NIS2 national transpositions: why one directive means many rulebooks

NIS2 is a directive, not a regulation — which means it does not apply to you directly. It obliges each member state to pass national law achieving its objectives, and those national laws differ. An organisation operating in five countries can face five variations of the same requirement.

Where states diverge

• Sector scope. The directive sets a floor; member states may extend it to additional sectors or entity types. Being out of scope in one country says nothing about another.
• Entity identification. Some states publish lists of designated entities; others expect self-identification against size and sector criteria. That changes whether you find out by letter or by analysis.
• Registration. Timing, mechanism and the information required all vary, and registration is independently enforceable.
• Reporting channels. Different authorities, portals and formats — sometimes a national CSIRT, sometimes a sector regulator.
• Supervision intensity. Essential entities face proactive supervision; important entities are supervised reactively — but how that is operationalised differs.
• Penalties and management liability. The directive sets maximums; national implementation determines application, including any personal liability for management.
• Timing. States have not transposed simultaneously, so your obligations may commence on different dates in different countries.

The practical consequence: determine your status per country, not once. A group-level "we are an important entity" conclusion is not portable, and treating it as portable is the most common planning error.

What does not vary

The substance is stable, which is what makes a single control set viable. The ten minimum measures, the staged incident reporting structure, the management approval and training duty, and the supply chain obligations derive from the directive and appear everywhere in recognisable form.

So the model is: one control set satisfying the measures, plus a per-country register covering identification status, registration, reporting route, deadlines and supervisory authority. The controls travel; the administration does not.

Running it across countries

1. Determine entity status in each country where you have operations or provide in-scope services.
2. Register in each, tracking the specific mechanism and deadline.
3. Record the reporting route and portal credentials per country — obtained in advance, not during an incident.
4. Operate to the shortest applicable deadline as your working assumption.
5. Confirm whether your group needs a representative where you have no establishment.
6. Re-check when a state transposes or amends, because commencement dates have moved.

The supplier dimension

Even where you are out of scope, in-scope customers will push obligations to you contractually — supply chain security is one of the ten measures. For many organisations this is the actual trigger, arriving as a security schedule rather than a regulatory letter.

Key takeaways

• A directive means national rulebooks — determine status per country.
• Control substance travels; registration, reporting and penalties do not.
• Registration is a separate, independently enforceable duty.
• Most suppliers are reached contractually rather than directly.