The Netherlands gave 8,000 organizations five weeks to prepare for NIS2. Is a shorter window a compliance constraint?
Imagine being told that you have only five weeks to comply with NIS2, a new European cybersecurity regulation. This is exactly what happened with almost 8,000 organizations in the Netherlands.
On July 7, 2026, the Dutch Senate approved the Cyberbeveiligingswet (Cbw), the national law implementing NIS2. It took effect on Aug. 15, 2026, 39 days later, with no general transition period.
Most of the organizations bound by the new cybersecurity law, including ministries, water authorities, municipalities, inter-municipal partnerships, and private entities across 18 sectors, had no such obligations five weeks earlier. If a five-week runway is what a finished national law could offer organizations, the only real strategy is not waiting for one at all. The question is whether that window was simply the consequence of a long legislative process, or a compliance constraint in its own right.
What NIS2 actually is
NIS2 is particularly designed to raise the cybersecurity standards of organizations that provide critical services. NIS2 is the European Union's cybersecurity rulebook, and if an organization operates in healthcare, banking, transport, digital infrastructure, or public administration, it is required to comply with these security standards.
NIS2 is a directive, not a regulation
As a regulation, the GDPR applied directly to all organizations across the EU the day it took effect. However, the NIS2 directive binds member states rather than organizations, meaning each government has to pass its own national law by transposing the directive's requirements.
NIS2 has had legal force at the EU level since Jan. 16, 2023, with every member state required to finish the transposition by October 2024.
However, most member states missed the deadline. The European Commission opened infringement procedures against 23 member states in November 2024 and sent reasoned opinions to 19 of them in May 2025.
A government's delay doesn't extend an organization's deadline
Here's the mistake of many European organizations: They read their government's delay in passing a NIS2 law as an extension of their own deadline.
When there is no national text to comply with, no designated regulator, no registration portal, and no published penalty schedule, building a compliance program against a directive an organization's own parliament has not yet interpreted feels like guessing at requirements that could still change.
National law informs who a regulator is, where to register, and the fines for non-compliance. But it does not tell the organization what to build.
The risk management measures under Article 21, the reporting deadlines under Article 23, and the rules making management accountable have all been written since 2023. Therefore, a Dutch hospital's to-do list did not change on the CBW's deadline. It just became enforceable.
A government's delay in transposing NIS2 doesn't give organizations an automatic extension of the deadline, it just gives them less time. Usually, when a country misses a deadline, the European Commission puts more pressure on the government to comply, and the government responds by reducing the transition period.
How a single vote changed the Dutch deadline
The EU deadline for transposing NIS2 had passed in October 2024. The Dutch Senate didn't approve the Cyberbeveiligingswet until July 7, 2026—21 months late. The next day, the European Commission referred the Netherlands, Ireland, Spain, and France to the EU court for still not having finished the transposition, asking for a fixed fine plus a daily penalty until each country complied.
That one-day gap explains why Dutch companies got so little notice. Approving a law is not the same as having it in force, and the daily penalty would keep running until the Cbw actually took effect. A long transition period—the months organizations normally get to prepare—would have meant more months of penalty exposure for the government. So the law took effect on August 15, just 39 days after the vote, and the roughly 8,000 organizations covered by it absorbed the compression.
The Netherlands is not unusual. By July 18, 2026, 22 of the 27 member states had a NIS2 law in force, an average of 246 days after the deadline, according to RegDossier's transposition tracker. Late laws and short notice tend to arrive together.
Is a shorter window becoming a compliance constraint?
The Netherlands finished transposing NIS2 21 months after the EU deadline. However, the Commission was escalating its penalties the whole time.
A long transition period would have meant dragging the case, and the penalties, on for longer. To avoid penalties, the Netherlands pushed the law into force on August 15, and passed the cost on to the 8,000 organizations that had to be ready on the day.
While a longer window may have helped the transition, what happened in Germany tells us a different story. Unlike the Netherlands, Germany transposed early: NIS2-Umsetzungsgesetz took effect on Dec. 6, 2025. When the BSI registration portal opened in January 2026, entities were given three months to register.
Approximately 11,500 organizations had registered—under 40%—and the BSI pushed the deadline back to July 31, 2026, and registrations grew to around 18,000.
But, around 11,000 organizations still didn't register by the July 31 deadline, almost eight months after the law took effect! Thirty-nine days in the Netherlands and eight months in Germany produced the same outcome.
Which country is next?
France, Spain, and Ireland still don't have a NIS2 law. The organizations in these regions are sitting exactly where Dutch organizations sat on July 6.
Most are making the same call: wait for the official text. France's Resilience bill came off the July 2026 session agenda, pushing review to September at the earliest. Ireland's Minister for Justice expects to notify transposition by the end of the year. Neither date is a commitment, and neither comes with a promised transition period.
Waiting for the law isn't the same as being ready for it, and survey data suggests that many organizations lack the processes needed to respond to NIS2 requirements. In ManageEngine's Owning Operational Resilience in 2026 survey of 1,514 IT and business decision-makers across five European markets, only 35% of Spanish respondents said their organization has a written incident response plan. This means once Spain transposes NIS2, most Spanish organizations will be playing catch-up.
For example, NIS2 expects an early warning within 24 hours, a fuller report within 72, and a final one within a month. That capability does not get built in the weeks after a law is published.
The window is not the constraint. Waiting is.
The Netherlands shows what happens when governments leave transposition until the last minute: the pressure eventually lands on the organizations expected to comply. Germany shows the other side of the coin: giving organizations eight months did not lead to a better outcome.
So perhaps the real compliance constraint is not the length of the window at all, but what organizations do with it. Organizations in France, Spain, and Ireland still have time that Dutch organizations no longer have. They should use it.
The core NIS2 requirements are already known, and capabilities such as incident reporting, risk management, and management accountability cannot be built overnight. National laws will still matter for the details of enforcement, but waiting for those details before doing anything is a risky strategy. If NIS2 has taught European organizations anything so far, it is that the safest deadline is the one you don't wait for.
