Five member states have not yet transposed the NIS2 directive, which aims to establish a high common level of cybersecurity across the EU.
The deadline for member states to adopt national legislation transposing the directive was 17 October 2024.
Of the five EU countries, four (France, Ireland, Luxembourg and Netherlands) have already submitted legislation to parliament. Spain is the only country which has not yet submitted a draft transposition law to parliament.
Scope
Region: Europe
Countries covered: 27 EU member states
Policy area: Cybersecurity, digital economy
Last updated: March 2026
For more information on the benchmark and Cullen International's complete NIS2 coverage, please click on “Access the full content” - or on “Request Access”, in case you are not subscribed to our European Digital Economy service.
more news
22 October 26
IoT regulation: new operational requirements reshape global connectivity
Cullen International's Quarterly Regulatory Update on IoT and M2M Services (Q3 2026) highlights how national regulators around the globe are shaping the future of IoT and M2M services.
21 October 26
Americas countries require satellite service providers to obtain a spectrum licence
Cullen International’s latest benchmark compares satellite regulation across the Americas, including service and spectrum licensing, registration requirements, spectrum allocations and fees, interference rules, migration between frequency bands and recent regulatory developments.
21 October 26
Around the world, many regulators examined communications apps through distinct lenses, but their interventions did not always lead to any enforcement
Cullen International's latest Global Trends benchmark for communications apps regulation shows how telecoms, consumer protection, data protection and competition regulators intervene in the number-independent communications apps sector. The benchmark addresses regulation apps such as WhatsApp, WeChat and iMessage across 13 jurisdictions around the world.