NIS2 compliance stopped being a future deadline on October 17, 2024. That’s the date EU member states were legally required to have transposed Directive (EU) 2022/2555, the NIS2 Directive, into national law, and the date every medium and large company in a covered sector became subject to its security, governance, and incident-reporting obligations. Two years on, the gap between that legal reality and actual readiness is larger than most companies planning around NIS2 compliance assume, and the gap isn’t closing as fast as the deadline’s age would suggest it should be.

A 2026 survey of 670 business leaders across nine countries found just 16% of companies required to comply with NIS2 are fully compliant. That’s not a statistic about confusion or awareness. The same survey found budget, not understanding, is the leading reason companies cite for falling short, and in July 2026 the European Commission itself referred four member states to the EU’s top court for still not having finished transposing the law two years after their own deadline.

Six findings below walk through how far behind both companies and governments actually are, what NIS2 compliance actually requires once a company is in scope, and why the fine structure makes this a board-level risk rather than a compliance-team one. None of this is presented to alarm a team that’s already behind. It’s presented because the companies that treat NIS2 compliance as a real deadline, rather than a line item waiting for budget approval, are the ones who won’t be explaining a gap to a regulator, a partner, or a court later.

The transposition deadline passed two years ago, and four governments still haven’t caught up

Before asking whether companies are ready for NIS2 compliance, it’s worth noting that some of the governments enforcing it aren’t finished either. That matters for any company tempted to treat a national regulator’s quietness as a signal that NIS2 compliance can wait.

Ireland, Spain, France, and the Netherlands were referred to the EU’s top court in July 2026

The European Commission referred all four countries to the Court of Justice of the EU on July 8, 2026, for failing to notify the Commission that they had fully transposed NIS2 into national law. The original transposition deadline was October 17, 2024 — nearly 21 months earlier. The Commission is asking the Court to impose a lump sum plus daily penalties on each country until full transposition is confirmed, the same kind of financial-pressure mechanism NIS2 compliance ultimately relies on at the company level too.

This followed two earlier warnings that went unanswered

The referral wasn’t the Commission’s first move. It sent formal notice letters to the same countries on November 28, 2024, then reasoned opinions on May 7, 2025, before escalating to the Court of Justice fourteen months later. Each stage gave the governments involved another chance to close the gap quietly, without a public referral attached to their name, and each one passed without full transposition getting finished. NIS2 compliance isn’t a theoretical obligation sitting in a drawer somewhere.

It’s a law the EU’s own enforcement machinery is actively pursuing against its own member states, which says something about how seriously it’s treating the companies underneath them. A regulator that’s willing to drag a national government through three stages of formal escalation over NIS2 compliance isn’t the kind of regulator that quietly lets a mid-sized company’s gap slide indefinitely.

The scope catches far more companies than most expect

Government delays aside, the more immediate risk for most businesses is simpler: not realizing NIS2 compliance applies to them at all. That’s a different failure mode than running out of budget, and it’s arguably a more dangerous one, because a company that doesn’t know it’s in scope isn’t tracking NIS2 compliance as a risk in the first place.

Medium and large companies across 18 critical sectors are in scope

NIS2 applies to medium and large entities — generally 50 or more employees or annual turnover above €10 million — operating across 18 critical sectors that the European Commission defines, including health, energy, transport, digital infrastructure, and public administration. That list is substantially broader than the critical-infrastructure operators NIS2’s predecessor directive covered, and it pulls in software vendors, managed service providers, and supply-chain partners that may never have thought of themselves as regulated entities before. 

A company whose only direct customer is another regulated entity can still end up needing its own NIS2 compliance program, simply because its customer’s own obligations flow downward through the supply chain. That downstream pressure is already visible in practice: regulated customers are starting to ask smaller suppliers for the same assurances they themselves have to provide, well before any regulator asks the supplier directly.

Inside that scope, NIS2 also splits companies into two tiers — essential and important entities — and the difference isn’t just which fine ceiling applies. Essential entities face proactive, ex-ante supervision, meaning regulators can audit, inspect, and request evidence of NIS2 compliance at any time without waiting for a complaint or an incident. Important entities are supervised reactively instead, only drawing scrutiny once something — a breach, a complaint, a vulnerability in the news — gives a regulator a reason to look, though both tiers answer to the exact same Article 21 security requirements.

