Cybersecurity

NIS2: one directive, twenty-seven timetables

Europe's most ambitious cybersecurity directive required all twenty-seven member states to write it into national law by October 2024. More than a year later, seven of them still have not, and companies working across borders are carrying the difference.

P J Laszkowicz

On 6 December 2025, Germany's law implementing the NIS2 Directive came into force, fourteen months after the European deadline of 17 October 2024. The new law rewrites the act governing the Federal Office for Information Security, widening cybersecurity regulation from roughly 4,500 organisations to about 29,000, making board members personally liable where they fail to oversee cyber risk, and setting penalties of up to ten million euros or 2 per cent of worldwide annual turnover.

Germany was not an outlier. It was the pattern. More than a year past the deadline, only twenty of the twenty-seven member states have finished writing the directive into national law. In May 2025 the European Commission sent reasoned opinions to nineteen of them, the last formal warning before a case can go to the Court of Justice, naming Germany, France, Spain, and the Netherlands among others. The Czech law took effect on 1 November 2025. Belgium, Denmark, and Italy moved earlier. The rest sit at various points of parliamentary debate, drafting, or coalition negotiation.

The result is the very condition NIS2 was written to prevent. What a company must do now depends on which member state it happens to be in, and on whether that state has finished its legislative work. A directive meant to make European cybersecurity consistent has, for the moment, produced fresh inconsistency instead.

What follows sets out what NIS2 requires, where the national laws stand, how the Cyber Resilience Act adds a second layer, and whether the Commission's Digital Omnibus can close the gaps.

What NIS2 requires

NIS2, adopted in January 2023 to replace the original network and information security directive of 2016, is the largest expansion of European cybersecurity regulation in a decade. The original covered seven sectors, being energy, transport, banking, financial market infrastructure, drinking water, healthcare, and digital infrastructure, and left each member state wide latitude to decide which organisations counted as operators of essential services.1 Coverage came out uneven: a service treated as essential in Germany might not be in Portugal, and the thresholds for obligations varied considerably from one border to the next.

NIS2 replaces that latitude with a rule. It widens coverage to eighteen sectors, adding manufacturing, food production, waste management, postal and courier services, public administration, space, and chemicals among others.2 It sets a size threshold, bringing every medium and large enterprise in a covered sector into scope and removing the country-by-country identification that produced the earlier inconsistency.3 The Commission estimates that more than 160,000 organisations across the Union now fall within the directive, against the few thousand covered before.4

The obligations are more demanding to match. Organisations must put in place risk-management measures covering, at minimum, risk analysis, incident handling, business continuity, supply chain security, the security of networks and information systems, and policies on the use of cryptography.5 Incident reporting runs to a tiered clock: an early warning within twenty-four hours to the national authority or computer security incident response team, a fuller notification with an initial assessment within seventy-two hours, and a final report within one month setting out causes, impact, and what was done to fix the problem.6

The directive also splits organisations into "essential" and "important". Essential entities, those in the most critical sectors, are supervised actively, whether or not anything has gone wrong. Important entities are supervised only when something prompts it, typically evidence of non-compliance or a reported incident.7 Penalties follow the same split: up to ten million euros or 2 per cent of worldwide turnover for essential entities, whichever is higher, and up to seven million euros or 1.4 per cent for important ones.8

The most consequential provision concerns boards. NIS2 requires management bodies to approve the cybersecurity risk-management measures personally and to oversee how they are carried out, and governance failures can lead to temporary suspension or a ban from holding management positions.9 Cybersecurity is no longer, as a matter of European law, a matter for the technology department. It is a duty of the board.

Where the national laws stand

Writing an EU directive into national law is, by design, an uneven business. A directive sets the objective and each member state chooses the means, which allows the result to fit national legal traditions, institutions, and priorities. It also means identical European obligations can take substantially different shapes in national law, and that the timetable depends on legislative calendars, coalition politics, and the capacity of national administrations.

NIS2 has illustrated every part of that unevenness. Belgium was among the first, introducing enhanced governance duties and board-level oversight.10 Italy and Croatia finished by early 2025. The Czech law, though technically adopted, did not take effect until November 2025, thirteen months late.11

Germany's path shows what larger member states have faced. The revised act had been in preparation for over a year when the governing coalition collapsed in late 2024 and a federal election followed. The final law, arriving in December 2025, is thorough, and the fourteen-month delay meant German companies spent more than a year knowing new obligations were coming without having the law that would define them.12

France and Spain, two of the Union's largest members, were still working through the process at the end of 2025. Poland's legislation was close to done. The Netherlands, though it received a reasoned opinion, had made substantial progress without formally notifying the Commission that it had finished.13

For a company operating in several member states, the practical effect is a split compliance picture. An organisation classed as essential in Germany may face different deadlines, reporting channels, and supervisory expectations than its own operations in France or Spain. The supply chain requirements are the sharpest example, because they oblige companies to assess the cybersecurity practices of their direct suppliers, which is difficult when those suppliers sit in member states where the directive has not yet been written into law and no legal basis for enforcement exists.14

The Commission's reasoned opinions in May 2025 raised the formal stakes without offering a practical remedy. Infringement proceedings run from formal notice to reasoned opinion to referral to the Court, and the sequence usually takes years. By the time the Court could penalise a state for lateness, most will have finished anyway. The threat works as a political signal rather than as enforcement.

