Obligations due by this deadline
For online platforms and search engines
- Art 21 — Adopt implementing acts laying down the technical and methodological requirements of the measures referred to in paragraph 2 for specific service providers (DNS, TLD, cloud, data centre, CDN, MSP, MSSP, online marketplaces, search engines, social networking platforms, trust service providers).
For all in-scope entities
- Art 41 — Member States shall adopt and publish the measures necessary to comply with this Directive by 17 October 2024.
- Art 34 — The Member State shall notify the Commission of the provisions of the laws adopted pursuant to paragraph 8 by 17 October 2024.
Checklist — what you need to have done
- Art 21: adopt
- Art 41: adopt and publish
- Art 34: notify
What should already be in place — audit framing
17 October 2024 is 647 days behind us. The obligations on this page have been in force since then; treat any gap as an audit finding, not a planning question. The expected baseline under NIS2 Directive:
- entity registration with the competent authority — should be done already
- incident-reporting playbook update — should be done already
- management-body cybersecurity training — should be done already
If any of these are missing, the right next step is a gap assessment plus a documented remediation plan — not a re-design of the underlying programme.
Related Fontvera pages
- nis2 directive art 14 cooperation group obligations
- nis2 directive art 32 competent authorities obligations
- nis2 directive art 33 competent authorities obligations
- nis2 directive art 7 member state obligations
Check your full compliance exposure with the 5-minute Fontvera diagnostic →