NIS2Free Resource
EU NIS2 Directive Timeline and Compliance Guide
NIS2 is an EU directive on cybersecurity governance, risk management, and significant-incident reporting. It generally covers medium-sized and larger entities of a type listed in Annex I or II that provide services or carry out activities in the Union. Article 2 also captures specified entities regardless of size.
By Sorena AIBased on official EU sourcesUpdated 25 July 2026
Quick scan
NIS2Scope
Map the legal entity and service to Annex I or II, calculate SME status using group relationships, check special inclusions and exclusions, then apply the Article 26 jurisdiction rules.
Controls
Management bodies approve and oversee appropriate and proportionate measures. Apply Regulation 2024/2690 only to its named entity types.
Reporting
For a , preserve the awareness decision and route the early warning within 24 hours, the incident notification within 72 hours, requested updates, and the final or progress report through the applicable national channel.
Use the EU text for the baseline, then validate each in-scope entity against the applicable national law, competent authority, registration route and incident-reporting channel.
Key dates
16 Jan 2023
In force
17 Oct 2024
Transposition
17 Apr 2025
Entity lists
2024/2690
Implementing act
What you can decide faster
In scope or out of scope
Map the actual service to an Annex I or Annex II entity type. Then test whether the entity is medium-sized or larger using annual work units, turnover or balance-sheet data and the partner and linked-enterprise aggregation rules. The SME definition normally requires a threshold change over two consecutive accounting periods before status changes. Check every regardless-of-size and Member State identification path before concluding that a small entity is outside scope.
Essential vs important
Both tiers have Articles 20, 21 and 23 duties. The main EU-level difference is supervision: can face ex ante and ex post supervision under Article 32, while are supervised ex post under Article 33.
Controls + reporting
Management bodies must approve and oversee proportionate measures, including supply-chain security, and follow training. Prepare reporting for significant incidents. Regulation (EU) 2024/2690 adds detailed control requirements and significance criteria only for the provider types it names. A sector-specific Union act displaces corresponding NIS2 duties only where Article 4's equivalence test is met.
Essential vs important
Article 21 baseline
24h/72h reporting
Publication details
Editorial metadata for this artifact
Author
Sorena AI
Published
Feb 23, 2026
Updated
Jul 25, 2026
Start with the legal entity and each service. Map the exact Annex row, calculate SME status using partner and linked-enterprise data, check size-independent and sector-specific-law rules, classify the entity as essential or important, and identify jurisdiction. The Directive is the EU baseline; national implementing law controls local registration, authority routes, procedure, supervision, and penalties.
NIS2 Timeline
Key dates for NIS2 compliance planning
Track adoption, the 17 October 2024 transposition deadline, entity-list and registry dates, Regulation (EU) 2024/2690, the Commission's 2025 reasoned opinions, and its 8 July 2026 Court referrals concerning Ireland, Spain, France, and the Netherlands. These enforcement steps do not replace a current country-law check.
Loading timeline...
Recommended reading path
Choose the next NIS2 decision
New to NIS2? Start with the legal entity, service, sector, size and Member State nexus. Once scope and tier are documented, move to governance, controls, incident reporting, national implementation or the comparison you need.
1
Start here: scope, sector and entity tier
Decide whether the Directive covers the entity and service, whether a size-independent rule applies, whether the entity is essential or important, and which Member State route needs validation.
EU NIS2 Directive applicability test for entity scope
Stepwise NIS2 applicability test for Annex I and Annex II sectors, medium and large entities, size-independent cases, essential or important classification, jurisdiction, and evidence.
Read guide
NIS2 Annex I and Annex II Sector Scoping Guide
Map NIS2 Annex I and Annex II sectors, entity types, size-cap rules, and essential versus important entity classification with official EU sources.
Read guide
NIS2 Size Cap Rule and Special Scope Cases
Apply the NIS2 medium-size test, group-data rules, regardless-of-size cases, exclusions, and essential-versus-important classification.
