NIS2 Transposition Status: Two Years Late, and Three Countries Still Have No Law

On 6 October 2026, the French National Assembly removed its NIS2 bill from the agenda one day before the debate. Eleven days later, on 17 October, the EU transposition deadline turned two years old. If you advise clients in France, Spain or Ireland, the question is no longer when the law arrives. It is what you do for your clients while it does not.

This is the NIS2 transposition status as of 21 October 2026, and what it means for your advisory work.

NIS2 transposition status: where the 27 stand two years on

Directive (EU) 2022/2555 required member states to transpose NIS2 by 17 October 2024. According to a secondary tracker last updated in mid-September 2026, 24 of 27 member states now have a law in force. France, Ireland and Spain do not. Treat that tracker as a pointer and check each row against the national source, as the tracker itself advises.

The laws that exist are not synchronised. Italy transposed on time with Legislative Decree 138/2024, in force since 16 October 2024. Germany followed on 6 December 2025 with the NIS2 Implementation Act, supervised by the BSI. Poland's amendment to the national cybersecurity system act entered into force on 3 April 2026. The Netherlands brought the Cyberbeveiligingswet (Cbw) into force on 15 August 2026. Austria's NISG 2026 applies from 1 October 2026.

A client with entities in several of these countries now runs several compliance clocks at once. The three missing countries add a fourth state: no clock at all. That is not the same as no obligation, and the rest of this article explains why.

France: pulled from the agenda the day before the debate

France's Senate adopted the bill on 12 March 2025, by 181 votes to 134. It then waited more than a year and a half for the National Assembly. The debate was finally scheduled for 7 and 9 October 2026. On 6 October, the Conférence des présidents removed both sessions. No new plenary date has been confirmed.

Around 397 amendments are still pending. The main fight is over Article 16 bis, the provision on encryption and backdoors, which the government wants deleted. If the Assembly deletes it, the text goes to a joint committee (CMP) to reconcile the two chambers. Only after final adoption and promulgation do decrees follow.

None of that is a business obligation. The point for MSPs is the timeline: even a vote this autumn would be followed by decrees, and reported commentary puts full compliance three years after publication of the law.

What does exist is ANSSI's ReCyF framework, made available in March 2026, with 20 security objectives for essential entities and 15 for important entities. Large buyers already cite it in tenders. For the detail, see our earlier guide on France's NIS2 law and ANSSI's ReCyF.

Spain and Ireland: drafts, not laws

Spain's Council of Ministers approved the draft Ley de Coordinación y Gobernanza de la Ciberseguridad on 14 January 2025. It was given urgent status. It is still a draft awaiting parliamentary debate. Operational roles remain split between the CCN, INCIBE and sector authorities, and the national competent authority is still to be finalised. Our post on Spain's delay and the CJEU referral covers the background.

Ireland's National Cyber Security Bill is still being drafted. The details are in our piece on where the Irish bill stands.

The CJEU referral puts pressure on governments, not on your clients

On 8 July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for failing to notify full transposition. It followed letters of formal notice on 28 November 2024 and reasoned opinions on 7 May 2025. The Commission asked the Court for a lump sum and daily penalties until each state notifies full transposition.

Those financial penalties fall on the member state. They do not create fines for your client. The Netherlands put its Cbw into force five weeks after the referral, which shows how the pressure works in practice. The case continues until the Commission accepts that transposition is complete.

What a missing law does and does not change for your clients

A directive is addressed to member states. Until a country transposes it, a private company there has no statutory registration duty, no national audit schedule and no fine under that country's NIS2 law. That is the good news, and clients in France, Spain and Ireland will hear it often.

The bad news is that the obligation arrives through the supply chain. NIS2 Article 21(2)(d) requires entities to manage supplier risk. A German essential entity, an Italian operator or a Dutch healthcare provider will push security requirements to every supplier, including French, Spanish and Irish ones, through questionnaires and contract clauses. Those clauses are enforceable in contract today, whatever the status of the home law. We explain the mechanism in NIS2 supply chain security.

So a client's first NIS2 audit may come from a customer, not a regulator. And a regulator in a transposed country will check what its own supervised entities asked of their suppliers.

Triage for clients in countries without a law

Start with scope, not with the missing law. Ask three questions for each client:

1. Does the client supply an entity in a country where NIS2 is already in force? If yes, expect questionnaires now.
2. Is the client in a NIS2 sector by size and activity, under the EU text? If yes, scope is likely, whatever the national timetable.
3. Does the client already hold evidence for the ten Article 21 measures? Policies, incident handling, backups, supplier controls, MFA and the rest.

A readiness assessment answers question three in an afternoon rather than a quarter. You can run one for any client with the NIS2Certify quick scan, and use the gaps as the work plan you sell.

Then log the evidence. Dated policies, an asset list, a tested incident plan and a supplier register are what a customer's questionnaire, and later a regulator, will ask for first. Our guide to what regulators check after registration lists the same evidence from the supervisor's side.

What to tell clients this month

Do not tell a French, Spanish or Irish client that NIS2 does not apply to them yet. Tell them that their national law is late, that their customers in other countries are not, and that the evidence they build now is the evidence they will need either way. When the French bill returns to the agenda, you will already have the work done.