Methodology and fact-checking: NIS2 Guide

This page explains how sources rank, how statuses are dated and how errors are corrected; what the law itself requires is explained in the NIS2 Directive overview.

Which Primary Sources Every Fact Comes From

We take each kind of fact from the body that issues it: EU law from EUR-Lex and the Official Journal of the European Union, national law from the national gazette, and registration and reporting practice from the competent authority or CSIRT. The Directive is cited as CELEX 32022L2555, OJ L 333, 27.12.2022, p. 80-152 (EUR-Lex text), read with the English corrigendum OJ L, 2023/90206. Table 1 lists the five kinds of source.

Implementing Regulation (EU) 2024/2690 (CELEX 32024R2690) is cited from EUR-Lex with its three language corrigenda, in Polish, Swedish and Dutch; as of 23 October 2026 it has not been amended.

How Sources Rank When They Disagree

When two sources give different values, the official source wins over every other source, and a newer official source wins over an older one. The Directive binds the Member States (Article 46), whose national measures have applied since 18 October 2024 (Article 41(1)), so an organisation's duties are read from its national law. The five ranks below run from highest to lowest.

1. The act in the Official Journal, read with its corrigenda.
2. The national law in its gazette, which wins where it deviates: Cypriot Law 60(I)/2025 sets a 6-hour early warning (section 35B(4)(a)), where Article 23(4)(a) sets 24 hours.
3. Competent authority and CSIRT publications on applying the law.
4. EU institution records for proposals and infringements, and ENISA and Cooperation Group guidance, always non-binding.
5. Secondary sources, as leads only; the Commission's per-country NIS2 pages, last updated in July 2025, are never used for current status.

A secondary source leads to a primary source; it never supplies a value.

How Every Status Carries Its Date

Every transposition status, infringement step and proposal stage on this guide is written with the date on which it was checked, in the form "as of 23 October 2026". Dates are written out in full, and an estimate keeps its own date and author. On 8 July 2026, for example, the Commission decided to refer Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for failing to notify measures transposing NIS2 (IP/26/1499).

Fixed dates of the Directive carry their article instead of a check date. The Commission review by 17 October 2027, repeated every 36 months (Article 40), is one of them; each is listed in the NIS2 timeline.

What the Guide Does Not State as Fact

A value that we cannot trace to a primary source is left out, not hedged: the guide does not write "reportedly" or "some sources say". A national in-force date reported only by a law firm stays off until the gazette or authority confirms it. No list of named entities in scope is published, because ENISA's Article 27 registry is not public and access is restricted to national authorities.

Pending proposals carry their stage and date, as of 23 October 2026. COM(2026) 13 (procedure 2026/0012(COD)) is at the European Parliament stage "Awaiting committee decision", and for the Digital Omnibus COM(2025) 837, Coreper agreed the Council mandate on 21 October 2026. Neither is called adopted or "NIS3".

How Corrections Work

Anyone can report an error to editorial@nis2guide.net, and every report is checked against the primary source before any page changes. A differing official value is written with its source on every page that carries it, not only on the reported page.

A newer official act triggers the same check without a report. Such acts include an amending national law, a new implementing act and an infringement decision.

Independence and the Limits of This Guide

NIS2 Guide explains what the Directive and the national laws require; it does not tell a named organisation whether it is in scope, and it is not legal advice. No company pays for placement. How independence is kept is set out in our editorial policy.