The deadline

NIS2 required EU Member States to transpose the directive into national law by 17 October 2024. After the deadline passed, the Commission assessed whether national measures had been adopted and notified sufficiently. The 28 November announcement therefore described an institutional enforcement step following incomplete transposition, not a new date for the direct application of identical obligations to every business.

The 23 countries

The procedures concerned Bulgaria, Czechia, Denmark, Germany, Estonia, Ireland, Greece, Spain, France, Cyprus, Latvia, Luxembourg, Hungary, Malta, the Netherlands, Austria, Poland, Portugal, Romania, Slovenia, Slovakia, Finland and Sweden. Norway was not among them because the procedure was directed at EU Member States.

Letters of formal notice

The first infringement stage was the dispatch of a letter of formal notice. The countries had two months to reply, complete transposition and notify their measures to the Commission. If a response was not satisfactory, the Commission could later issue a reasoned opinion. The announcement did not say that the next step had already been decided or that every national implementation failure had the same legal effect.

Covered sectors

NIS2 covers critical sectors and services, including electronic communications, ICT service management, digital services, waste and water management, space, health, energy, transport, manufacturing of critical products, postal and courier services and public administration. The directive is marked as EEA-relevant, but its sectoral scope and national rules must not be treated as proof of automatic, uniform application everywhere.

The practical distinction

The infringement action showed that implementation was incomplete in many Member States. It did not show that every organisation was already subject to identical requirements, supervisory arrangements or sanctions in every country. Scope, national legislation and the date of actual transposition had to be checked country by country, especially for groups with EU subsidiaries.

Norwegian status

At that date, Norway had not implemented NIS2 in Norwegian law. Norwegian businesses therefore had to distinguish obligations potentially applying to an EU subsidiary under that country’s transposing law from Norway’s then-pending digital-security framework. The EU infringement procedure was not a Norwegian legal change and did not itself bring NIS2 into force in Norway.

Sources

European Commission: “23 Member States called to transpose NIS2,” 28 November 2024.

EUR-Lex: “Directive (EU) 2022/2555 – NIS2,” 27 December 2022.

For discussion

How should groups document the difference between NIS2 requirements arising under an EU subsidiary’s national law and requirements not yet transposed in Norway?