NIS2 enforcement timeline

NIS2 national transposition deadline

Member States were required to adopt and publish national transposition measures by 17 October 2024. As of May 2026, several Member States have not yet fully transposed NIS2: Belgium, Bulgaria, Czech Republic, Greece, Hungary, Luxembourg, Portugal, Romania, Slovakia, Slovenia, and Spain have either delayed or produced incomplete transposition laws.

Applies to: Member States; essential and important entities in sectors covered by NIS2

Penalty: up to €10M or 2% of global annual turnover for essential entities; up to €7M or 1.4% for important entities

Most EU Member States missed the deadline. Entities in non-transposed states still face uncertainty; the Directive remains binding on states regardless.

Member States must designate NIS2 competent authorities and single points of contact

Six months after the transposition deadline: Member States must designate national competent authorities, single points of contact (SPOC), and ensure operational CSIRT capacity as required by NIS2.

Applies to: Member States

Essential and important entities must register with national authorities

Entities that fall within scope of NIS2 (essential and important entities per Annexes I and II) must register with their national competent authority by April 2025, subject to national transposition timing.

Applies to: essential and important entities: energy, transport, banking, health, digital infrastructure, ICT service management, public administration, space, postal, waste, chemicals, food, manufacturing, digital providers

Penalty: up to €10M or 2% of global annual turnover (essential); up to €7M or 1.4% (important)