Board-level accountability

Germany's treatment of the board provisions repays attention, because it is the most detailed statement so far of what the governance requirements mean in practice.

Under the revised act, management bodies must not merely be told about cybersecurity risks. They must personally approve the risk-management measures their organisation adopts and oversee how those measures are carried out.15 The duty cannot be delegated. A board cannot discharge it by appointing a chief information security officer and standing back. It has to be able to show that it understands the risks the organisation faces and actively approved the response.

The liability provisions reinforce that. Board members who fail their oversight duties are personally liable for damage from incidents that proper governance would have prevented.16 The fines fall on the organisation, and the personal liability provisions mean individual directors can face separate consequences of their own.

One analysis characterises the shift as turning cybersecurity into an immediate leadership responsibility carrying personal exposure, rather than a technical matter handed to the technology department.17 Another places Germany's approach within a broader European move to fold cybersecurity into corporate governance, drawing the parallel with financial regulation, where directors have long faced personal liability for failures of risk oversight.18

Whether the model changes behaviour depends on whether boards take it seriously and whether supervisors enforce it. The financial precedent is instructive without being encouraging: directors' liability provisions have existed in banking regulation for decades and have rarely been used against individual board members for governance failures. The test of these provisions will come not from the statute but from the first enforcement action against a director who ignored them.

The Cyber Resilience Act arrives

Where NIS2 governs what organisations must do, the Cyber Resilience Act, adopted in October 2024, governs the security of the products they buy. The two fit together: NIS2 requires organisations to run secure networks and systems, while the Act requires manufacturers to build security into products with digital elements before placing them on the European market.19

On 28 November 2025 the Commission adopted Implementing Regulation 2025/2392, which supplies the technical descriptions deciding which products face the strictest treatment. Products fall into four bands: a default category covering roughly 90 per cent of everything on the market, two bands of "important" products, and a "critical" band at the top. Important products include operating systems, network management systems, and firewalls. Critical products include hardware security modules and smart meter gateways. Classification turns on what a product is mainly for rather than on features embedded incidentally, and it determines how demanding the conformity assessment is—including whether an independent third party has to certify the product before sale.

The obligations fall mostly on manufacturers, who must assess cybersecurity risk, apply security-by-design principles across the product's life, supply updates for newly discovered vulnerabilities, and document the security properties of what they sell for both users and regulators.20 Vulnerability reporting duties begin in September 2026, with the main product obligations following in December 2027.21

Layering the two instruments has a cost. An organisation under NIS2 must maintain risk-management measures, which necessarily covers the security of the products it uses. The manufacturers of those products must separately satisfy the Cyber Resilience Act. When a vulnerability turns up in a product used by a regulated organisation, the organisation's incident reporting duties and the manufacturer's vulnerability disclosure duties can both be triggered at once, potentially to different authorities, on different clocks, in different formats.

That overlap is what the Digital Omnibus was written to address.

The Digital Omnibus fix

On 19 November 2025 the Commission published the Digital Omnibus, a legislative package intended, among other things, to tidy the tangle of incident reporting duties that has accumulated across European digital law.22

Its cybersecurity centrepiece is a single entry point: one reporting interface, to be built and run by the European Union Agency for Cybersecurity, through which an organisation can file one notification that satisfies reporting duties under several laws at once.23 The shorthand is "report once, share many". An organisation hit by an incident files one standardised report, and the entry point sorts and forwards the relevant parts to the right authorities under NIS2, the General Data Protection Regulation, the financial sector's operational resilience regulation known as DORA, the electronic identification regulation, and the Critical Entities Resilience Directive.24

The problem being solved is real. A bank suffering an incident that affects personal data may owe reports under NIS2 to the national incident response team, under the data protection regulation to the data protection authority within seventy-two hours, under DORA to its financial supervisor, and, if it runs critical infrastructure, under the Critical Entities Resilience Directive as well.25 Each regime has its own deadline, its own content requirements, and its own recipient. The combined burden is not merely administrative. In the hours after an incident, when the organisation should be concentrating on containment and repair, preparing several reports for several authorities pulls attention and people away from the response.

The promise is considerable—the timing is the difficulty. The entry point would only begin operating eighteen to twenty-four months after the Omnibus takes effect, following a pilot.26 The proposal has still to pass the European Parliament and the Council, which usually takes one to two years.27 Genuine harmonisation of incident reporting therefore looks unlikely before 2028, three to four years after the duties it aims to streamline started to bite.

DIGITALEUROPE, the industry association, welcomed the package as a first step and argued it does not go far enough, calling for deeper consolidation of overlapping requirements rather than a fix at the reporting layer.28 Slaughter and May questioned whether the entry point can really deliver "report once, share many", noting that the various regimes define a reportable incident differently, set different severity thresholds, and ask for different information. A common interface can accommodate those differences. It cannot remove them.