Read guide
NIS2 Entity Classifier Workflow: essential vs important entity scoping
Classify whether an EU service is out of scope, an important entity, an essential entity, or needs national-authority review under the NIS2 Directive.
Read guide
NIS2 essential vs important entities: Article 3 scope and supervision guide
Classify NIS2 essential and important entities using Article 3, Annex I and II sector scope, size-cap rules, registration evidence, and the Article 32/33 supervision split.
Read guide
NIS2 Registration and Authority Notification Guide
Map NIS2 Article 3 entity-list duties, Article 27 registry submissions, competent-authority contacts, and national registration portal evidence without inventing country deadlines.
Read guide
2
Governance, controls, evidence and enforcement
Translate the classification into management-body decisions, proportionate Article 21 measures, supply-chain controls, evidence records, supervisory readiness and penalty analysis.
NIS2 entity supervision guide
Compare NIS2 essential and important entities by scope, Article 21 and 23 duties, Article 32 and 33 supervision, evidence, jurisdiction, and penalties.
Read guide
NIS2 Management Body Accountability: board duties, training, and evidence
A guide to NIS2 Article 20 management body accountability: approval of Article 21 measures, oversight, national liability rules, training, reporting lines, and evidence.
Read guide
NIS2 Article 21 control baseline and evidence checklist
Build a NIS2 Article 21 control baseline from the Directive's minimum cybersecurity risk-management measures, proportionality test, supplier duties, and evidence expectations.
Read guide
NIS2 Article 21 control-by-control evidence checklist
Map NIS2 Article 21 risk-management measures to evidence records for governance, incident handling, continuity, supply chain, testing, cyber hygiene, cryptography, access, assets, and authentication.
Read guide
NIS2 Article 21 Gap Assessment Workflow: controls, evidence, and owners
Assess NIS2 Article 21 cybersecurity risk-management gaps by mapping current controls to Article 21(2), ownership, evidence, supplier risk, and management review.
Read guide
NIS2 Supply Chain Security Program: Article 21 Guide
Apply NIS2 Article 21 to direct suppliers and service providers, and distinguish its general duty from Regulation 2024/2690's digital-entity controls.
Read guide
NIS2 Requirements: scope, Article 21 controls, reporting, and evidence
Map NIS2 requirements for essential and important entities: scope classification, management-body duties, Article 21 cybersecurity measures, Article 23 incident reporting, and evidence records.
Read guide
NIS2 Compliance Checklist: scope, controls, reporting
This NIS2 compliance checklist helps confirm scope, entity classification, management-body duties, Article 21 controls, Article 23 reporting, and evidence.
Read guide
NIS2 Compliance Guide: scope, controls, reporting, and evidence
A practical NIS2 compliance guide for mapping entity scope, Article 21 risk measures, Article 23 incident reporting, management accountability, and evidence records.
Read guide
NIS2 penalties and fines: Article 34 maximum levels and factors
NIS2 Article 34 fine levels, calculation factors, enforcement measures, GDPR overlap, and national-law checks for essential and important entities.
Read guide
3
Significant-incident triage and reporting
Build the significance decision, awareness timestamp, national authority route, staged Article 23 submissions, recipient communications and defensible incident evidence before a crisis.
NIS2 Article 23 incident notification workflow
Map NIS2 Article 23 reporting duties for significant incidents: 24-hour early warning, 72-hour notification, intermediate reports, final report, recipients, and evidence.
Read guide
NIS2 incident clock triage workflow
Triage a possible NIS2 significant incident by recording awareness time, severity, impact, authority route, recipient communications, and Article 23 reporting clocks.
Read guide
NIS2 Incident Reporting Workflow: 24-hour, 72-hour, and final report steps
Build a NIS2 Article 23 incident reporting workflow with significance triage, CSIRT or authority notification steps, recipient communication, cross-border checks, and evidence records.
Read guide
4
Dates and national implementation
Separate EU-level dates and historical infringement steps from the current national law, registration mechanism, authority instructions and operational country overlay that apply to each entity.
