Five member states have not yet transposed the NIS2 directive, which aims to establish a high common level of cybersecurity across the EU.
The deadline for member states to adopt national legislation transposing the directive was 17 October 2024.
Of the five EU countries, four (France, Ireland, Luxembourg and Netherlands) have already submitted legislation to parliament. Spain is the only country which has not yet submitted a draft transposition law to parliament.
Scope
Region: Europe
Countries covered: 27 EU member states
Policy area: Cybersecurity, digital economy
Last updated: March 2026
For more information on the benchmark and Cullen International's complete NIS2 coverage, please click on “Access the full content” - or on “Request Access”, in case you are not subscribed to our European Digital Economy service.
more news
11 September 26
Have EU countries implemented the e-Evidence Package?
Cullen International’s latest Benchmark tracks implementation of the e-Evidence Regulation and transposition of the accompanying Directive on legal representatives across 26 EU member states.
10 September 26
Digital Networks Act recitals now directly linked to articles in the Cullen Legislation Navigator
Digital Networks Act (DNA) recitals now link to articles in Cullen international's Legislation Navigator online tool.
09 September 26
Insights into the proposed EU framework for mobile satellite services (MSS) in the 2 GHz band
Cullen International’s new Tracker makes a comparison between the European Commission’s 2 GHz band MMS proposals and the existing framework.