Even companies that know the scope don’t always know they’re in it

The same 2026 survey found 11% of respondents were unsure what NIS2 compliance actually requires, despite their own organization falling within its scope. That’s a smaller problem than the compliance gap itself, but it compounds it: a company that doesn’t know it’s covered isn’t budgeting, assigning ownership, or building toward NIS2 compliance at all, which guarantees it shows up in next year’s version of the same survey, further behind than it is now.

Only 16% of in-scope companies are actually compliant

Put the scope question aside and assume a company knows exactly where it stands, has read the directive, and has a named owner for NIS2 compliance internally. The readiness numbers are still stark.

The survey behind this piece covered 670 leaders across nine countries

CyberSmart’s 2026 NIS2 Survey, conducted with OnePoll in late 2025, surveyed 670 business leaders across the UK, Poland, the Netherlands, Ireland, France, Germany, Italy, Denmark, and Belgium. Every respondent fell within NIS2’s scope: companies with 50 to 249 employees or turnover exceeding €10 million, managed service providers operating in the EU, and UK businesses trading with EU entities. Just 16% reported being fully compliant with NIS2 — not partially underway, not planning to start, but actually finished. A nine-country spread matters here, because it rules out the possibility that the gap is a quirk of one slow-moving national regulator; the pattern holds across markets with very different enforcement cultures.

Eighteen months after the deadline, 84% of in-scope companies still aren’t done

That 16% figure means 84% of the companies the survey covered — organizations that know they’re in scope, in countries where the law has been transposed — hadn’t finished NIS2 compliance well over a year after the legal deadline passed. For a regulation with real financial penalties attached, that’s not a small lag. It’s most of the addressable market still exposed, and still assuming it has more time than it actually does.

Budget, not understanding, is the real blocker

If a 16% compliance rate sounds like a knowledge problem, the same research says otherwise. The obstacle most companies report isn’t confusion about NIS2 compliance itself — it’s funding the work once the requirements are already understood.

Budget constraints are the single most-cited reason for falling short

CyberSmart’s survey found budget constraints are the leading barrier companies report, ahead of a lack of implementation guidance and insufficient internal expertise. Most companies in the survey aren’t confused about what NIS2 compliance requires. They know, and they haven’t funded the work to get there, which makes this a resourcing decision sitting with finance and leadership, not a technical gap sitting with IT.

75% already see compliance as a competitive advantage, not just a cost

The same survey found 75% of respondents see some competitive advantage in NIS2 compliance, a notable number given how many of them haven’t achieved it yet. Partners, investors, and customers are increasingly asking companies to demonstrate NIS2 compliance as part of their own due diligence, which means the budget conversation isn’t purely defensive. A company behind on NIS2 compliance risks losing deals to one that isn’t, independent of whatever a regulator eventually does, and that’s a revenue argument a finance team can act on even before a fine ever enters the conversation.

The fines scale with your whole group’s revenue, not the violation

The budget argument for delaying NIS2 compliance gets harder to make once the actual penalty structure is on the table. It isn’t calibrated to the size of the lapse. It’s calibrated to the size of the company.

Essential entities face fines up to €10 million or 2% of global turnover

Article 34 of the NIS2 Directive sets maximum administrative fines at €10 million or 2% of total worldwide annual turnover for essential entities, whichever is higher. Important entities face a lower ceiling than essential ones — €7 million or 1.4% of global turnover, also whichever is higher — though “lower” is relative; both figures 

“Global turnover” means the whole group, not the EU subsidiary that slipped

The percentage-of-turnover calculation applies to an entity’s entire consolidated group revenue — every parent company, subsidiary, and linked business worldwide — even when only one EU operation triggered the obligation. A US or Asia-based parent company with a single EU subsidiary covered by NIS2 compliance can see a fine calculated against its entire worldwide revenue, not the revenue of the EU entity alone, which is a detail that surprises a lot of finance teams the first time they read Article 34 closely. 

