NIS2 national transposition

NIS2 is a directive, so it binds your organization only through the law each Member State adopts to transpose it. The Directive sets a common baseline, but the national transposition law decides which entities are listed, which authority supervises them, where they register, what concrete duties apply and how high fines can go. Before you plan against the Directive's text, identify the national law that applies to your establishment, find the competent authority named in it, and check the registration deadline and portal that law sets. Those four facts determine what you must actually do and whom you must answer to.

Article 5 of the Directive lets Member States adopt or keep rules that ensure a higher level of cybersecurity than NIS2 requires. That means a national law can impose duties beyond the Directive's text, add sectors or entity types, or set stricter reporting or supervision expectations. Do not assume that because a neighboring country's rules look similar, yours do too. Ask your counsel or the competent authority to confirm every national requirement that touches your entity, and keep a dated record of the version of each national law you relied on, because amendments and secondary regulations can change the duties during the program.

Implementing Regulation (EU) 2024/2690 is directly applicable in all Member States and does not differ by country for the digital infrastructure and digital provider entities it covers, such as cloud, data center, DNS and managed service providers. For those entities, the national law adds to the Implementing Regulation rather than replacing it, so you should build one technical control set that meets the Regulation and then check each national law for additional obligations. The Commission's transposition page reports what Member States notify and does not formally assess compliance, so treat the country status as a starting point and confirm the current position with the national authority before you rely on it.

A group with establishments or customers in several Member States should first map each legal entity to a single jurisdiction under the Directive's jurisdiction rules, then treat each national transposition law as a separate set of obligations. The reason is that NIS2 is a directive, so the national law sets the entity's concrete duties, its competent authority, its registration route and its fine ceilings. Two subsidiaries of the same group can therefore face different reporting channels and supervisors even when their technical environment is shared. Record, for each entity, which Member State's authority supervises it, which portal it must register with, and which national rules it must follow, and confirm these points against the national law and the authority's own guidance rather than assuming they match.

Some requirements do not vary by country. The Article 21 measures are common to every in-scope entity, and where an entity is a digital infrastructure or digital provider covered by Implementing Regulation (EU) 2024/2690, that regulation is directly applicable in all Member States. A practical approach is to build one control set against these common requirements, then add a national overlay for each country: registration steps, reporting contacts, any stricter national rules and any national frameworks the law gives a role to. Ask each authority or local counsel which national additions apply, and document the answer so the group can show a supervisor which layer each piece of evidence satisfies.

Because the national picture is still changing, the group should assign an owner to track infringement steps, national transposition updates and the proposed amendments to NIS2 that the Commission put forward in January 2026. The Commission's transposition page describes what Member States report and does not formally assess compliance, so the group should check the national legal text itself before relying on any summary. Review the jurisdiction map and each national overlay on a fixed cycle and after any change in law or corporate structure, and record each review so the decisions can be shown to supervisors later.

On 20 January 2026 the Commission proposed targeted amendments to NIS2 in COM(2026) 13. The proposal is not law. It still needs approval by the European Parliament and the Council, and Commission pages updated through July 2026 still describe it as a proposal. Its most visible change for national transposition is a new small mid-cap category, which could bring some companies that sit between the existing size thresholds into a lighter regime. Whether any entity falls into that category depends on the final text, so do not plan around the proposal's wording until it is adopted.

The proposal would give Member States one year after adoption to transpose the changes into national law. That timing matters for planning. A country that today appears to be in the middle of the infringement steps may also have to amend its law again once the changes are adopted, so the national position in your sector can move twice: once when your Member State completes its current transposition, and again when the amendments take effect. Treat the current national position as a snapshot, not a settled baseline.

Track the EU proposal and your national law together. Watch the status of COM(2026) 13 in the Parliament and Council, and check your national competent authority's guidance and transposition law for any changes that follow. Ask your legal or compliance team to record which obligations are set by national law today, which would change under the proposal, and who owns the decision on each. Ask your competent authority directly how it will handle the amendments and whether it will publish updated guidance before the one-year transposition window closes.