NIS2 Timeline: Every Deadline from Adoption to the 2027 Review

The national measures had to apply from 18 October 2024, the same day NIS1 was repealed.

The NIS2 Directive is addressed to the Member States (Article 46), so a company does not count its duties from 17 October 2024: it follows its national law from the date that law applies. As of 23 October 2026, the next EU dates are 17 January 2027, 17 April 2027 and 17 October 2027, all set by the NIS2 Directive itself.

The eight milestones below lead from the signature to the 2027 review. The sections that follow add the adoption procedure, the follow-up deadlines for Member States and the Commission, the infringement steps, the dates still ahead and the time limits that start from an event.

What Is the NIS2 Deadline?

The NIS2 deadline is 17 October 2024: by that date the 27 Member States had to adopt and publish the laws, regulations and administrative provisions needed to comply with the Directive, and they had to apply them from 18 October 2024 (Article 41(1)). Both dates stand in the final provisions of the Directive text on EUR-Lex, and neither one names a company.

As of 23 October 2026, the dates that bind a company come from its national law, so the national transposition status decides which deadline applies. Not every Member State met 17 October 2024: on 8 July 2026 the Commission decided to refer four of them to the Court of Justice of the EU, as the infringement section below sets out. Each national law, its date and its authority are listed in the NIS2 transposition tracker.

Why 17 October 2024 Did Not Bind Companies Directly

A directive addresses the Member States (Article 46), so 17 October 2024 was a deadline for national legislators, not for essential or important entities. The date obliged parliaments and governments to pass the transposing law; it set no duty for a company.

What, then, starts a company's duties? The duties of essential and important entities, such as the cybersecurity risk-management measures of Article 21 and the reporting of Article 23, start when the national law applies, and that date differs per Member State. A national law adopted after the deadline binds companies only from its own date of application. Commission Implementing Regulation (EU) 2024/2690 is the only NIS2 act that applies directly, and it covers only the 11 entity types of Regulation (EU) 2024/2690, such as cloud computing service providers, managed service providers and online marketplaces. NIS2 was never "enforceable" against companies from 18 October 2024 except through a national law in force on that date.

How Was NIS2 Adopted? From the 2020 Proposal to the Official Journal

NIS2 took two years from proposal to publication: the Commission proposed it on 16 December 2020 as COM(2020) 823, the European Parliament and the Council signed it on 14 December 2022, and it appeared in the Official Journal (OJ L 333) on 27 December 2022. The act carries the date of its signature, which is why its full name is Directive (EU) 2022/2555 of 14 December 2022.

The ordinary legislative procedure 2020/0359(COD), recorded in the European Parliament Legislative Observatory, ran through a committee vote in ITRE on 28 October 2021, the Parliament's first reading on 10 November 2022 and the Council's adoption on 28 November 2022. How the published act is organised is set out under Directive (EU) 2022/2555 full text and structure.

When Did NIS2 Enter into Force and Become Applicable?

NIS2 entered into force on 16 January 2023, the twentieth day after its publication (Article 45), and it has applied through national law from 18 October 2024 (Article 41(1)), the day NIS1 was repealed (Article 44). The table below lists every event of those two dates with its legal effect.

Entry into Force on 16 January 2023

Entry into force on 16 January 2023 started the transposition period and the Commission's clocks, but it created no duty for companies. From that day the Directive bound the Member States, and the period for their national laws ran until 17 October 2024.

Which provisions use the date itself? The date matters twice in the text. Article 3(1)(g) lets a Member State keep entities that it identified as operators of essential services under NIS1 or national law before 16 January 2023 as essential entities. Article 38(2) gives the Commission the power to adopt delegated acts under Article 24(2) on certified ICT products, services and processes, to be used where insufficient levels of cybersecurity have been identified, for five years from 16 January 2023. That power therefore ends on 16 January 2028 (calculated), unless it is extended or revoked.

Transposition by 17 October 2024 and Application from 18 October 2024

Article 41(1) set two dates one day apart: adopt and publish the national measures by 17 October 2024, apply them from 18 October 2024. The first date closed the legislative window; the second opened the period in which those national measures bind entities.

National measures must contain a reference to the Directive (Article 41(2)), which lets readers trace a national section back to its NIS2 article. Two Commission and Member State tasks shared the 17 October 2024 date: the implementing acts under Articles 21(5) and 23(11), and the notification under Article 34(8) by Member States whose legal systems do not provide for administrative fines. Where Article 41 sits among the final provisions is shown under all 46 NIS2 articles explained.

What Was Repealed and Deleted on 18 October 2024

Three provisions of earlier EU law ended on 18 October 2024, the same day the national NIS2 measures had to apply. They are listed below.

• NIS1: Directive (EU) 2016/1148 was repealed with effect from 18 October 2024 (Article 44); see NIS2 vs NIS1.
• eIDAS security requirements: Article 19 of Regulation (EU) No 910/2014 was deleted (Article 42); see trust service providers.
• EECC security rules: Articles 40 and 41 of Directive (EU) 2018/1972 were deleted (Article 43); see public electronic communications networks and services.

