NIS2 key dates and deadlines: which dates have already passed for your organization
National NIS2 measures applied from 18 October 2024, and that is the date most customer questionnaires and contract clauses now assume. The same day, the first NIS Directive, Directive (EU) 2016/1148, was repealed. Separately, Commission Implementing Regulation (EU) 2024/2690 binds specific digital provider types, including DNS, TLD, cloud, data center, CDN, managed and managed security service providers, online platforms and trust service providers, and it sets its own technical requirements for them. If your organization is one of these provider types, the Implementing Regulation is a direct obligation to plan for, not background reading.
The dates that matter to you depend on your sector, your entity type (essential or important) and the Member State whose law applies to you. The Directive itself is binding only on the Member States, so the national transposition law sets what you must actually do, when you must register, and which authority supervises you. Confirm with your national competent authority which deadlines in your country apply to your entity, and ask any customer or regulator that cites NIS2 which national law they rely on.
The Union-level milestones give the background for those national rules. NIS2 was adopted on 14 December 2022, published in the Official Journal on 27 December 2022 (OJ L 333) and entered into force on 16 January 2023. Member States had to adopt and publish their transposition measures by 17 October 2024. Use these dates to answer a simple question from a counterparty: the Directive has been law in the EU for several years, and any gap against it is now a compliance gap, not a planning item. The NIS2 Directive text on EUR-Lex is the primary source to cite.
How the NIS2 timeline unfolded from adoption to application
The sequence from adoption to application shows which obligations were fixed in law, which were set in implementing measures and which dates an entity had to meet for its own registration and listing.
Adopt and publish the Directive
The European Parliament and the Council adopted Directive (EU) 2022/2555 on 14 December 2022, and it was published in the Official Journal (OJ L 333) on 27 December 2022. For an entity, this step creates no duty yet, but it fixes the legal baseline that national lawmakers must transpose. To confirm the text, check the consolidated Directive on EUR-Lex and note the article numbers your legal team will cite later.
Enter the Directive into force
NIS2 entered into force on 16 January 2023, the twentieth day after publication under Article 45. Entry into force starts the clock for Member States but does not bind entities directly. Organizations should treat this date as the start of the national transposition period and track the bills, decrees and regulator notices in each Member State where they operate.
Publish the Article 4(3) sector guidelines
The Commission had to issue guidelines on sector-specific acts under Article 4(3) by 17 July 2023, and it published them on 14 September 2023, after that deadline. The guidelines help determine when sector-specific rules displace NIS2 for a given entity. The output for a sector body is a documented view on whether its sector law is equivalent, which should be confirmed with counsel and the national authority.
Meet the transposition deadline and application date
Member States had to adopt and publish national transposition measures by 17 October 2024 and apply them from 18 October 2024, under Article 41. The first NIS Directive, Directive (EU) 2016/1148, was repealed from the same application date under Article 44. Entities now have binding obligations set by their national law, so the check is whether the national act names them, the competent authority and the Article 21 and Article 23 duties that apply.
Adopt and publish Implementing Regulation 2024/2690
The Commission adopted Implementing Regulation (EU) 2024/2690 on 17 October 2024 and published it on 18 October 2024. It sets technical and methodological requirements for the Article 21(2) measures and significant incident criteria for DNS, TLD, cloud, data center, CDN, managed and managed security service providers, online platforms and trust service providers. Covered providers should map their current controls against its Annex, and other entities should read it for the baseline their customers may request.
Register digital providers and notify penalty rules
By 17 January 2025, the digital providers listed in Article 27 had to submit their registration information, and Member States had to notify their penalty rules to the Commission under Articles 27(2) and 36. For a covered digital provider, the output is a registration record held by the competent authority. Other entities should confirm with their national authority whether any registration duty applies to them, because the national act sets the process.
Establish lists of essential and important entities
By 17 April 2025, Member States had to establish lists of essential and important entities, which must be reviewed at least every two years under Article 3(3). An entity should check whether it appears on its national list and, if it does not, whether it has been asked to provide information. The output is a confirmed classification that determines whether ex ante or ex post supervision applies.
Use ENISA's technical implementation guidance
ENISA published its non-binding technical implementation guidance for Implementing Regulation 2024/2690 on 26 June 2025, with examples of evidence and mappings to ISO/IEC 27001:2022, NIST CSF 2.0 and other frameworks. Entities use it to shape the evidence they will show a supervisor. Confirm the current version on the ENISA publication page before relying on any mapping, because the guidance is not legally binding.
Which NIS2 deadlines apply to your entity right now
NIS2 deadlines fall on different actors at different times, so the first question is which role your organization plays. Each card below names one deadline, who it binds and the place where you confirm your exact obligation, which is usually your national transposition law or your national competent authority.
