Member states had until 17 October 2024 to transpose the NIS2 Directive. Two years later, France, Spain, Ireland and the Netherlands have yet to notify full transposition. On 8 July 2026, the European Commission referred all four to the Court of Justice of the European Union and asked for financial penalties.
For the organisations concerned, the delay is no reason to wait. The Directive’s requirements have been public since 2022, and national laws will have to carry them over. What takes time is not reading the text: it is organising the work that allows you to meet it.
Where things stand
France
The bill on the resilience of critical infrastructure and the strengthening of cybersecurity, known as the “Resilience” bill, was passed by the Senate on 12 March 2025. A special committee of the National Assembly adopted its version on 10 September 2025, but the plenary debate has still not taken place: scheduled for 7 and 9 October 2026, it was taken off the agenda on 6 October. At the time of writing, no new date has been announced.
Spain
The Council of Ministers approved the draft Law on the Coordination and Governance of Cybersecurity at first reading on 14 January 2025. It transposes NIS2 and creates a National Cybersecurity Centre, but it has not yet been published in the Official State Gazette. For the public sector and its suppliers, the National Security Framework (ENS, Royal Decree 311/2022) already applies.
Ireland and the Netherlands
Both countries were referred on the same day, because the Commission had not received notification of complete transposition.
What the Directive already requires
National laws will set the scope, the authorities and the procedures. The substance is fixed by Directive (EU) 2022/2555:
- Risk management measures (Article 21): risk analysis, incident handling, business continuity and crisis management, supply chain security, security in the acquisition, development and maintenance of systems, asset management and access control, training, multi-factor authentication.
- Reporting deadlines (Article 23): an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month.
- Management accountability (Article 20): management bodies approve the measures, oversee their implementation and follow training.
- Penalties (Article 34): a maximum of at least €10 million or 2% of total worldwide annual turnover for essential entities, and €7 million or 1.4% for important entities, whichever is higher.
What you can prepare now
This work will be useful whatever the final wording of the national laws. It also improves the way you run your services, regardless of any obligation.
1. Know what you have to protect
Without an up-to-date inventory of systems, applications and their dependencies, you cannot assess the impact of an incident or justify a risk analysis. Start with the services that are essential to your activity and the items they depend on.
2. Timestamp every incident from detection
The 24-hour clock starts when you become aware of the incident. You therefore need to be able to say when it was detected, by whom, who qualified it and which decisions were taken. An incident handled by email and phone rarely leaves that record.
3. Prepare crisis management before the crisis
Who takes charge of operations? Who informs management, customers and the authority? Write these roles down and rehearse them: a major incident is not the moment to invent them.
4. Know your suppliers
Supply chain security means knowing which suppliers work on which systems, under which contracts and with which deadlines. A contract register linked to the items each contract covers already answers much of the question.
5. Govern your changes
Many incidents follow a change that was poorly assessed. A request, an impact assessment, an approval and a review for each change: this is also evidence that your measures are applied.
6. Involve management
The Directive makes management accountable. Present your state of readiness, the risks you have identified and the decisions to be taken, and keep a record of their approvals.
What a tool can do, and what it cannot
No software makes an organisation NIS2 compliant: compliance depends on your decisions, your procedures and how they are applied. A service management tool does, however, help you keep the evidence in one place: the inventory, the incident history, change decisions and supplier contracts.
That is the role of Ecaldima. The CMDB and asset tracking describe what you have to protect. The Service Desk gives each ticket its deadline, its owner and its history. Major incident management organises the crisis response, with one person in charge and stakeholders kept informed. Change management keeps the decision and the review of every change. The contract register brings suppliers, deadlines and commitments together.
Would you like to see how your own incident and change processes would fit? Let’s talk.