Which Deadlines Followed for Member States and the Commission?

Between July 2023 and April 2025 the Directive set 11 further deadlines, from the Commission's Article 4 guidelines due by 17 July 2023 to the national lists of essential and important entities due by 17 April 2025. The table below gives each deadline with its addressee and article.

Implementing Acts and Commission Guidelines

The Commission met the 17 October 2024 deadline of Articles 21(5) and 23(11) by adopting Implementing Regulation (EU) 2024/2690 that day; it was published on 18 October 2024 and has applied directly since 7 November 2024 (Article 16). The Regulation text on EUR-Lex, Commission document C(2024) 7151, sets the technical and methodological requirements of the risk-management measures and the cases of a significant incident for its 11 entity types, and it repeals Implementing Regulation (EU) 2018/151.

Guidelines came earlier. The Article 4(3) guidelines on sector-specific Union legal acts were due by 17 July 2023 and were published on 14 September 2023, together with the Commission's Article 3(4) guidelines; the Article 4 guidelines appeared in OJ C 328, 18.9.2023, p. 2. Both sets of guidelines are non-binding, unlike Implementing Regulation (EU) 2024/2690.

The Registry Date of 17 January 2025 and the Other January 2025 Deadlines

17 January 2025 was the date by which the 11 types of Article 26(1)(b) had to submit their registry information to the competent authority (Article 27(2)); it was never a registration date for all entities. The 11 types include DNS service providers, TLD name registries, entities providing domain name registration services and cloud computing service providers, but not trust service providers.

Which other deadlines fell on the same day? Three more: Member States notified their penalty rules to the Commission (Article 36), the CSIRTs network delivered its first report on operational cooperation to the Cooperation Group (Article 15(4)), and the Cooperation Group had to establish the peer-review methodology. Article 19(1) reads "by 17 January 2025" as corrected by the English corrigendum OJ L, 2023/90206; the original text said "on".

The Entity Lists Due by 17 April 2025

Member States had to establish a list of essential and important entities and of entities providing domain name registration services by 17 April 2025, and they review it at least every two years (Article 3(3)). The next review therefore falls due by 17 April 2027 (calculated).

Competent authorities notify the number of essential and important entities per sector and subsector to the Commission and the Cooperation Group by the same date and every two years (Article 3(5)). The entities themselves provide the Article 3(4) data: name, address and contact details, sector and subsector, and the Member States they serve. The list records the outcome of the entity test; it does not decide whether an organisation is in scope, which follows from the NIS2 entity test step by step.

Which Member States Missed the Deadline? The Infringement Steps

The Commission opened infringement procedures for non-transposition on 28 November 2024, sent reasoned opinions to 19 Member States on 7 May 2025 and, on 8 July 2026, decided to refer Ireland, Spain, France and the Netherlands to the Court of Justice of the EU (IP/26/1499). The 23 Member States that received a letter of formal notice in November 2024 are named in the Commission's infringement package INF/24/5988.

The three steps follow Article 258 TFEU: a letter of formal notice, a reasoned opinion with two months to respond, and a referral to the Court. For a failure to notify transposition measures, Article 260(3) TFEU lets the Commission ask the Court for a lump sum and daily penalties, and the Commission did so in its press release IP/26/1499. The reasoned opinions are recorded on the Commission NIS transposition page. The table below lists the steps with the Member States named at each one.

The referral is a request to the Court: the Court decides whether a lump sum and daily penalties are imposed, and the penalties requested run until the Member State notifies complete transposition. A Member State's place in this table says nothing about its law as of 23 October 2026; each country page gives that national status with its own date.

Which NIS2 Deadlines Are Still Ahead?

As of 23 October 2026, the next EU-level NIS2 dates are the second CSIRTs network report by 17 January 2027, the review of the national entity lists by 17 April 2027 and the Commission's review report by 17 October 2027. The table marks each date as fixed, when the Directive names the day, or calculated, when it follows from a Directive interval.

The Commission Report Due by 17 October 2027

Article 40 requires the Commission to review the functioning of NIS2 and report to the European Parliament and the Council by 17 October 2027, then every 36 months, so the following report falls due on 17 October 2030 (calculated). The 2027 date is the only one in the table above that the Directive fixes to the day.

What does the review assess? The report assesses the relevance of the size of the entities concerned and of the sectors, subsectors and entity types in Annexes I and II, and the Commission accompanies it, where necessary, with a legislative proposal (Article 40). Recital 140 adds a specific question: whether very large online platforms designated under Article 33 of the Digital Services Act could be essential entities. A review report changes no rule by itself; only an adopted amending act would.

