a regulation, so what binds you is your member state's implementing law and not the directive text. It covers eighteen sectors split into essential entities, including energy, transport, banking, health, water, digital infrastructure, public administration and space, and important entities, including post, waste, chemicals, food, several manufacturing categories, digital providers and research. The size threshold is broadly medium-sized and above, with carve-outs that catch certain providers regardless of headcount.

The ten Article 21 measures

Article 21 sets ten minimum measures every in-scope entity must have. They are minimums, not a ceiling — national law can and does go further.

• Risk analysis and information system security policies
• Incident handling
• Business continuity and crisis management
• Supply chain security
• Secure development and vulnerability handling
• Assessment of the effectiveness of the measures
• Cyber hygiene practices and training
• Cryptography policy
• Access control and asset management
• Multi-factor authentication

The reporting clock, liability and penalties

Reporting runs on a three-stage clock to the national CSIRT: an early warning within 24 hours of becoming aware of a significant incident, a fuller notification within 72 hours, and a final report within a month.

The performer is explicitly the management body, which must approve the measures, oversee implementation, undergo training and can be held personally liable. Essential entities face proactive supervision and inspections; important entities are supervised reactively, once a regulator has cause to look. Fines reach 10 million euro or 2% of global turnover for essential entities, and supervisors can suspend senior managers.

One important interaction: DORA is lex specialis for financial entities, so a bank satisfies the ICT risk and incident limbs of NIS2 through DORA rather than doing the work twice.

The state of play, and why it is the hard part

Transposition status by member state

The table below is the operational view: what instrument is in force, who supervises, and which national deadline is the one that will actually catch you.

Authority names and registration routes move. Sweden reorganised its national body twice inside eighteen months and Denmark folded its CSIRT into a new agency, so verify the current route before filing anything.

Three things that catch multi-country operators

• Scope is not uniform. Member states may extend beyond the directive's annexes, and several have. France pulls in local authorities above 30,000 residents, Poland pulls in roughly 28,000 public sector bodies, Italy adds annexes for public administration and local transport. Being out of scope in one country tells you nothing about the next.
• Reporting routes differ. Most states run a single national CSIRT. Poland runs three, split by sector. Finland and Sweden supervise through sector regulators rather than one central body. You need a routing map keyed on member state and sector, not a single contact.
• National deadlines are the real deadlines. Hungary required a completed audit by June 2026, Belgium required essential entities to evidence posture by April 2026, Italy requires basic measures by October 2026. None of these come from the directive.

What is coming next

The Commission proposed targeted NIS2 amendments in January 2026 covering submarine infrastructure, digital wallet providers, a small mid-cap category, ransomware reporting detail and post-quantum migration timelines. Separately, the NIS Cooperation Group agreed common incident reporting templates in May 2026, which the Commission intends to make binding by implementing act. That would remove one of the more tedious cross-border differences.