NIS2 transposition deadline: manufacturing enters the scope

2024-10-17 · Publisher : Union européenne · Domain : Industry 4.0 & 5.0

Member States had to transpose the NIS2 Directive (EU) 2022/2555 by 17 October 2024, with application from the next day. It covers 18 critical sectors, including parts of manufacturing.

What changes

  • Transposition deadline: 17 October 2024; measures applicable from 18 October 2024.
  • 18 critical sectors covered, including manufacture of machinery, electrical equipment, electronics and vehicles.
  • Risk-management and incident-reporting obligations, management accountability.
  • Several states late, including France, referred to the CJEU in July 2026.

### Background The **NIS2 Directive** (Directive (EU) 2022/2555) had to be transposed by Member States by **17 October 2024**, with national measures applying from **18 October 2024**. It replaces NIS1 and greatly widens the scope of regulated entities. ### Timeline - **December 2022**: directive published. - **17 October 2024**: transposition deadline; national measures apply from 18 October. - **28 November 2024**: Commission letters of formal notice to late states. - **8 July 2026**: France, Ireland, Spain and the Netherlands referred to the EU Court of Justice for incomplete transposition. ### Why it matters NIS2 covers **18 critical sectors**. Under "manufacturing", it targets in particular medical devices, electronics and optics, electrical equipment, machinery and vehicles. In-scope entities must manage cyber risk (including industrial systems and the supply chain), report significant incidents within short deadlines, and their management bodies are accountable. For automation teams, this means OT network segmentation, control of remote maintenance access and an inventory of PLCs. ### Key takeaway With NIS2, shop-floor cybersecurity becomes a legal obligation for a large part of industry, not just a good practice.

Links

Tags : Réglementation, UE, Cybersécurité OT, NIS2