Five member states have not yet transposed the NIS2 directive, which aims to establish a high common level of cybersecurity across the EU.
The deadline for member states to adopt national legislation transposing the directive was 17 October 2024.
Of the five EU countries, four (France, Ireland, Luxembourg and Netherlands) have already submitted legislation to parliament. Spain is the only country which has not yet submitted a draft transposition law to parliament.
Scope
Region: Europe
Countries covered: 27 EU member states
Policy area: Cybersecurity, digital economy
Last updated: March 2026
For more information on the benchmark and Cullen International's complete NIS2 coverage, please click on “Access the full content” - or on “Request Access”, in case you are not subscribed to our European Digital Economy service.
more news
21 August 26
Sustainability targets of car manufacturers
Our latest benchmark summarises the sustainability targets put in place by the major car manufacturers.
19 August 26
Regulating submarine cable infrastructure
Our latest Global Trends benchmark analyses policies and regulations of relevance to international submarine cables used for electronic communications in 17 jurisdictions around the world.
18 August 26
Countries around the world take different approaches to data centre development
Cullen International’s new benchmark provides insights into how 19 countries, including 13 in Europe, have introduced rules to incentivise and/or regulate the development of data centres.