Recurring Reports and Work Programmes of the EU Bodies

Three EU bodies report on fixed cycles: the Cooperation Group adopts a work programme every two years from 1 February 2024 (Article 14(7)), EU-CyCLONe reports every 18 months from 17 July 2024 (Article 16(7)) and the CSIRTs network reports every two years from 17 January 2025 (Article 15(4)). Their next dates under those intervals are listed below.

• Cooperation Group: third work programme by 1 February 2028 (calculated).
• EU-CyCLONe: third report to Parliament and Council by 17 July 2027 (calculated).
• CSIRTs network: second report to the Cooperation Group by 17 January 2027 (calculated).

ENISA adds a fourth cycle: Article 18(1) requires a biennial report on the state of cybersecurity in the Union, the first of which ENISA published on 3 December 2024, and ENISA states that the next edition is due in 2026.

Which Time Limits Run from an Event Rather Than a Date?

Five NIS2 time limits start from an event, not from a calendar date: two weeks for changes to Article 3(4) data, three months for changes to Article 27 registry data, three months for notifying a national strategy or a crisis management authority, and 72 hours for answering a request for domain registration data. The table adds the incident-reporting clock of Article 23(4) as a sixth row, because it also starts from an event.

Two of these limits concern registration data. The two-week limit of Article 3(4) and the three-month limit of Article 27(3) apply to different data sets, so an entity of an Article 26(1)(b) type tracks both. National strategies themselves are assessed at least every five years (Article 7(4)).

What the NIS2 Dates Mean for Your Organisation

Turn the EU dates into your own calendar in five steps, starting from the national law that binds your organisation. The five steps are listed below.

1. Check the national law and its date of application in the NIS2 transposition tracker.
2. Confirm whether NIS2 is likely to apply with the NIS2 scope check.
3. Register under the national rules and keep the data current: see NIS2 registration and data changes.
4. Set up the reporting process for the 24-hour, 72-hour and one-month stages: see NIS2 incident reporting deadlines.
5. Have the management body approve and oversee the measures: see management body duties under Article 20.

Which Pending Proposals Could Add New Dates?

Two pending proposals would change NIS2, and as of 23 October 2026 neither has been adopted: COM(2026) 13 of 20 January 2026 (procedure 2026/0012(COD)), with the European Parliament at the stage "Awaiting committee decision", and the Digital Omnibus COM(2025) 837 of 19 November 2025 (2025/0360(COD)), for which Coreper agreed the Council mandate on 21 October 2026. In the Legislative Observatory file on 2026/0012(COD), the ITRE draft report PE792.221 is dated 24 September 2026 and the amendments PE796.471 13 October 2026; the Council mandate on the Omnibus is document ST 14756/26.

No amending act has been adopted, so NIS2 applies unamended as of 23 October 2026. Any new deadline would come from the text that Parliament and Council finally adopt, and none can be stated before then. There is no "NIS3": both proposals would amend Directive (EU) 2022/2555. Their content and stages are tracked under NIS2 amendments and review.

Dates of Connected EU Acts

Three connected EU dates sit next to the NIS2 calendar. They are listed below.

• DORA: Regulation (EU) 2022/2554 has applied since 17 January 2025 (Article 64); for its financial entities it displaces NIS2 Articles 20, 21, 23 and Chapter VII via NIS2 Article 4, while NIS2 Articles 7, 9 and 16 still apply; see NIS2 vs DORA.
• CER Directive: Member States had to identify critical entities under Directive (EU) 2022/2557 by 17 July 2026 (Article 6(1)), and these are NIS2 essential entities regardless of size (NIS2 Articles 2(3) and 3(1)(f)); see NIS2 vs the CER Directive.
• ENISA guidance: the Technical Implementation Guidance v1.0 of 26 June 2025 accompanies Regulation (EU) 2024/2690 and is not legally binding.

NIS2 Deadline Questions

Five questions recur about the NIS2 deadlines.

Were companies bound by NIS2 from 17 October 2024?

No: 17 October 2024 bound the Member States (Articles 41(1) and 46), and a company is bound from the date its national NIS2 law applies.

Is there a single EU-wide date by which companies must comply?

No: the Directive sets dates for Member States, the Commission and the EU bodies, and for companies only the Article 27(2) registry date of 17 January 2025, which applies to the 11 types of Article 26(1)(b).

When did NIS1 stop applying?

Directive (EU) 2016/1148 was repealed with effect from 18 October 2024 (Article 44 NIS2). What changed between the two acts is compared under NIS2 vs NIS1.

What happens after a Member State misses the transposition deadline?

The Commission can send a letter of formal notice, then a reasoned opinion and then refer the Member State to the Court of Justice, asking for a lump sum and daily penalties (Articles 258 and 260(3) TFEU), as it did for four Member States on 8 July 2026.

Which NIS2 dates fall in 2027?

Four: the CSIRTs network report by 17 January 2027, the entity list review by 17 April 2027, the EU-CyCLONe report by 17 July 2027 and the Commission review by 17 October 2027 (the first three calculated).