Adopted is not in force: why trackers disagree

Open three NIS2 transposition trackers and you will get three answers. One says 18 member states have transposed, another 22, another 23. None of them is lying and none of them is out of date. They are counting different events.

This matters more than a pedantic quibble, because the event that decides when your obligations bind you is only one of the four, and it is not the one most trackers headline.

Four events, not one

Between a bill and a binding obligation there are at least four distinct moments, and in 2025 and 2026 they have been separated by unusually long intervals.

1. Parliamentary adoption — the legislature votes. Nothing binds anyone yet.
2. Promulgation — the text is signed and published in the official journal. It exists, and it is final.
3. Entry into force — the text applies. This is the one that matters to you.
4. Notification — the member state tells the European Commission its transposition is complete. This is the one that ends an infringement procedure.

A tracker that counts adoptions gets a high number early. A tracker that counts entry into force gets a lower number that is more useful. A tracker that counts Commission notifications gets the lowest number of all, and it tells you about Brussels rather than about your compliance calendar.

The four statuses we use

We keep four, because collapsing them produces a register that misleads in both directions.

done — transposed and in force

The law applies. There is a date, and every entry carries it: claiming "in force" without saying since when is worthless to anyone planning. Twenty-three member states are here as at 16 August 2026.

adopted — promulgated, with a fixed future date

Nothing is missing from the text. It has simply not started yet. Austria is the clean example: the NISG 2026 was published in the Bundesgesetzblatt on 23 December 2025 and enters into force from 1 October 2026, staged. Calling Austria "not transposed" would be wrong — the work is done and the date is known. Calling it "in force" would be worse, because an Austrian entity would conclude it is already supervised.

partial — something is genuinely missing

Not "deferred", not "the guidance has not landed". Missing: whole categories of obligation untransposed, or nothing in the official journal for a class of entities. As at 16 August 2026 no member state is in this category, which is itself worth reporting.

late — no complete transposition, no date

Ireland, Spain and France. All three were referred to the Court of Justice in July 2026.

The failure mode is asymmetric

In our own review of 16 August 2026 we corrected five member states, and every single correction ran in the same direction: we had been understating them.

• Cyprus was recorded as partial on a report of an approved bill. Its amending law had been in force since April 2025.
• Malta was recorded as partial for the same reason. Its Order took effect on 23 January 2026 — though only because a second Legal Notice supplied the commencement date the first one had deferred.
• Luxembourg was recorded as late. Its law of 5 May 2026 has applied since 10 May.
• Bulgaria was recorded as partial with sources in conflict. Its amended Cybersecurity Act has applied since February 2026.
• The Netherlands was recorded as adopted, with an entry into force date that had passed the day before.

The common cause is a single confusion, and it is the most expensive one in this whole area: mistaking the absence of an ASSESSMENT FRAMEWORK for the absence of a TRANSPOSITION. Cyprus has a law in force and no published implementing framework from its Digital Security Authority. Malta has a law in force and no certifiable scheme. Luxembourg has a law in force and nothing to certify against. All three are transposed. None of them can hand you a national label.

Those are two different facts about a member state, and a register that merges them will tell an entity in Nicosia that it has no obligations, which is false and expensive.

How to read any tracker, including this one

• Ask which event is being counted. If it is not stated, assume adoption, which is the flattering number.
• Require a date next to every "in force". A status without a date cannot be planned against.
• Require a review date on the source itself. Transposition moves; a tracker without a date on it is a photograph with no timestamp.
• Treat "no national framework" and "no national law" as separate questions, and ask both.
• Remember that a Commission infringement page tells you about notification, not about what binds you.

The last one is where most confusion in mid-2026 came from. Four member states were in front of the Court of Justice in July. Three of them had no law. One of them had a law that took effect five weeks later. Reading the referral list as a transposition list would have put the Netherlands in the wrong column on exactly the day it started supervising 8,000 entities.