A fast-growing company can cross into a materially higher penalty bracket simply by growing or acquiring, with no separate notification that it’s happened. For a multinational with meaningful global revenue, 2% is rarely a rounding error, and treating NIS2 compliance as a fixed, one-time project rather than something that needs revisiting after every acquisition is its own quiet source of exposure.

The fine isn’t the only way NIS2 compliance becomes personal for a board rather than a department. Article 20 of the Directive requires the management body itself — not just the compliance team — to approve the company’s cybersecurity risk-management measures, oversee how they’re implemented, and complete training specific to that oversight role. 

Member states can hold individual board members and senior managers personally liable for failing to meet those duties, with sanctions that include temporary bans from exercising managerial functions. Rubber-stamping a program nobody on the board actually understood is exactly the scenario that duty is designed to catch — a different kind of exposure than a line item a CFO can simply underfund.

The reporting clock starts before the investigation does

NIS2 compliance isn’t only about prevention. It also sets a hard operational clock once something goes wrong, and the clock is unforgiving about how little a company knows when it starts. A company can be fully compliant on paper and still fail this part of NIS2 compliance the first time it’s actually tested. It isn’t the only EU deadline built this way, either: the Cyber Resilience Act runs an almost identical 24-hour clock for software vulnerabilities, which means a team building toward one reporting rhythm is effectively building toward both.

Significant incidents require a report within 24 hours of becoming aware, not resolved

Article 23 of NIS2 requires essential and important entities to report significant incidents in three stages: an early warning within 24 hours of becoming aware of the incident, a more substantive notification within 72 hours, and a final report within one month. The clock starts once an entity reaches “a reasonable degree of certainty following an initial assessment,” not once an investigation is complete, and waiting for management approval doesn’t pause it.

Most companies have never rehearsed a 24-hour disclosure

A written policy that says “report significant incidents within 24 hours” is not the same capability as actually doing it, correctly, at 2am, before anyone has a complete picture of what’s happening. That gap between policy and rehearsed capability is exactly the kind of thing that doesn’t show up in a NIS2 compliance checklist until the day it’s tested for real, which is also the worst possible day to discover it. Knowing which internal role owns the decision to escalate, which national CSIRT to contact, and what the early warning actually needs to say are details most companies have written down somewhere but never actually walked through under time pressure.

What this means for teams preparing for NIS2 compliance

None of the six findings above are reasons to wait. If anything, each one removes a reason companies have been using to wait: the deadline already passed, the scope is broader than assumed, the fines apply to global revenue, and the governments enforcing all of it are now under direct pressure from the EU’s own courts to stop being lenient about delay. Waiting for a national regulator to start actively enforcing NIS2 compliance before investing in it is a bet against an institution that just demonstrated, in open court, that it’s willing to escalate.

The 16% compliance figure is the headline, but the more useful number for a team actually planning this work is the other side of it: 75% of leaders in the same survey already see NIS2 compliance as a competitive advantage, not just a cost center avoided. The companies closing that gap now aren’t just reducing exposure to a €10 million fine. They’re building the kind of demonstrable security posture that’s quietly becoming a condition of doing business with EU partners, regardless of what a regulator ever asks for directly.

That reframes what the 84% of still-non-compliant companies are actually weighing. It isn’t a question of whether NIS2 compliance eventually gets enforced against a mid-sized company that’s behind — both the fine structure and the Commission’s own willingness to escalate against member states suggest it will be. It’s a question of whether a company gets there on its own timeline, with budget planned and incident-response procedures actually rehearsed, or on a regulator’s or an auditor’s timeline instead, after a significant incident has already forced the question.

None of this requires treating NIS2 compliance as a single, monolithic project that has to be solved in one budget cycle. The six findings above break down into pieces a team can act on independently and roughly in order: confirm scope honestly, including the supply-chain cases that pull in companies who never saw themselves as regulated; price the real cost of the gap against the real cost of the fine, since the two numbers rarely favor waiting; and rehearse the 24-hour reporting clock specifically, since that’s the one requirement no written policy can satisfy on its own. Talk to Fyld about where your own NIS2 compliance gap actually sits before it becomes someone else’s question to ask.