Article 41Transposition
1. By 17 October 2024, Member States shall adopt and publish the measures necessary to comply with this Directive. They shall immediately inform the Commission thereof.
They shall apply those measures from 18 October 2024.
2. When Member States adopt the measures referred to in paragraph 1, they shall contain a reference to this Directive or shall be accompanied by such reference on the occasion of their official publication. The methods of making such reference shall be laid down by Member States.
NIS2, the European Union directive on network and information security, Article 41
Member States had to adopt and publish the measures necessary to comply with the Directive by 17 October 2024 and inform the Commission immediately. They had to apply those measures from 18 October 2024. National measures must refer to the Directive, or be accompanied by that reference when officially published; each State decides how.
This is the article that turns the Directive into national law an entity can be held to. For an entity, the operative text is therefore the transposing law of the Member State concerned, which may go beyond the Directive (Article 5) and has its own dates, scope and penalties. Whether and when a particular State completed transposition is a fact about that State, to be checked at its source rather than assumed from the deadline.
Text: Directive (EU) 2022/2555, OJ L 333, 27.12.2022, p. 80, as corrected by Corrigendum OJ L, 2023/90206, 22.12.2023 (Article 19(1): “by 17 January 2025”, replacing “on”), from EUR-Lex. Only the Official Journal text is authentic.