787 974 136
Many companies assume that, since NIS 2 is an EU directive, it applies in exactly the same form everywhere. This is a mistaken assumption – and one that could prove costly. The NIS 2 Directive merely sets out a common minimum standard. Exactly how it works in practice – what penalties apply for breaches, who exactly is subject to the obligations, to whom incidents must be reported and by when – depends on how each country has transposed the EU regulations into its national law. And these differences can be significant.
For companies operating exclusively in Poland, this is an important but secondary issue. For companies with branches, customers or a supply chain spanning several EU countries, it is an issue that could have a significant impact on the compliance budget, the implementation timetable and the liability of the board of directors. If you are still considering whether, and to what extent, your company is subject to the obligations under NIS 2, it is worth starting with this point before we move on to the differences between countries.
This legal distinction is key to understanding all the confusion surrounding NIS 2. An EU regulation is directly applicable and has the same effect in every Member State. A directive works differently – it sets out an objective and minimum requirements, but each country must ‘translate’ it into its own legislation. In practice, this means that the 27 Member States have created – or are still creating – 27 separate pieces of legislation which differ in detail, although they are based on the same EU framework.
The deadline for transposing NIS 2 into national law was 17 October 2024. In reality, however, the process has taken much longer than the EU legislator had anticipated.
The picture in Europe in mid-2026 is a mix of countries that met the deadline, countries that were months or years behind, and a now small group of states still working on the final form of the legislation.
The situation in May 2026 reveals a clear imbalance – most countries had already completed their legislative processes, but five Member States (France, Ireland, Luxembourg, the Netherlands and Spain) were still working on their legislation to transpose the directive. These are not peripheral or small countries – they are among the largest economies in the European Union, which in itself demonstrates just how great an organisational and legislative challenge NIS 2 has proved to be.
The European Commission did not remain passive in the face of these delays. In July 2026, it referred the cases of Ireland, Spain, France and the Netherlands to the Court of Justice of the European Union for failing to fully transpose the directive, requesting that financial penalties be imposed on these countries. This signals that delays in implementing NIS 2 are no longer treated as a mere formality – the Commission has begun to enforce discipline at the level of the governments themselves.
On the other side of the spectrum are countries that have managed the process much more efficiently. Belgium was one of the first countries to pass its own legislation implementing NIS 2, with the regulations coming into force there as early as 2024. Hungary and Croatia also completed implementation early.
The mere fact that different countries have implemented NIS 2 at different rates is only half the problem. The other half – often more important for businesses – lies in the differences in the content of individual national laws. Here are the key areas where practices diverge between Member States.
Level of fines. The Directive sets only minimum thresholds for fines – up to €10 million or 2 per cent of global annual turnover for critical entities, and up to €7 million or 1.4 per cent of turnover for important entities. However, these are lower limits. Member States may set higher national thresholds, and some have indeed done so. This means that the actual financial risk depends on the country in which the breach occurs – a company operating in several jurisdictions must take into account the highest of the applicable thresholds.
Management board liability. This is an area where differences between countries are particularly pronounced – and a topic we have already discussed in greater detail on our blog. The German implementation of the directive – the NIS2UmsuCG Act – goes beyond the EU minimum requirements regarding management board liability. It explicitly requires management bodies to approve cybersecurity measures, oversee their implementation and demonstrate personal competence in this area. Other countries, such as Belgium, Hungary and Italy, have opted to align the provisions on management liability with existing national civil law regulations, rather than creating an entirely new regime.
Scope of application and size thresholds. The Directive gives Member States the discretion to bring additional, smaller entities within the scope of NIS 2 – for example, where a given entity is the sole provider of a service of critical importance to a particular country. Different countries exercise this discretion to varying degrees, meaning that a company deemed too small to be subject to NIS 2 in one country may already be subject to the regulations in another.
Supervision and enforcement. The way in which supervisory authorities actually check compliance also varies. A good example is Germany, where, from March 2026, the Federal Office for Information Security (BSI) will carry out proactive supervision – it may request evidence of the implementation of security measures without waiting for an incident to occur, conducting both remote and on-site inspections. Not all countries are at the same stage of operational readiness for supervision.
Deadlines and procedures for reporting incidents. Although the directive sets out a general framework for incident reporting – early warning, preliminary report, final report – the specific definitions of a ‘significant incident’, reporting thresholds and detailed deadlines vary between countries, which means that companies operating across borders must monitor several parallel procedures rather than just one.
Compared with many European Union countries, Poland is neither a leader nor a laggard when it comes to transposition – it lies somewhere in the middle of the rankings. The amendment to the Act on the National Cybersecurity System (KSC), which constitutes Poland’s implementation of NIS 2, came into force on 3 April 2026. A dozen or so days later, on 13 April 2026, the official list of critical and important entities was published – a document which, in practice, determines which companies in Poland are actually subject to the new obligations.
This is important information for companies that were previously unsure whether the regulations applied to them – the list of entities serves as a point of reference, rather than the text of the directive itself in isolation from the national context.
By way of comparison: the Dutch Cyberbeveiligingswet does not come into force until 15 August 2026, imposing an obligation on over 8,000 organisations to register, implement risk-based security measures and ensure oversight at board level. This means that Polish companies have already been operating under the new legal regime for several months, whilst their Dutch business partners are only just implementing it.
If you operate exclusively in Poland, your main points of reference are the Act on Critical and Significant Entities and the official list of critical and significant entities. However, it is worth bearing in mind that Polish regulations are based on the same EU core principles as those in other countries – risk management, reporting obligations, and management liability – so an understanding of the broader European context helps to understand the direction in which national requirements will evolve.
If you have branches, customers or suppliers in other EU countries – the fragmented implementation of NIS 2 poses a real operational risk for you. Different deadlines for reporting incidents, different penalty thresholds, different regulators overseeing the same processes – all this means that a single, universal compliance procedure may simply not be sufficient. Companies operating across borders should map out their obligations country by country, rather than assuming that meeting Polish requirements automatically means compliance everywhere else.
Regardless of the scale of operations, the safest strategy is to build compliance around the common core of the directive: sound risk management, efficient procedures for detecting and reporting incidents, and genuine commitment from senior management to cybersecurity issues. Such a foundation meets the basic requirements almost everywhere in the European Union, whilst local differences – higher fines, additional reporting obligations, specific deadlines – can be applied to it as an additional layer of adaptation, rather than building compliance from scratch for each country individually. A good starting point for building such a foundation is the implementation of ISO 27001, which largely overlaps with the requirements of NIS 2, although – as we have noted previously – it does not fully replace it.
The discrepancies between Member States are not a temporary inconvenience of the transition period – they are a structural feature of EU directives that will persist for some time to come, even once all 27 Member States have completed formal transposition. The European Commission recognises this problem – in January 2026, it proposed targeted amendments to NIS 2, aimed at increasing legal clarity and simplifying compliance with EU cybersecurity regulations, particularly for smaller businesses.
However, until these amendments come into force, companies cannot afford to wait for the ‘final’ version of the regulations. A better strategy is to build compliance now – on a solid, universal foundation of cybersecurity risk management that will prove effective regardless of how the NIS 2 implementation landscape in Europe ultimately takes shape. This is, in fact, a question that is increasingly being asked not by the regulator, but by business partners – [we have already written about how customers are beginning to ask companies about NIS 2 compliance even before signing a contract.
DJB DORADZTWO
Marcin Chorąży
