A directive binds the state, not you

In this lesson

• Explain, from articles 41 and 46 of the directive, why the text that binds an entity is national law and not Directive (EU) 2022/2555 itself.
• Separate what NIS2 fixes for every member state from what it leaves to each national legislator.
• Recognise the one part of the article 21(2) regime that applies directly: Commission Implementing Regulation (EU) 2024/2690.
• Work out which national laws a group is subject to, using the jurisdiction rules of article 26.

Addressed to the member states

Art. 46

The last article of NIS2 is one sentence long, and it decides how everything before it works: “This Directive is addressed to the Member States.” A regulation applies in the same words in every member state from the day it applies. A directive does not. It obliges each state to produce a result, and it is the national law adopted to produce that result which reaches the entity.

Article 41(1) sets the deadline for that work: “By 17 October 2024, Member States shall adopt and publish the measures necessary to comply with this Directive.” and, in the next subparagraph, “They shall apply those measures from 18 October 2024.” The obligation to legislate sits with the state, and the date belongs to the state. Most states missed it, which is the subject of the next lesson.

Read the operative articles with this in mind and the grammar becomes obvious. Article 21(1) does not say that entities shall take measures. It says “Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational and organisational measures”. Article 23(1) opens with “Each Member State shall ensure that essential and important entities notify”. Article 20(1) opens with “Member States shall ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures”. Every duty you will carry is written, in the directive, as a duty of your state to impose it on you.

The practical consequence is the first habit this course asks you to build: cite the national provision, not the directive. The data hub behind this course records, for example, that the Belgian Law of 26 April 2024 carries the measures at Article 30, that the Danish NIS 2-loven carries them at § 6, and that the German measures sit in § 30 of the BSI Act as amended by the NIS2UmsuCG. A Belgian supervisor reads Article 30. A document that answers only “article 21(2)” answers a question nobody in Belgium is asking.

What the directive fixes for all 27

Art. 21(2)

A directive leaves the form to the state, but not the substance. Four things in NIS2 are the same in every member state, and they are the stable layer on which a multi-country programme should be built.

• The ten measures. Article 21(2) states that the measures “shall include at least the following”, then lists points (a) to (j), from policies on risk analysis to multi-factor authentication and secured communications. “At least” makes the list a floor. No state can transpose nine.
• The reporting chain. Article 23(4) sets an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, an intermediate report on request, and a final report no later than one month after the notification. The clock is set in the directive; states choose the recipient and the portal.
• The two classes. Article 3 defines essential and important entities, and article 2 sets the size-cap rule with its exceptions. States identify entities and may add to the lists, but they work inside these definitions.
• The floor on fines. Article 34(4) and (5) require fines with a maximum of at least EUR 10 000 000 or 2 % of the worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs for essential entities, and at least EUR 7 000 000 or 1.4 % of that turnover for important entities, whichever is higher in each case. These are floors for the national maximum: a state may set it higher.

What it leaves to national law

Art. 5

Everything procedural is national, and the directive says so in terms. Article 8(1) has each state designate “one or more” competent authorities, and article 10(1) one or more CSIRTs. Article 3(3) has each state establish the list of essential and important entities by 17 April 2025, and article 3(4) adds, as an option rather than a duty: “Member States may establish national mechanisms for entities to register themselves.” Article 2(5) lets a state extend the regime to local public administration and to education institutions. None of these choices is harmonised, and the states did not converge.

Then there is article 5, which is the reason two national laws can differ on substance and both be lawful: “This Directive shall not preclude Member States from adopting or maintaining provisions ensuring a higher level of cybersecurity, provided that such provisions are consistent with Member States’ obligations laid down in Union law.” Belgium used that room. The hub records that Article 30 of the Belgian law restates the ten measures and adds an eleventh, standalone obligation at Article 30 §3: a coordinated vulnerability disclosure policy. Denmark did the opposite and carried the ten one for one. Both are correct transpositions of the same article.

The authority structure varies as much as the text. In Denmark, the hub records Styrelsen for Samfundssikkerhed (SAMSIK) as the authority while the national CSIRT task sits with the Defence intelligence service, FE, and supervision is split across sector authorities named by ministerial order. In the Netherlands, the RDI supervises while registration goes to NCSC-NL. A group that assumes one regulator per country will send something to the wrong desk.

The one layer that is not national

Art. 21(5)

There is an exception, and it is narrow. Article 21(5) required the Commission to adopt implementing acts setting the technical and methodological requirements of the article 21(2) measures for a defined list of entity types. It did so in Commission Implementing Regulation (EU) 2024/2690, whose article 1 names them: DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, providers of online market places, of online search engines and of social networking services platforms, and trust service providers. Eleven types.

For those entities, article 2(1) of the regulation places the requirements for points (a) to (j) in its Annex, and article 16 settles the legal form: “This Regulation shall be binding in its entirety and directly applicable in all Member States.” The detail of the measures is therefore the same text in all 27 for a cloud provider, a data centre operator or an MSP. What stays national for them is everything around it: registration, the authority that supervises, the penalties and the national article that imposes the duty in the first place.

For every other entity, the detail of the measures is what the national legislator, regulator or framework makes of the ten points. That is why modules 2 and 3 of this course exist.

Which national law is yours

Art. 26

If national law binds, the first question is which national law. Article 26(1) answers with a general rule and three exceptions. The rule: an entity falls under the jurisdiction of the member state in which it is established. The exceptions:

• Public electronic communications providers fall under the state in which they provide their services (point (a)).
• DNS, TLD and domain registration services, cloud, data centre, content delivery, managed and managed security services, online marketplaces, search engines and social networks fall under the state of their main establishment in the Union (point (b)). Article 26(2) locates it where decisions on the cybersecurity risk-management measures are predominantly taken; failing that, where cybersecurity operations are carried out; failing that, at the establishment with the highest number of employees in the Union.
• Public administration entities fall under the state that established them (point (c)).

For a manufacturing or food group with subsidiaries across Europe, the general rule applies, and each subsidiary is subject to the law of its own state. Five subsidiaries can mean five laws, five authorities, five registration channels and up to five sets of dates, under one directive.

What a supervisor will ask

• “Which national provision carries your risk-management obligations?” Answer with the citation for that state, such as Article 30 of the Belgian law or § 30 BSIG, and a table linking it back to article 21(2).
• “Why does this entity fall under our jurisdiction and not another state’s?” Answer with the article 26 analysis: establishment, or for the entity types listed in article 26(1)(b) the main-establishment reasoning of article 26(2), written down and dated.
• “You provide a managed service. How do you meet the Annex to Implementing Regulation 2024/2690?” Answer with your evidence mapped to that Annex, not to a national summary of it.
• “Who approved these measures?” Answer with the management body decision required under the national provision that transposes article 20(1).

Key points

• NIS2 is addressed to the member states (article 46). Every entity duty in it is written as a duty of the state to ensure it, and reaches you through national law.
• The directive fixes the ten measures as a floor, the 24-hour, 72-hour and one-month reporting chain, the two classes of entity and the floors for the national maximum fines.
• Authorities, CSIRTs, registration mechanisms and the national numbering are left to each state, and article 5 lets a state go further, as Belgium did with an eleventh measure.
• Implementing Regulation (EU) 2024/2690 is directly applicable and sets the detail of the measures for eleven types of digital and trust service entities.
• Article 26 decides which state’s law applies: establishment as a rule, with exceptions for public electronic communications, for the DNS, cloud, data centre, managed service and online platform types listed in point (b), and for public administration.