NIS2 for Legal, Compliance and DPOs — A directive: what binds whom

In this lesson

Locate the legal source of an entity's NIS2 obligation: the national transposing measure, read with the directive.
Sort the provisions of the directive into obligations that reach entities, obligations on member states and authorities, national options and encouragements.
Read the drafting signals that change the answer: "shall", "may", "shall encourage", "where appropriate" and "where applicable".
Place the Union-level acts around the directive, such as Implementing Regulation (EU) 2024/2690, and set up a transposition watch.

Addressed to the member states

The last article of Directive (EU) 2022/2555 is the first one counsel should read: "This Directive is addressed to the Member States." Nearly every entity obligation is drafted accordingly. Article 21(1) does not say that entities shall take measures; it says that "Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational and organisational measures". Article 23(1) begins "Each Member State shall ensure". Article 20(1) begins "Member States shall ensure".

The consequence matters for client advice: the legal source of an entity's obligation is the national measure that transposes the directive. An opinion telling a client that it must comply with article 21 is imprecise: it must comply with the national provision implementing article 21, and the directive is used to interpret that provision. A legal register that lists only directive articles cannot answer the question a supervisor or a court will ask: which national rule was infringed?

Art. 41, 44, 45

The timetable is in the final provisions. The directive was published in the Official Journal on 27 December 2022 and entered into force on the twentieth day following that publication (article 45). Under article 41(1), member states had to adopt and publish their transposing measures by 17 October 2024 and apply them from 18 October 2024. Article 41(2) requires those measures to refer to the directive. Directive (EU) 2016/1148, the first NIS Directive, is repealed with effect from 18 October 2024 (article 44), and references to it are read in accordance with the correlation table in Annex III.

National acts differ in timing, structure, numbering and in the options they take. Those are national facts, which this course does not record: the transposition pages track each of the 27.

What the directive lays down

Art. 1(2)

Article 1(2) gives the map. The directive lays down four things: (a) obligations that require member states to adopt national cybersecurity strategies and to designate or establish competent authorities, cyber crisis management authorities, single points of contact and CSIRTs; (b) cybersecurity risk-management measures and reporting obligations for entities of a type referred to in Annex I or II and for entities identified as critical entities under Directive (EU) 2022/2557; (c) rules and obligations on cybersecurity information sharing; and (d) supervisory and enforcement obligations on member states.

Point (b) is the core of the entity's own obligations, and point (c) adds some, such as the notification of participation in information-sharing arrangements (article 29(4)). Points (a) and (d) describe the state machinery that supervises it, which matters to counsel because it determines who the entity deals with and what procedural rights it has.

Four kinds of provision

A useful first step on any NIS2 question is to sort the provisions involved into four categories; the answer can depend on the category.

Category	Examples	What counsel checks
Obligations that reach the entity through national law	Submitting information for the national list (art. 3(4)); approval, oversight and training by the management body (art. 20); risk-management measures (art. 21); reporting (art. 23); designating a representative (art. 26(3)); registry information (art. 27(2) and (3)); notifying participation in information-sharing arrangements (art. 29(4))	The national provision, its wording, its entry into application and any national additions
Obligations on member states and authorities	National strategy (art. 7); competent authorities and single point of contact (art. 8); CSIRTs (art. 10); supervision and enforcement (art. 31 to 37)	Which authority is competent, what powers national law gives it, which procedure applies
National options	Extending scope to local public administration and education institutions (art. 2(5)); exempting specific entities (art. 2(8)); treating former operators of essential services as essential (art. 3(1)(g)); requiring certified ICT products (art. 24(1)); periodic penalty payments (art. 34(6)); fines on public administration entities (art. 34(7))	Whether the member state used the option, and how
Encouragements	Training for employees (art. 20(2)); use of qualified trust services (art. 24(1)); use of European and international standards (art. 25(1))	Whether national law turned the encouragement into a requirement

Art. 5

The last column of the table matters because of article 5. NIS2 is a minimum harmonisation instrument: it "shall not preclude Member States from adopting or maintaining provisions ensuring a higher level of cybersecurity, provided that such provisions are consistent with Member States' obligations laid down in Union law." A national law may therefore be stricter than the directive, for example by extending scope, shortening a deadline or requiring a specific measure. Reading only the directive will understate the obligations in those member states. The reverse case is different: where a national law falls short of the directive, that is a transposition failure of the member state, and how far the directive can then be relied on is a question of EU law that counsel analyses case by case rather than assumes.

Drafting signals

Art. 20(2)

Four drafting patterns carry legal weight.

