Mapping EU Legislation: Directive (EU) 2022/2555 (Network and Information Security Directive 2 – NIS2)

Directive (EU) 2022/2555 (Network and Information Security Directive 2 – NIS2) was published in the Official Journal of the European Union on December 27, 2022. It lays down measures aiming to achieve a high common level of cybersecurity across the union.

The directive sets out cybersecurity risk-management measures and reporting obligations for entities referred to in Annexes I or II, including banks and financial market infrastructures. In particular, affected entities will be required to take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems which are used for operators and the provision of services. 

NIS2 was first discussed in the European Commission’s communication on shaping Europe’s digital future on February 19, 2020. It was then subsequently proposed by the European Commission on December 16, 2020. Replacing Directive (EU) 2016/1148 (Network and Information Security Directive 1 – NIS1), NIS2 intends to correct the limitations found within the previous framework. In particular, NIS2 expanded the scope of applicable entities by introducing a clear size cap – meaning that all medium and large companies in selected sectors will be included in the scope. Medium and large companies are defined in Annex 1, Article 2 of Recommendation 2003/361/EC as follows: 

• Medium-sized enterprise:
  • Employs 50 to 249 persons
  • Annual turnover: between €10m and €50m.
  • Annual balance sheet total: between €10m and €43m.
• Large enterprise:
  • Exceeds any of the thresholds set for medium-sized enterprises.

With the publication of NIS2 in the Official Journal of the European Union, the directive entered into force on January 16, 2023, and then applied from October 18, 2024. 

This Mapping EU Legislation: NIS2 page will be updated in line with any NIS2 update. This includes any delegated regulation, implementing regulation or guideline issued and published. 

Key Dates 

Member State Implementation

* Countries marked were, on November 28, 2024, subject to the European Commission's infringement procedures for failing to fully transpose NIS2 within the prescribed deadline.

** Countries marked were, on May 7, 2025, subject to the European Commission’s reasoned opinion on failing to fully transpose NIS2. 

The infringement procedure is as follows: 

1. The commission sends a letter of formal notice requesting further information to the country concerned, which then must send a detailed reply within a specified period, usually two months.
2. If the commission concludes that the country is failing to fulfil its obligations under EU law, it may send a reasoned opinion, which is a formal request to comply with EU law. It explains why the commission considers that the country is breaching EU law. It also requests that the country inform the commission of the measures taken, within a specified period, usually two months.
3. If the country still does not comply, the commission may decide to refer the matter to the Court of Justice of the European Union. Most cases are settled before being referred to the court.
4. If an EU country fails to communicate measures that implement the provisions of a directive in time, the commission may ask the court to impose penalties.
5. If the court finds that a country has breached EU law, the national authorities must take action to comply with the court judgment.

With the opening of infringement procedures by sending a letter of formal notice, member states had two months to respond and to complete their transposition, as well as to notify the commission. Where a member state failed to issue a satisfactory response, the commission could issue a reasoned opinion. 

Following on from the European Commission’s reasoned opinion of May 7, 2025, five more member states have completed the NIS2 transposition. However, as of January 13, 2026, nine countries have yet to complete this step, nearly two years on from the directive’s effective date. Several possible reasons exist for this delay, from de-prioritisation to legislative complexity. Notwithstanding these challenges, the directive’s requirements will ultimately apply across the Union. Institutions should, therefore, continue to advance their NIS2 readiness, rather than waiting during a period of transitional uncertainty or delayed national implementation.

NIS2 Secondary Regulations 

NIS2 contains empowerments for the European Commission to develop draft delegated and implementing acts. 

A draft act, once finalised by the regulators, is submitted to the European Commission for endorsement. If endorsed, it will be published in the Official Journal of the European Union as either a Commission Delegated Regulation (for a delegated act) or a Commission Implementing Regulation (for an implementing act). The procedure for the adoption of delegated acts is known as comitology (Article 290, Treaty on the Functioning of the European Union). 

To date, the European Commission has only published one implementing regulation in relation to NIS2. 

NIS2 Guidelines