Obligations due by this deadline
For all in-scope entities
- Art 19 — The Cooperation Group shall establish the methodology and organisational aspects of peer reviews with the assistance of the Commission and ENISA.
- Art 15 — By 17 January 2025, and every two years thereafter, the CSIRTs network shall assess the progress made with regard to the operational cooperation and adopt a report.
- Art 36 — Member States shall notify the Commission of the rules on penalties and measures taken to ensure implementation by 17 January 2025.
For online platforms and search engines
- Art 27 — Member States shall require entities listed in paragraph 1 to submit specific identification and contact information to the competent authorities by 17 January 2025.
- Art 27 — Entities referred to in paragraph 1 must submit their name, sector, address, contact details, Member States of service provision, and IP ranges to competent authorities.
Checklist — what you need to have done
- Art 19: establish
- Art 15: assess
- Art 27: require submission
- Art 27: submit
- Art 36: notify
What should already be in place — audit framing
17 January 2025 is 499 days behind us. The obligations on this page have been in force since then; treat any gap as an audit finding, not a planning question. The expected baseline under NIS2 Directive:
- entity registration with the competent authority — should be done already
- incident-reporting playbook update — should be done already
- management-body cybersecurity training — should be done already
If any of these are missing, the right next step is a gap assessment plus a documented remediation plan — not a re-design of the underlying programme.
Related Fontvera pages
- nis2 directive art 14 cooperation group obligations
- nis2 directive art 32 competent authorities obligations
- nis2 directive art 33 competent authorities obligations
- nis2 directive art 7 member state obligations
Check your full compliance exposure with the 5-minute Fontvera diagnostic →