Shall against shall encourage. Article 20(2) contains both in one sentence: member states shall ensure that the members of the management bodies "are required to follow training", and "shall encourage essential and important entities to offer similar training to their employees on a regular basis". The first is a duty on board members; the second is an instruction to the state to encourage. Staff training is an entity measure through a different route, the "basic cyber hygiene practices and cybersecurity training" of article 21(2)(g).
"May". A "may" addressed to member states creates a national option (article 2(5), article 34(6)). A "may" addressed to an authority creates a power, not a duty (article 31(2): competent authorities may establish supervisory methodologies that prioritise their tasks on a risk basis).
"Where appropriate" and "where applicable". In article 23(1), entities notify the recipients of their services "where appropriate"; article 23(2) opens with "Where applicable". In article 21(2)(j), multi-factor authentication and secured communications are required "where appropriate". These qualifiers call for a reasoned, documented judgement, not for silence.
"At least". Lists introduced by "at least", such as the ten measures of article 21(2), the supervisory powers of article 32(2) or the information of article 3(4), are floors. National law may add to them.

Recitals explain the operative text and are used to interpret it; they create no obligations of their own. They are still indispensable here: recital 16 explains how linked and partner enterprises may be treated for the size test, recital 28 how DORA displaces NIS2 for financial entities, and recitals 113 and 114 the jurisdiction rules.

The Union-level acts around the directive

Reg. 2024/2690, art. 1

Not everything in the NIS2 framework passes through national law. Articles 21(5) and 23(11) required the Commission to adopt implementing acts for a defined group of entity types, and it did so in Commission Implementing Regulation (EU) 2024/2690. As a regulation, it applies directly. Its article 1 limits it to DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, providers of online market places, of online search engines and of social networking services platforms, and trust service providers. For those entities it lays down the technical and methodological requirements of the article 21(2) measures and further specifies when an incident is significant. For every other entity its annex is a reference, never an obligation.

Other instruments are not binding at all. Under article 3(4), the Commission, with the assistance of ENISA, had to provide guidelines and templates on the information to be submitted, without undue delay; under article 4(3), it had to provide guidelines on the application of article 4 by 17 July 2023. Guidance helps interpret, but an entity is not in breach of a guideline. Finally, article 40 requires the Commission to review the directive by 17 October 2027 and every 36 months thereafter, assessing in particular the relevance of the size of the entities concerned and of the sectors, subsectors and types of entity in the annexes. Scope advice should therefore carry a review date.

A transposition watch

For a group active in several member states, the deliverable that follows from this lesson is a transposition watch: a working document, not a memo, recording for each relevant member state:

the national act or acts, their status and date of application, and the provision that implements each article the entity relies on;
the options the member state took (scope extensions, exemptions, former operators of essential services, periodic penalties, fines on public bodies) and any requirement that goes beyond the directive;
the competent authority, the CSIRT, the registration mechanism and any national guidance;
the date the entry was last checked, and by whom.

In practice

An invented case. The general counsel of Calder Freight, a rail freight group whose subsidiaries in three member states are railway undertakings, an Annex I type, receives a note from the HR director: the directive obliges us to train every employee once a year, so we need a budget line for 4,000 people. Counsel answers in three paragraphs. First, article 20(2) requires members of the management body to follow training and asks member states to encourage entities to train employees; it does not itself impose annual staff training. Second, staff training is part of the measures through article 21(2)(g), which sets no frequency; the content and rhythm are for the entity's own risk-based judgement. Third, under article 5, a national law may go further, so the transposition watch was checked for each of the three member states; in this invented case, one national act imposed a recurring training requirement, and the obligation was recorded for that subsidiary only. The budget was approved on that basis, with the analysis attached.

What a supervisor will ask

Which national provisions does the entity consider applicable to it? The legal register, citing national articles alongside the directive articles they implement.
How does the entity know about national requirements that go beyond the directive? The transposition watch and the date of its last review.
For the entity types listed in article 1 of Regulation (EU) 2024/2690: how are its requirements reflected in the measures? The mapping between the regulation's annex and the entity's policies.
Where the entity relied on a qualifier such as "where appropriate", why? The documented reasoning behind that judgement.

Key points

NIS2 is addressed to the member states (art. 46); an entity's obligations arise from the national transposing measures, read in the light of the directive.
Transposition was due by 17 October 2024, with application from 18 October 2024 (art. 41); the first NIS Directive is repealed from the same date (art. 44).
Sort provisions into entity obligations, state obligations, national options and encouragements before answering a question.
NIS2 is minimum harmonisation (art. 5): national law may be stricter, so the directive alone can understate the obligations.
Implementing Regulation (EU) 2024/2690 applies directly, but only to the entity types in its article 1; guidelines interpret but do not bind.