The NIS2 Directive’s transposition: How do Member States make their critical infrastructure cybersecure?

Executive summary 

Europe’s critical infrastructure faces ever-increasing cyber threats. Examples of serious consequences are the Danish railways coming to a standstill in 2022, or the millions of Ukrainians being cut off from the internet in 2023.

To combat these threats, the revised Network and Information Security (NIS2) Directive was adopted in November 2022, and entered into force on 16 January 2023. This first horizontal cybersecurity legislation aims to increase the common level of cybersecurity of critical infrastructure in the EU.

Member States are required to transpose the NIS2 Directive into national law by 17 October 2024. This overview seeks to map the state of transposition across the EU27. Spoiler: The (draft) transposition laws that have been made available show that there is a risk of fragmentation across the EU, creating uncertainty and unnecessary burden for the industry on multiple fronts.