Harmonisation in practice

NIS2 states its purpose as achieving a high common level of cybersecurity across the Union. Its recitals acknowledge that the original directive proved insufficient against a changing threat landscape and left cybersecurity fragmented between member states.29 The fix was meant to come through clearer scope, stronger obligations, and less national discretion.

Fourteen months past the deadline, the picture is mixed. The substantive provisions covering risk management, incident reporting, board accountability, and supply chain security are among the most comprehensive cybersecurity obligations anywhere. Extending scope to 160,000 organisations is a genuine change of scale. Germany has demonstrated that the board accountability model can be turned into enforceable national law.

The process of getting there, though, produced exactly the temporary fragmentation the directive was meant to prevent. Companies working across borders face different deadlines in different states. The supply chain obligations assume a uniformity that does not yet exist. The interaction between NIS2, the Cyber Resilience Act, DORA, and the rest has created overlapping layers that the Omnibus addresses without having resolved.

The deeper question is whether twenty-seven national laws, written at different speeds, in different legal traditions, through different institutions, can ever produce genuine uniformity rather than a rough convergence that leaves real national variation intact. The directive sets a floor. It cannot govern what each member state builds on top of it.

Germany is the most detailed case so far: 29,000 organisations, personal liability for boards, a registration portal opening in January 2026, and a supervisory framework more prescriptive than the directive demands.30 Whether France takes a similarly expansive approach when it finishes, or whether smaller member states implement only the minimum, is not yet known. The consistency NIS2 promised is real as an aspiration. In practice it is still being assembled, one national law at a time, across a continent that agrees on the destination without yet agreeing how quickly to reach it.

Footnotes

  1. European Commission, "Directive on Measures for a High Common Level of Cybersecurity across the Union (NIS2 Directive)—FAQs," 2025. ↩

  2. Greenberg Traurig LLP, "EU NIS 2 Directive: Expanded Cybersecurity Obligations for Key Sectors," August 2025. ↩

  3. NIS2 Directive, Article 2. ↩

  4. European Commission, "NIS2 Directive: Securing Network and Information Systems," 2025. ↩

  5. NIS2 Directive, Article 21. ↩

  6. NIS2 Directive, Article 23. ↩

  7. Goodwin Procter LLP, "Navigating NIS2: What Organisations Need to Know as EU Implementation Unfolds," October 2025. ↩

  8. NIS2 Directive, Article 34. ↩

  9. NIS2 Directive, Article 20. ↩

  10. White & Case LLP, "NIS 2: One Year Later," 2025. ↩

  11. ECSO, "NIS2 Directive Transposition Tracker," 2025. ↩

  12. Reed Smith LLP, "Finally: Germany Enacts Its NIS2 Law," December 2025. ↩

  13. Wavestone, "NIS 2 Directive: Transposition Status and What Companies Must Do," 2025. ↩

  14. Morrison Foerster, "Flipping the NIS2 Switch: What Germany's Implementation Means for 2026 Compliance," December 2025. ↩

  15. Greenberg Traurig LLP, "NIS2 in Germany: The New BSI Act Makes Cybersecurity a Board-Level Issue," December 2025. ↩

  16. Ibid. ↩

  17. Ibid. The wording here paraphrases that analysis rather than quoting it, since the original phrasing could not be confirmed directly. ↩

  18. ISC2, "Enabling Germany's Cyber Resilience," December 2025. Paraphrased on the same basis. ↩

  19. European Commission, "The Cyber Resilience Act—Summary of the Legislative Text," 2025. ↩

  20. Taylor Wessing, "The Cyber Resilience Act—EU-Wide Requirements for the Cybersecurity of Products," November 2025. ↩

  21. European Commission, "Cyber Resilience Act," 2025. ↩

  22. Bird & Bird, "Digital Omnibus Package: Single EU Harmonised Incident Reporting Regime across Cyber and Data Protection," November 2025. ↩

  23. Hunton Andrews Kurth LLP, "EU Digital Omnibus Introduces a Single Reporting Point for Cybersecurity Incidents," November 2025. ↩

  24. Taylor Wessing, "The Digital Omnibus and Incident Reporting," November 2025. ↩

  25. Bird & Bird, "Digital Omnibus Package," November 2025. ↩

  26. Slaughter and May, "EU Proposes Single-Entry Point for Cyber Incident Reporting, But Is It Really 'Report Once, Share Many'?", 2025. ↩

  27. This was the position when this piece was written. The Council and the European Parliament reached a provisional agreement on the Digital Omnibus on 7 May 2026. ↩

  28. DIGITALEUROPE, "Digital Omnibus: A First Step and What Must Come Next, Now," November 2025. ↩

  29. NIS2 Directive, Recitals 1–7. ↩

  30. Cyble, "Germany NIS-2 Implementation Act Strengthens Cybersecurity," December 2025. ↩