EU NIS2 Directive deadlines and compliance calendar | Article 23 clocks
NIS2 compliance calendar for EU transposition, Article 3 and 27 registration updates, Article 23 incident reports, technical measures, and the 2027 review.
Read guide
NIS2 Country Implementation Matrix: Authorities, Portals, and Local Deltas
Build an operational NIS2 country matrix for applicable national law, competent authorities, registration, incident portals, local implementation deltas, evidence, and review dates.
Read guide
NIS2 National Transposition Tracker: EU Member State Evidence Register
Track NIS2 national transposition with Commission country pages, Article 41 dates, reasoned-opinion flags, source wording, authority contacts, and legal review triggers.
Read guide
5
Compare regimes or answer a focused question
Keep NIS2 duties separate from CER, DORA, GDPR, NIS1 and voluntary ISO evidence, or use the FAQ when you already know the question you need to resolve.
NIS2 vs CER Directive comparison: cyber obligations and critical-entity resilience
Compare NIS2 and the CER Directive using cited rows for scope, triggers, evidence, incident handling, supervision, and shared critical-entity work.
Read guide
NIS2 vs DORA: scope, overlap, and evidence for EU cyber compliance
Compare NIS2 and DORA for EU cyber compliance: covered entities, when DORA replaces NIS2 duties for financial entities, incident reporting, evidence, and supervisory handoffs.
Read guide
NIS2 vs GDPR breach reporting: EU deadlines and overlap
Compare NIS2 significant-incident reporting with GDPR personal-data-breach reporting, including scope, 24-hour and 72-hour clocks, evidence, and overlap.
Read guide
NIS2 vs ISO/IEC 27001: legal duties, ISMS evidence, and reuse limits
Compare NIS2 legal obligations with ISO/IEC 27001 ISMS requirements: scope, Article 21 controls, incident clocks, SoA evidence, audits, and certification reuse.
Read guide
NIS2 vs ISO/IEC 27017: legal duties, cloud controls, and reuse limits
Compare NIS2 legal obligations with ISO/IEC 27017 cloud-service controls: entity scope, Article 21 measures, incident clocks, shared responsibility, evidence, and assurance limits.
Read guide
NIS2 vs NIS1: what changed in EU cybersecurity compliance
Compare NIS2 with the repealed NIS1 Directive: expanded sectors, essential and important entities, management-body duties, Article 21 controls, Article 23 reporting, and supervision.
Read guide
NIS2 FAQ: scope, Article 21 controls, incident reporting, and penalties
NIS2 FAQ on entity scope, essential and important classification, Article 21 measures, Article 23 reporting, national implementation, and evidence.
Read guide
Next step
Turn NIS2 scoping, controls, and reporting into an assessment workflow
Use the timeline as the entry point for an NIS2 work plan: confirm Annex I or Annex II scope, record essential or important entity status, assign control owners, and prepare the incident reporting clock for the Member State authorities that apply to your services.
What this unlocks
- Create a scope record for each service, legal entity, Member State, Annex sector, size-cap result, and any regardless-of-size trigger.
- Translate Article 20 and into management approvals, risk-management measures, control owners, and evidence requests.
- Prepare incident triage so significant incidents can move from early warning to notification to final report within the NIS2 reporting sequence.
- Track national transposition overlays separately from the EU-level dates because portals, supervisory routes, and penalty rules are Member State specific.
Recommended route
Open Assessment Autopilot
Convert NIS2 scope, Article 21 measures, and reporting duties into owned tasks, evidence requests, and review checkpoints.
Supporting route
Open Research Copilot
Research scope, timing, Article 4 overlap, and Member State implementation questions with cited outputs.
Talk to Sorena
Talk through implementation
Review NIS2 applicability, control evidence, incident reporting handoffs, and national implementation dependencies.
Discuss your setup
Share it internally
Download the timeline export to align legal, product, engineering, and commercial teams on milestones and deadlines.