Glossary · NIS2
National Transposition
The process by which an EU member state converts the NIS2 Directive into its own national law.
Explained in depth: NIS2 by country
As a directive, NIS2 does not apply directly to organisations. Each member state passes its own law implementing the directive's requirements, and it is that national law which binds entities. The transposition deadline was 17 October 2024, but many member states, including Sweden, transposed later. Sweden's implementation, Cybersäkerhetslagen, entered into force in 2026. Transposition also creates national variation: member states designate their own competent authorities, decide registration procedures, may add sectors or lower size thresholds, and define the details of management liability and sanctions. Compliance work must therefore always be anchored in the national law of each member state where the entity operates, not only in the directive text.
Why it matters
An organisation active in several EU countries can face different registration duties, reporting portals, and supervisory authorities per country. The directive tells you the minimum; the national law tells you your actual obligations.
Used in
- NIS2 by country
- Who NIS2 applies to
- NIS2 overview
- NIS2 national transposition: where member states stand