DeadlinesEU

EU NIS2 Directive (EU) 2022/2555 Deadlines and Compliance Calendar

Turn NIS2 dates into deliverables, owners, and escalation gates.

Focus: legal anchor dates, transposition reality, entity listing milestones, and operational readiness for Article 21 and Article 23.

Back to main artifact Review sources

Author

Sorena AI

Published

Feb 23, 2026

Updated

Feb 23, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published Feb 23, 2026

Updated Feb 23, 2026

Overview

Dates only help if they drive work. Use this page to convert NIS2 anchor dates into scope memos, entity registry submissions, management approvals, incident reporting tests, and evidence refresh cycles.

Section 1

EU-level anchor dates you should track

These dates are in the directive or in official Commission material. National measures can add registration or reporting steps, but they do not replace these EU-level anchors.

16 January 2023: NIS2 entered into force.
17 October 2024: Member States had to adopt and publish transposition measures.
18 October 2024: Member States had to apply those measures, and NIS1 was repealed.
17 January 2025: entities within Article 27 had to submit core entity information to competent authorities, and Member States had to notify the Commission of national penalty rules under Article 36.
17 April 2025: Member States had to establish lists of essential and important entities and notify key figures to the Commission.

Section 2

Current transposition milestones you should reflect in planning

The Commission tracker is a state-of-play tool, not a formal legal assessment. It is still useful for planning because it shows where local overlays may still be moving.

7 May 2025: the Commission sent reasoned opinions to 19 Member States for not notifying full transposition.
1 July 2025: the Commission transposition tracker page showed its latest update date.
20 January 2026: the Commission proposed targeted NIS2 amendments to simplify and clarify parts of the framework. This is a proposal, not current law.

Recommended next step

Turn EU NIS2 Directive (EU) 2022/2555 Deadlines and Compliance Calendar into an operational assessment

Assessment Autopilot can take EU NIS2 Directive (EU) 2022/2555 Deadlines and Compliance Calendar from planning deadlines, owners, and milestones from this page to a reusable workflow inside Sorena. Teams working on EU NIS2 Directive (EU) 2022/2555 can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

Assessment workflow

Open Assessment Autopilot for EU NIS2 Directive (EU) 2022/2555 Deadlines and Compliance Calendar

Start from EU NIS2 Directive (EU) 2022/2555 Deadlines and Compliance Calendar and turn the guidance into owned tasks, evidence requests, and review checkpoints.

Explore next step

Talk to Sorena

Talk through EU NIS2 Directive (EU) 2022/2555

Review your current process, evidence gaps, and next steps for EU NIS2 Directive (EU) 2022/2555 Deadlines and Compliance Calendar.

Explore next step

Section 3

What to deliver before each milestone

Convert each date into a concrete output. If a calendar item does not point to a file, a register, or a tested workflow, it is too vague.

Before transposition review: scope memo, Annex I or Annex II mapping, essential or important classification note, and Article 4 overlap analysis.
Before Article 27 data collection: entity registry data set, legal-entity identifiers, contact points, and service mapping ready for authority submission.
Before operational go-live: authority and CSIRT route map, portal accounts, 24h and 72h templates, and a tested significant incident decision log.
Before supervisory contact: Article 21 control register, management approval evidence, and indexed evidence vault.

Section 4

Internal recurring calendar items

NIS2 compliance is a repeating management system. Use recurring reviews to keep evidence current and reduce incident severity.

Monthly: vulnerability backlog review, patch SLA performance, and privileged access and MFA coverage checks.
Monthly: backup integrity and restore test review for critical systems.
Quarterly: supplier risk review, incident reporting tabletop, and management oversight meeting.
Annually: crisis simulation, evidence vault refresh, and scope memo revalidation after organisational changes.

Primary sources