The EU's NIS2 Directive Is In Force – But Can It Be Enforced?

If a European Union member state hasn't transposed a directive into its national law, are in-scope organisations liable for non-compliance with the directive from the date at which the member state should have done so?

That is the question that numerous clients have been asking in recent weeks, in light of the fact that only four of the EU's 27 member states — Belgium, Croatia, Italy and Lithuania — fully transposed the NIS2 Directive into national law by the date on which they should have done, namely, 17 October 2024. (Hungary and Latvia have also adopted NIS2 into their respective laws, although as we shall see below, the European Commission does not appear to consider that these laws have "full[y]" implemented the Directive.)