It applies at the EU level and is transposed into Member States’ national laws. Key dates: entered into force on
16 Jan 2023; transposition deadline -
17 Oct 2024.
Current status (as of 5 Nov 2025): NIS2 is operational via national laws across the EU. The European Commission has initiated measures against lagging transpositions, but the requirements and the incident-reporting model (early warning within
24 hours, notification within
72 hours, and a
final report within 1 month) are already embedded and used by regulators and CSIRTs.
Who is in scope: all large and medium-sized organisations in the affected sectors, classified as
essential and
important entities. The list and categorisation are defined in the directive’s annexes.
What’s required in practice:- Risk management and a baseline of technical measures (vulnerability management, network segmentation, backup/DR, logging, least-privilege access, supplier and supply-chain security).
- Incident reporting: early warning within 24 hours, notification within 72 hours, and a final report within 1 month (or an interim report if the investigation is ongoing).
Penalties: for essential entities — up to
€10 million or 2% of global turnover; for important entities — up to
€7 million or 1.4% (whichever is higher). Specific amounts are set in national implementations.