ZetrixwebWhere transposition stands
The NIS2 Directive's transposition deadline was 17 October 2024. The Commission opened infringement procedures in November 2024 against 23 member states that had not fully transposed it and issued reasoned opinions in May 2025 to 19. Trackers suggest around twenty of the 27 states had completed transposition by early 2026, but counts differ by source and some commentary looks unreliable, so check an up-to-date tracker for the countries you care about. In January 2026 the Commission also proposed a revision of the Cybersecurity Act and targeted NIS2 simplification amendments, which as of mid-2026 were still in the legislative process.
The practical conclusion is that the legal landscape is moving but the direction is stable.
What customers will ask
Expect questionnaires and contract clauses on security governance, risk assessment, access control, encryption, vulnerability handling, business continuity, and incident reporting. Under NIS2, in-scope entities must give an early warning of a significant incident within 24 hours, a notification within 72 hours, and a final report within a month, so they will ask how fast you can tell them about incidents affecting their service.
Where you are a critical supplier, they may also ask for audit rights, evidence of testing, and information about your own sub-suppliers.
| Area | What to be ready to show | Format |
|---|---|---|
| Governance | Security policy, accountable owner, review cadence | Policy summary |
| Incident handling | Detection, escalation, and customer notification times | Runbook excerpt |
| Vulnerability management | Scanning, patch timelines, disclosure process | Process summary |
| Continuity | Backups, recovery tests, results | Test report |
| Supply chain | Sub-processors and how you assess them | Maintained list |
Build once, reuse often
Prepare a single, current evidence pack and a standard answer set that your sales and customer teams can use, reviewed by someone who owns security. Commit to incident notification times you can actually meet and rehearse them. Align the work with the Cyber Resilience Act vulnerability process if you ship software, since the two overlap.
Treat certifications as helpful evidence but not as a substitute for a real program.
Getting more security questionnaires from EU customers? Talk to us about building your evidence pack.
Key takeaways
- NIS2 transposition is uneven across member states; counts vary by source, so check a current tracker.
- In-scope customers must manage supply chain risk and will ask suppliers for evidence now.
- Be ready for 24-hour, 72-hour, and one-month incident reporting questions.
- Prepare a single evidence pack and rehearse notification timelines.