There Is No Single NIS2 Deadline. That’s the Compliance Problem.

There is no single NIS2 compliance deadline any more. The transposition deadline passed in October 2024, and if your organisation is waiting for one date to work towards, the date that now applies depends on where you operate.

Member states had until 17 October 2024 to transpose NIS2 into national law. Most did not. In July 2026 the European Commission referred Ireland, Spain, France, and the Netherlands to the Court of Justice of the European Union for failing to notify their transposing measures — closing on two years past the deadline.

The result is a compliance landscape with no common clock. Germany’s BSIG entered into force in December 2025 with no transition period, and the BSI registration portal opened on 6 January 2026. Other member states are running their own registration, audit, and reporting timetables across 2026 and 2027. An organisation operating in five EU markets does not have one NIS2 deadline. It has five, and they are not aligned.

What varies, and what does not

What varies by member state

The timetable and the administrative detail: when registration opens and closes, which national authority supervises, what the audit cadence looks like, and how quickly penalties become enforceable.

What is fixed by the directive

The substance does not vary, because it comes from the directive rather than the transposing law. Article 21 requires cybersecurity risk-management measures. Article 23 sets the reporting clock: an early warning within 24 hours of becoming aware of a significant incident, a fuller notification within 72 hours, and a final report within one month. Article 20 makes management bodies responsible for approving and overseeing those measures, and requires them to undertake training. Article 34 caps administrative fines at €10 million or two percent of total worldwide annual turnover for essential entities, and €7 million or 1.4 percent for important entities.

An organisation that builds to the directive is ready for whichever national deadline arrives first. An organisation that builds to one country’s checklist is ready for one country.

The obligation that is hardest to retrofit

Registration is administrative. Documentation is a project with a due date. The Article 23 reporting clock is neither, because it is the only obligation that has to work under pressure, on the day, with whoever happens to be available.

Twenty-four hours sounds generous until the first hours of an incident go on establishing what is actually happening. The early warning has to leave while the picture is still forming. The fuller notification at 72 hours has to be consistent with it. Both have to hold up afterwards, in front of a supervisory authority that will ask how each conclusion was reached. That is a capability, not a document — and it is the part organisations most often find they do not have at the moment they need it.

What this means in practice

RAYVN closes that gap by making the record a by-product of the response rather than a task after it. When mobilisation, escalation, and every decision are logged as they happen, the notification is drawn from a live, time-stamped record instead of reconstructed from memory against a running clock — and the same record answers the supervisory questions that follow.

This article summarises NIS2 for general information and reflects our reading of the directive and the national transposing laws as they stand. It is not legal advice and should not be relied on as such. For a definitive view on how these rules apply to your organisation, consult a qualified legal adviser.