Obligations due by this deadline
For all in-scope entities
- Art 40 — The Commission shall review the functioning of the Directive and report to the European Parliament and to the Council.
- Art 40 — The Commission shall report to the European Parliament and to the Council on the review of the Directive's functioning.
- Art 40 — The report shall assess the relevance of the size of the entities concerned, and the sectors, subsectors and types of entity referred to in Annexes I and II.
- Art 40 — The Commission shall take into account the reports of the Cooperation Group and the CSIRTs network on the experience gained at a strategic and operational level.
- Art 40 — The report shall be accompanied, where necessary, by a legislative proposal.
Checklist — what you need to have done
- Art 40: review
- Art 40: report
- Art 40: assess
- Art 40: take into account
- Art 40: propose
Start now — reverse timeline
462 days = 66 weeks until 17 October 2027. The typical work blocks under NIS2 Directive:
- entity registration with the competent authority — 1–2 weeks
- incident-reporting playbook update — 3–4 weeks
- management-body cybersecurity training — 2–3 weeks
Stack these end-to-end and most NIS2 Directive programmes need a minimum runway of 12–16 weeks. Compress one block and you have to either parallelise the others or accept residual risk on the back end.
Related Fontvera pages
- nis2 directive art 14 cooperation group obligations
- nis2 directive art 32 competent authorities obligations
- nis2 directive art 33 competent authorities obligations
- nis2 directive art 7 member state obligations
Check your full compliance exposure with the 5-minute Fontvera diagnostic →