NIS2 in Late 2026: Transposition Status, Supervisor Expectations and the Belgian Model

Two years after the NIS2 deadline, most Member States have national laws in force and supervisors have moved from awareness to verification. Here is where things stand in October 2026, with a closer look at Belgium.

The NIS2 Directive (EU) 2022/2555 had to be transposed into national law by 17 October 2024 ^[1]. Two years on, the picture has changed considerably. Most Member States now have a national law in force, the Commission has escalated infringement cases against the remaining laggards, and supervisors in early-adopting countries have shifted from awareness campaigns to verification. This article summarises the position as of 18 October 2026 and what it means in practice, with a focus on Belgium.

Where transposition stands in October 2026

The Commission has gone to court

The Commission sent letters of formal notice to Member States that had not notified full transposition on 28 November 2024 and followed up with reasoned opinions on 7 May 2025. On 8 July 2026 it referred Ireland, Spain, France and the Netherlands to the Court of Justice of the EU, asking the Court to impose a lump sum and daily penalty payments until transposition is complete ^[2].

The remaining gaps

Since that referral, the Netherlands has moved: its Cyberbeveiligingswet and the law transposing the Critical Entities Resilience Directive entered into force on 15 August 2026, with registration with the NCSC required from that date ^[3].

France, Ireland and Spain were still without a national NIS2 law in force at the time of writing:

• France: the “Résilience” bill was due for debate in the Assemblée nationale on 7 October 2026, but the session was postponed again on 6 October, with no new date set ^[4].
• Ireland and Spain: bills are still in the national legislative process, according to independent trackers ^[5].

Status can change quickly, so check the national official journal or competent authority before relying on any tracker. Organisations operating across borders should note that the Directive’s jurisdiction rules mean some entities, for example many digital infrastructure and ICT service providers, fall under the Member State of their main establishment ^[1].

The rules themselves are being revised

On 20 January 2026 the Commission proposed targeted amendments to NIS2 as part of a wider cybersecurity package. The proposal would, among other things, create a “small mid-cap” category generally treated as important rather than essential entities, and add ransomware-specific reporting fields ^[6]. Separately, the November 2025 Digital Omnibus proposes a single entry point for incident reporting under NIS2, GDPR, DORA and eIDAS ^[7]. As of October 2026, both are still proposals under negotiation. Current national obligations apply in full until any amendment is adopted and transposed.

The question supervisors ask is no longer whether you know about NIS2, but whether you can show it working.

What supervisors now expect

Registration that is accurate and kept current

Member States had to establish their lists of essential and important entities by 17 April 2025 ^[1]. Registration is not a one-off task: entities must notify changes to their registered details. Supervisors use registration data to plan inspections, so outdated contact details, sector classifications or lists of Member States where services are provided create avoidable friction.

A tested, staged incident reporting process

Article 23 of NIS2 requires significant incidents to be reported to the CSIRT or competent authority in stages ^[1]:

Stage	Deadline	Content
Early warning	Within 24 hours of becoming aware	Whether the incident is suspected to be caused by unlawful or malicious acts, and whether it could have cross-border impact
Incident notification	Within 72 hours of becoming aware	Update, initial assessment of severity and impact, indicators of compromise where available
Final report	Within one month of the incident notification	Detailed description, likely root cause, mitigation applied, cross-border impact

An intermediate report can be requested at any time, and a progress report is required if the incident is still ongoing at the one-month mark. For digital infrastructure and certain digital providers, Implementing Regulation (EU) 2024/2690 defines when an incident is “significant” ^[11].

Supervisors increasingly look for evidence that the process works: a documented significance assessment, named decision-makers, out-of-hours coverage, and records from exercises or real notifications. The 24-hour clock runs from awareness, so the hand-off from the security operations team to whoever files the report is often the weak point.

Management body accountability

Article 20 requires management bodies to approve cybersecurity risk-management measures, oversee their implementation and follow training, and allows them to be held liable for infringements ^[1]. Article 32 adds that, for essential entities, authorities can in some cases temporarily prohibit a person in a managerial role from exercising those functions ^[1]. Supervisors therefore look for minutes showing approval of the risk-management measures, regular reporting to the board, and training records for board members.

Proportionate, documented risk management

Article 21 lists ten minimum measure areas, from risk analysis and incident handling to supply chain security, cryptography and multi-factor authentication ^[1]. In practice, the expectation is a documented, risk-based rationale for each measure and evidence that it is operating, not only a policy.

The Belgian model: CCB and CyFun

Belgium was one of the first Member States to transpose, through the Law of 26 April 2024, in force since 18 October 2024. The Centre for Cybersecurity Belgium (CCB) acts as national cybersecurity authority and national CSIRT ^[8].

Key Belgian deadlines

• Registration on Safeonweb@Work: by 18 December 2024 for certain digital-sector entities and by 18 March 2025 for all other essential and important entities ^[8].
• 18 April 2026: essential entities had to complete their first mandatory conformity assessment ^[8].
• 18 April 2027: essential entities that chose CyberFundamentals (CyFun) or ISO/IEC 27001 must hold the corresponding certification ^[8].

For entities identified later by the CCB, these deadlines run from the date of notification ^[8].

CyFun as the conformity framework

CyFun is the CCB’s framework with three assurance levels: Basic, Important and Essential. A selection tool helps entities determine the appropriate level ^[9]. Essential entities must undergo regular conformity assessment, and those holding a valid conformity statement benefit from a presumption of conformity ^[8]. Important entities can opt into the same regime voluntarily to obtain that presumption ^[9].

In practice, the routes are a CyFun verification (Basic or Important level) or certification (Essential level) by an accredited conformity assessment body, an ISO/IEC 27001 certification with documentation submitted to the CCB, or inspection by the CCB ^[10]. Reports from the market indicate that accredited assessment capacity has been limited, which is one reason to plan the 2027 milestone now rather than in early 2027 ^[10].

Incidents are notified to the CCB through its notification platform, with phone notification reserved for emergencies ^[9].

Practical next steps

1. Re-validate your classification and registration in every Member State where you operate, especially where laws entered into force in 2025–2026.
2. Run a timed incident reporting exercise against the 24-hour and 72-hour deadlines, including the significance decision.
3. Document board oversight: approval of measures, a reporting cadence and completed training.
4. Map controls once, reuse them often. CyFun, ISO/IEC 27001 and the Article 21 measures overlap heavily; a single control set with shared evidence avoids duplicate work.
5. Belgian essential entities: confirm your 2027 target level and book your conformity assessment body early.

Closing note

Secrato helps organisations manage frameworks such as NIS2, DORA and ISO 27001 in one EU-hosted platform, with shared controls, evidence and audit trails.