The NIS2 Directive entered into force on January 16, 2023, after being published in the Official Journal of the European Union. However, it is important to distinguish between the entry into force of a directive and its concrete application. Directives set objectives that EU member states must achieve, but leave each country the freedom to implement them through their own national laws.

Deadline for implementation and review

Although the NIS2 Directive entered into force in 2023, EU member states had until October 17, 2024, to transpose it into their national laws. This 21-month period between the entry into force and the transposition deadline allowed countries to adjust their regulatory frameworks. For organizations that need to verify their scope of application and start a structured path, ISGroup’s NIS2 compliance support covers the entire process, from gap analysis to the implementation of the required measures.

The European Commission will then proceed to periodically review the functioning of the directive and will present a report to the European Parliament and the Council, with the first report scheduled for October 17, 2027. This review process ensures that the directive remains relevant and effective in addressing the ever-evolving cybersecurity landscape. The full text can be consulted in the official document of the NIS2 Directive.