Digital provider registration
Under Article 27, certain digital providers listed in that article had to submit registration information by 17 January 2025. The duty applies to the entity itself, not to its customers. Check whether your service falls within the Article 27 categories, then confirm with your national competent authority whether your registration was filed and what it must contain.
Entity list review cycle
Member States had to establish lists of essential and important entities by 17 April 2025, and they must review those lists at least every two years. If your organization is not on a list, that does not settle the question, because the list is built by the national authority. Ask your national competent authority whether you were listed and when the next review falls.
Early warning within 24 hours
For each significant incident, Article 23(4) requires an early warning within 24 hours of becoming aware of it. The clock binds the in-scope entity that suffers the incident. Your incident playbook should name who decides that an incident is significant and who sends the early warning. Confirm the content and channel with your national CSIRT or competent authority.
Notification within 72 hours and final report
Article 23(4) also requires an incident notification within 72 hours and a final report within one month of that notification. Both clocks bind the affected in-scope entity and run alongside any GDPR breach notification. Test whether your reporting workflow can produce both documents from the same incident record, and confirm the expected format with your national authority.
Management body approval and training
Under Article 20, the management body must approve and oversee the Article 21 risk-management measures, and its members must follow cybersecurity training. These duties bind directors and board members personally in most national laws, and they have no single fixed calendar date in the Directive. Confirm with your national law when approval and training must be documented, and keep dated minutes that show the board reviewed the measures.
Penalty rules notified to the Commission
Member States had to notify their penalty rules to the Commission by 17 January 2025 under Article 36. The rules set the fines and enforcement measures that apply to your entity in that country, so they shape your exposure. Read the penalty provisions in your national transposition law, and ask your national competent authority which fines and supervisory measures apply to your sector.
Why your national law, not the Directive alone, sets your date
NIS2 is a directive, so it does not apply to your organization directly in the form of a single EU-wide rule. Each Member State must transpose it into national law, and that national law, together with the competent authority it names, sets the obligations and deadlines you actually face. Article 5 also lets Member States adopt or keep rules that ensure a higher level of cybersecurity, so a national law can be stricter than the Directive's minimum. The EU-level dates in the Directive are the baseline, not the full picture for your entity. Start by confirming which Member State has jurisdiction over you, then find the transposing law, its application date and any registration or reporting rules it adds.
The Commission has been enforcing transposition on a case-by-case basis. It sent letters of formal notice to 23 Member States on 28 November 2024, issued reasoned opinions to 19 of them on 7 May 2025, and on 8 July 2026 referred Ireland, Spain, France and the Netherlands to the Court of Justice for failing to transpose the rules. Where a national law is late, incomplete or still being drafted, the national authority may still set its own timetable for registration and compliance, so an EU-wide date alone does not tell you when your supervisor expects you to comply. Confirm the current status of your Member State's law directly with the Commission's infringement pages and the national authority, and record the date and source you relied on.
Treat the national position as a live input to your program plan. Ask your legal or regulatory adviser to confirm whether your national law has been published, whether it has been amended since, and whether it adds any requirement beyond the Directive, such as earlier reporting or additional registration steps. Also confirm which authority will supervise you and how it expects notifications to reach it. A compliance calendar built only on October 2024 or the Commission's dates can miss a national deadline, so build yours from the transposing text and review it whenever your Member State publishes a change.
NIS2 dates at a glance and what each one means
This table lists each NIS2 milestone from adoption to the 2027 review, with the parties it touches and its current status. Adopted, passed and applied items are settled, while proposals still need approval by the European Parliament and the Council. Check your national transposition law for the dates that bind your entity.
