Glossary · OT cybersecurity
NIS 2 transposition
Also known as: NIS 2 national implementation, NIS 2 implementing law
German: NIS-2-Richtlinie (nationale Umsetzung)
In EU law, NIS 2 transposition is the adoption of national laws by which each member state implements the NIS 2 Directive, defining in detail which entities are covered, the competent authorities, registration and reporting procedures, and penalties. Member states had to transpose the directive by October 17, 2024.
- OT security
In one sentence
NIS 2 transposition is the national law by which each EU member state implements the NIS 2 Directive, with its own scope details and procedures.
Example
A company with plants in Germany and Austria checks both countries' NIS 2 implementing laws, because registration and reporting channels differ between them.
How it applies
- Compliance: A directive does not apply directly to companies; the obligations come from national law. Several member states transposed NIS 2 late, so the legal situation must be checked per country and date.
- Organization: Companies operating in several member states must determine which national law applies to them, register where required and set up reporting to the right authority or CSIRT.
- Terminology: "NIS 2 guideline" is a mistranslation of the German "Richtlinie"; in EU law the correct English term is directive. Use "NIS 2 Directive" for the EU act and name the national act separately.
- Documentation: Compliance documentation should cite both the directive and the national implementing law with its status date, and be reviewed when national rules or guidance change.
NIS 2 transposition vs. NIS 2 Directive
The NIS 2 Directive sets the minimum rules for the whole EU. The transposition laws implement them nationally and may add stricter or more detailed requirements.