This post sets out where NIS2 transposition stands in 2026. It covers the deadline, the May 2025 reasoned opinions, the July 2026 referral to the Court of Justice, the January 2026 proposal and the incident reporting stages. It rests only on four European Commission pages: the NIS2 policy page, the transposition page, the questions and answers page and the proposal page.
What was the NIS2 transposition deadline?
The Commission’s NIS2 page says NIS 2 came into force in January 2023. It says Member States had until 17 October 2024 to transpose the NIS2 Directive into national law, and that NIS 2 repealed NIS1 as from 18 October 2024. The page shows a last update of 2 July 2026.
The same page describes NIS2 as a unified legal framework to uphold cybersecurity in 18 critical sectors across the EU. The page says that, as a rule, medium-sized and large entities in these critical sectors will have to take appropriate cybersecurity risk-management measures and notify relevant national authorities of significant incidents. It also says NIS2 introduces accountability of the top management for non-compliance with cybersecurity risk management measures. For the plain definition, see the NIS2 glossary entry.
Which Member States received a reasoned opinion in May 2025?
The Commission’s transposition page says that on 7 May 2025 it sent a reasoned opinion to 19 Member States for failing to notify full transposition of the NIS2 Directive. The page names them: Bulgaria, Czechia, Denmark, Germany, Estonia, Ireland, Spain, France, Cyprus, Latvia, Luxembourg, Hungary, the Netherlands, Austria, Poland, Portugal, Slovenia, Finland and Sweden.
The page says these 19 Member States had two months to respond and take the necessary measures. Otherwise, it says, the Commission may decide to refer the cases to the Court of Justice of the European Union.
Who has the Commission referred to the Court of Justice?
Both the NIS2 page and the transposition page list a Commission press release dated 8 July 2026. It says the Commission decided to refer Ireland, Spain, France and the Netherlands to the Court of Justice of the European Union for failing to notify measures transposing NIS2 into national law.
The pages we read name only those four countries in the referral. This post does not state the position of any other Member State. The timeline below restates the dates the pages give.
- Jan 2023NIS 2 comes into forceThe NIS2 page says it came into force in January 2023.
- 17 Oct 2024Transposition deadlineMember States had until this date to transpose NIS2.
- 18 Oct 2024NIS1 repealedThe NIS2 page says NIS 2 repealed NIS1 as from this date.
- 7 May 2025Reasoned opinionsSent to 19 named Member States for failing to notify full transposition.
- 20 Jan 2026ProposalThe Commission proposes targeted amendments to NIS2.
- 8 Jul 2026Court referralIreland, Spain, France and the Netherlands referred to the Court of Justice.
- 17 Oct 2027First review reportThe Q&A page says the Commission reports for the first time by this date.
Can the Commission’s country pages be used as a compliance check?
The transposition page links a state-of-play page for each Member State. It also carries a caveat about its own content, which the callout below repeats. We did not read the individual country pages, so we say nothing about what they show.
What did the Commission propose on 20 January 2026?
The proposal page, published on 20 January 2026, says the Commission proposed a new cybersecurity package. It says the package introduces measures to simplify compliance with EU cybersecurity rules and risk-management requirements for companies operating in the EU. It says this complements the single-entry point for incident reporting proposed in the Digital Omnibus. The documents are listed as COM(2026) 13 and its annex.
On NIS2 itself, the proposal page says the targeted amendments aim to increase legal clarity by simplifying jurisdictional rules, streamlining the collection of data on ransomware attacks and facilitating the supervision of cross-border entities with ENISA’s reinforced coordinating role. The NIS2 page says the amendments ease compliance for 28,700 companies, including 6,200 micro and small-sized enterprises. As of 9 October 2026, neither page says whether the proposal has been adopted.
The NIS2 page also lists two sets of guidelines: one on the application of Article 3(4) and one on the application of Article 4(1) and (2) of Directive (EU) 2022/2555. We read only their titles on that page.
What are the NIS2 incident reporting stages?
The questions and answers page (last update 29 June 2023) describes a multiple-stage approach to incident reporting. The stages below follow its wording. For how these clocks compare with other regimes, see our post on incident reporting deadlines under NIS2, CRA, SEC and CIRCIA.
- Early warningWithin 24 hours from when the company first becomes aware of an incident.
- Incident notificationWithin 72 hours of becoming aware of the incident.
- Final reportNo later than one month after the notification.
The Q&A page also says NIS2 addresses supply chain security by requiring individual companies to address cybersecurity risks in the supply chains and supplier relationships. Our post on NIS2 and DORA third-party risk management covers that side, and the third-party risk glossary entry defines the term.
What questions do these pages raise for planning?
This is a summary of what the pages say, not legal advice. The pages suggest some questions to take to counsel. In which Member States is the organization established, and does the transposition page link a state-of-play page for each of them? Does the organization operate in a sector among the 18 named? Do its reporting processes fit the 24 hour, 72 hour and one month stages? Which amendments in the 20 January 2026 proposal, if adopted, would change its jurisdiction or reporting duties?
For other 2026 rules see our post on the cyber security regulations to know in 2026, and for dated deadlines the cyber compliance calendar for 2026 and 2027.
Last checked against the official pages on 9 October 2026. Dates and status can change, so confirm on the pages listed under Sources before acting.
For background on how threats are cataloged, see the Brandefense knowledge hub pages on threat groups, malware families, ATT&CK techniques and significant incidents, and the glossary. The cyber threat intelligence page describes the related service.