| Date | Event | Who it affects | Status |
|---|---|---|---|
| 14 and 27 December 2022 | Directive adopted on 14 December, then published in the Official Journal (OJ L 333) on 27 December | EU institutions, Member States and all future in-scope entities | Adopted |
| 16 January 2023 | NIS2 enters into force on the twentieth day after publication; the five-year clock for Article 24(2) delegated acts starts | Member States and the Commission | Passed |
| 17 July 2023 and 14 September 2023 | Article 4(3) deadline for Commission guidelines on sector-specific acts; the Commission published them on 14 September | Entities checking whether sector-specific laws displace NIS2 | Passed |
| 17 and 18 October 2024 | Transposition deadline (17 October); national measures apply and NIS Directive repealed (18 October); Regulation 2024/2690 adopted and published | Member States, all in-scope entities and digital providers covered by the implementing regulation | Applied |
| 28 November 2024, 7 May 2025 and 8 July 2026 | Infringement steps: formal notice to 23 Member States, reasoned opinions to 19, and referral of four Member States to the Court of Justice | Entities in Member States that have not completed transposition, including Ireland, Spain, France and the Netherlands | Passed |
| 17 January 2025 and 17 April 2025 | Digital provider registration information and penalty rules notified (January); national lists of essential and important entities due, reviewed every two years (April) | Article 27 digital providers, Member States and listed entities | Passed |
| 26 June 2025 | ENISA publishes non-binding technical implementation guidance for Regulation 2024/2690, with evidence examples | Digital providers, their auditors and compliance teams | Adopted |
| 19 November 2025 and 20 January 2026 | Commission proposes a single-entry point for incident reporting (19 November) and targeted NIS2 amendments, including a small mid-cap category (20 January) | In-scope entities, mid-sized companies and Member States | Proposal |
| 17 October 2027 and every 36 months | Commission review of how NIS2 functions, repeated every 36 months after the first review | The Commission, Member States and the regulated community | Future review |
Which pending NIS2 changes could move your dates
Several proposals and review clocks could change when NIS2 obligations apply or how they are reported. None of them is law yet, so the dates in force today still govern your program. Track each item below and confirm its status with your national competent authority before you reset internal deadlines.
Single-entry point for incident reporting
On 19 November 2025 the Commission proposed, in its Digital Omnibus, a single-entry point for incident reporting. If adopted, it could let entities send one notification that reaches several authorities, rather than filing the same report with each one. Today the Article 23 clocks still apply: an early warning within 24 hours, a notification within 72 hours and a final report within one month. Ask your national authority how it will handle reports until any change takes effect.
Targeted amendments and small mid-caps
On 20 January 2026 the Commission proposed targeted amendments to NIS2 in COM(2026) 13, including a new small mid-cap category. If adopted, the category could change which companies fall in scope and how they are treated. Check whether your headcount or turnover would move you into or out of scope under the proposed text, and do not change your program until the amendments are adopted and transposed in your Member State.
Delegated act power for certified ICT products
Under Article 38(2), the Commission's power to adopt delegated acts requiring certified ICT products under Article 24(2) runs for five years from 16 January 2023. Any such act would set which products entities must buy certified, which would affect procurement and supplier contracts. Watch for a delegated act in your sector and review the duration of this power, since its expiry or renewal is a date to record in your compliance calendar.
Article 40 review and 36-month cycle
The Commission must review how NIS2 functions by 17 October 2027 and then every 36 months. This review is a checkpoint, not a change in obligations, but it is the point where scope, reporting and supervision could be revisited. Record the date in your compliance calendar, and plan a short review of your scope analysis and reporting procedures shortly before it so that you can respond to any resulting proposal quickly.
How to plan a NIS2 program around these dates
Start with the question that sets every other date: which law binds the entity. NIS2 is a directive, so the obligations an organization carries come from the national transposition law of the Member State that has jurisdiction, and that law may go further than the Directive. Confirm the sector, the essential or important classification and the competent authority first, then check the registration and entity list position with that authority. The Article 3(3) entity lists were due by 17 April 2025 and are reviewed at least every two years, so a compliance lead should ask the authority whether the organization appears on the list and what its national deadlines are, rather than relying on the EU-level dates alone.
Next, build the incident reporting process before anything else, because its clocks are the shortest. For a significant incident, Article 23(4) sets an early warning within 24 hours, an incident notification within 72 hours and a final report within one month of the notification. Map who detects, who decides significance, who drafts each report and who signs off, then test that chain against a realistic scenario. Where personal data is involved, plan for GDPR notification running in parallel. The reporting process is also the easiest part to evidence, so it should be documented and exercised early.
Finally, set a formal review point. The Commission must review NIS2 by 17 October 2027 and every 36 months after that, and the January 2026 targeted amendments in COM(2026) 13 are still a proposal that needs approval by the European Parliament and the Council. Diarize a review each time a national law, an amendment or an ENISA update changes the picture, and record which version of each requirement the program was built against. DeployOpen can prepare systems, controls and evidence against the schedule agreed in writing, but it does not decide legal status. The organization owns that decision, and an independent auditor or the national competent authority confirms compliance.
NIS2 key dates questions buyers ask
Has NIS2 already applied to organizations in the EU?
Yes. NIS2 is Directive (EU) 2022/2555, which entered into force on 16 January 2023. Member States had to adopt and publish national transposition measures by 17 October 2024, and those national measures apply from 18 October 2024. On the same date the first NIS Directive, Directive (EU) 2016/1148, was repealed. Because NIS2 is a directive, your actual duties come from the national law of the Member State that has jurisdiction over your entity, not from the Directive text alone. Confirm with your national competent authority which law applies to you and when it took effect in your country, since some Member States transposed later than the deadline.
What is the deadline for my entity to register?
