NIS2 Transposition Status by Country: Where Every EU Member State Stands in 2025

Key Takeaways — NIS2 Transposition Status Tracker

The NIS2 Directive (Directive (EU) 2022/2555) required all 27 EU member states to transpose its cybersecurity requirements into national law by October 17, 2024. As of mid-2025, only a small number of countries have fully completed transposition. The European Commission has initiated infringement proceedings against 23 member states. This tracker monitors each country's legislative progress, competent authorities, and deviations from the directive's baseline — updated monthly by Priverion's regulatory intelligence team.

What is the NIS2 Directive?

NIS2 Directive (formally Directive (EU) 2022/2555) is the European Union's revised framework for achieving a high common level of cybersecurity across all member states. It replaced the original NIS Directive (2016/1148) and was published in the Official Journal of the European Union on December 27, 2022. NIS2 significantly expands the scope of regulated sectors from 7 to 18, introduces size-based thresholds for entity classification, and mandates stricter incident reporting timelines and management-body accountability. Source: EUR-Lex — Directive (EU) 2022/2555

What is transposition in EU law?

Transposition is the process by which EU member states incorporate the provisions of an EU directive into their national legal frameworks. Unlike EU regulations, which are directly applicable, directives require each member state to adopt national legislation that achieves the directive's objectives while allowing flexibility in implementation methods. Source: EUR-Lex — Types of EU law

What was the NIS2 transposition deadline?

Article 41 of the NIS2 Directive set October 17, 2024 as the deadline for all 27 EU member states to adopt and publish the national measures necessary to comply with the directive. Member states were also required to apply those measures from October 18, 2024. As of November 2024, the European Commission sent letters of formal notice to 23 member states that had not notified full transposition. Source: EUR-Lex — NIS2 Directive, Article 41

How many entities are affected by NIS2?

According to the European Commission's 2023 impact assessment, over 160,000 entities across the EU fall within the expanded scope of NIS2. The directive covers 18 sectors, including energy, transport, banking, health, drinking water, digital infrastructure, ICT service management, public administration, and space. ENISA's 2024 NIS Investments report noted that the median cybersecurity budget for entities in scope of NIS2 was approximately €1.4 million, representing about 9% of total IT spending. Source: ENISA — NIS Investments Report 2024

What are the NIS2 incident reporting requirements?

NIS2 Article 23 establishes a multi-stage incident reporting framework: entities must issue an early warning within 24 hours of becoming aware of a significant incident, followed by a full incident notification within 72 hours, and a final report within one month. ENISA coordinates cross-border incident response through the EU-CyCLONe network. According to ENISA's Threat Landscape 2024 report, ransomware and DDoS attacks remained the top two threat categories affecting NIS-regulated sectors. Source: ENISA — Threat Landscape 2024

What happens if a member state fails to transpose NIS2 on time?

Under Article 258 of the Treaty on the Functioning of the European Union (TFEU), the European Commission may initiate infringement proceedings against member states that fail to transpose directives by the deadline. In November 2024, the Commission sent formal letters of notice to 23 of the 27 member states for failing to notify complete transposition of NIS2. If non-compliance persists, the Commission may refer cases to the Court of Justice of the European Union, which can impose financial penalties. Source: EUR-Lex — NIS2 Directive

Does NIS2 apply to non-EU companies?

Yes. NIS2 has extraterritorial reach. Article 26 requires non-EU entities that provide services within the EU and fall within scope to designate a representative in one of the member states where they operate. This mirrors the representative requirement under GDPR Article 27. Failure to designate a representative does not exempt the entity from NIS2 obligations. Source: EUR-Lex — NIS2 Directive, Article 26

What is the difference between essential and important entities under NIS2?

NIS2 classifies entities into two categories based on sector and size. Essential entities include operators in sectors such as energy, transport, banking, health, drinking water, digital infrastructure, and public administration. Important entities cover sectors like postal services, waste management, chemicals, food production, and manufacturing. Both categories must comply with the same cybersecurity risk management and incident reporting obligations (Articles 21 and 23). However, essential entities are subject to proactive, ex-ante supervision — including regular audits and on-site inspections — while important entities face reactive, ex-post supervision triggered by evidence of non-compliance. Source: EUR-Lex — NIS2 Directive, Articles 32–33

NIS2 Transposition Statistics and Timeline

• October 17, 2024 — Transposition deadline for all 27 EU member states (NIS2 Article 41)
• November 2024 — European Commission sends letters of formal notice to 23 member states for non-transposition
• 160,000+ entities estimated in scope across the EU (European Commission, 2023)
• 18 sectors covered under NIS2, up from 7 under the original NIS Directive
• 24 hours — early warning deadline for significant incidents (NIS2 Article 23)
• 72 hours — full incident notification deadline (NIS2 Article 23)
• €10 million or 2% of global turnover — maximum administrative fine for essential entities (NIS2 Article 34)
• €7 million or 1.4% of global turnover — maximum administrative fine for important entities (NIS2 Article 34)

NIS2 vs. Original NIS Directive — Comparison

Authoritative Sources and References

• EUR-Lex — Directive (EU) 2022/2555 (NIS2 Directive full text)
• ENISA — NIS Investments Report 2024
• ENISA — Threat Landscape 2024
• EUR-Lex — Types of EU legislation
• European Data Protection Board (EDPB)
• European Union Agency for Cybersecurity (ENISA)