A directive binds the state, not you

A directive binds the state, not you

This is the distinction the whole certification turns on. A regulation applies directly and identically in every member state. A directive does not: it obliges each state to legislate, and it is that national law which binds the entity.

NIS2 — Directive (EU) 2022/2555 — is a directive. Article 21(2) sets ten risk-management measures as an outcome the Union requires. It never says which article of your national law will carry them, which framework your supervisor will read, or which portal you will register on. Those are national choices, and the states did not converge.

Three consequences that cost money

• Numbering moves. An entity that plans against "article 21(2)(d)" will not find that reference in its own national law.
• The count can change. At least one member state carries more than ten measures.
• The evidence expected differs. One supervisor reads a national framework with numbered controls; another reads whatever you produce.

A group operating in several member states therefore has one security programme and several compliance relationships. That is not a failure of planning — it is what a directive means.