The dates depend on your entity type. Digital providers listed in Article 27 had to submit registration information by 17 January 2025. For other in-scope entities, Member States had to establish lists of essential and important entities by 17 April 2025, and those lists are reviewed at least every two years under Article 3(3). Your national authority sets the registration route and any local deadline, so the national portal or notice is the source to check. Ask the authority whether your entity appears on its list, which entity category it assigned you, and when the next review is scheduled.
Does the 2027 review change my obligations today?
No. The Commission must review the functioning of NIS2 by 17 October 2027 and every 36 months after that, under Article 40. A review is an assessment of how the Directive works, and it does not change your duties on its own. Your obligations today come from the national transposition law and the Article 21 and Article 23 duties it implements. Any change would require a further legal act that goes through the normal EU process. Plan for the current rules, and track the review as a source of future change.
Are the January 2026 NIS2 amendments in force?
No. On 20 January 2026 the Commission proposed targeted amendments to NIS2 in COM(2026) 13, including a new small mid-cap category. The proposal still needs approval by the European Parliament and the Council. The Commission also proposed a single entry point for incident reporting in its Digital Omnibus on 19 November 2025. Both are proposals, so the current NIS2 text and your national law still set your obligations. Check the status of COM(2026) 13 on the Commission's pages before you change a scope decision, and confirm with your authority how any adopted change would apply to you.
Do I need to meet these dates myself, or can a partner do it?
The legal duty stays with your organization. Your management body must approve the Article 21 measures, and your entity answers to its authority for registration, reporting and supervision. A partner can prepare systems, documentation and evidence, such as configuration baselines, logging, backup records and incident runbooks, but it cannot register your entity, sign filings or issue a compliance report. Independent auditors and certification bodies issue reports or certificates, and NIS2 creates no certificate of compliance. Ask any provider which tasks it will perform, which stay with your staff, and who will hold the evidence after the engagement ends.
Does a date on this page mean my organization is in scope?
No. The dates describe when rules were adopted, applied or reviewed, and they do not decide whether you are covered. Scope depends on your sector in Annex I or Annex II, your entity type, your size and the Member State that has jurisdiction, along with any sector-specific rules that take precedence. A deadline that passed before you became covered can still matter, because obligations may begin for you on a different date under national law. Confirm your scope with your national competent authority, and record the answer and its date in your compliance file.
Which NIS2 dates should I track for incident reporting?
For each significant incident, Article 23(4) sets three clocks: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month of the notification. These run from the moment your entity becomes aware of a significant incident, so the clock starts before your investigation is complete. Your national authority may add its own forms or channels, so confirm those in advance. Test the process with a tabletop exercise so your team knows who sends each report and how the clocks are recorded.
How DeployOpen prepares NIS2 evidence against your timeline
DeployOpen works backward from the NIS2 dates that apply to your entity, then prepares the systems, logs and documents that show your controls were in place when a deadline arrived. DeployOpen implements self-hosted open-source platforms inside your own infrastructure. Your management body still owns the controls and every reporting decision.
How we scope
- Each engagement starts with a written scope that names the NIS2 dates and obligations it covers.
- We map which dates already passed for your entity and which fall inside the agreed timeline.
- Deliverables, responsibilities and milestones are agreed in writing before any work begins.
- Your national transposition law is confirmed as the source of your actual obligations and deadlines.
How we build
- We deploy and configure self-hosted tools that generate logs, inventories and access records with timestamps.
- We set up incident detection and notification workflows sized to the 24-hour, 72-hour and one-month clocks.
- We test the workflows so you can show a supervisor that the reporting process runs before a real incident.
- We document configurations and change history so evidence can be traced back to a specific date.
How we hand over
- You receive a dated evidence register that links each obligation to the artifact that shows it.
- Runbooks and reporting templates are written for your own staff to operate after handover.
- Known gaps against upcoming dates are listed with owners and proposed remediation steps.
- Your auditors and national authority decide what is sufficient; DeployOpen does not issue reports or certificates.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after handover.
- A retainer can track pending amendments and national transposition changes that affect your dates.
- Scope changes are handled through a written change to the agreed scope and its timeline.
- Quotes follow from the written scope, so ask for each date, deliverable and assumption to be itemized.
Sources and further reading
- Directive (EU) 2022/2555 (NIS2), EUR-Lex ↗
- Commission Implementing Regulation (EU) 2024/2690, EUR-Lex ↗
- NIS2 Technical Implementation Guidance (June 2025), ENISA ↗
- Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice ↗
- Proposal for a Directive as regards simplification measures and alignment with the Cybersecurity Act, COM(2026) 13 ↗
- NIS2 Directive: securing network and information systems, European Commission ↗
