# NIS2 Enforcement: National Deadlines & Backup Readiness

> NIS2 is now in force across the EU but enforcement and member-state transposition timelines vary. Here is the deadline overview and a backup-and-recovery readiness checklist mapped to the directive.

Source: https://loopbackup.com/blog/nis2-enforcement-deadlines-backup-readiness
Publisher: Loop Backup
Content language: en

---

## At a Glance

The NIS2 Directive entered into force in January 2023 with a transposition deadline of 17 October 2024. Member states are now in enforcement mode, but national authorities are applying different audit and reporting timelines through 2026.

If your organisation is an **essential** or **important** entity under NIS2, and the scope is much broader than NIS1, you are inside the regime now, regardless of whether you have been audited yet.

## What NIS2 expects from backup and recovery

Article 21 requires "policies and procedures regarding the use of cryptography and, where appropriate, encryption" and explicitly calls out **backup management, disaster recovery and crisis management**. Translated to practical controls:

- Tested, immutable backups of all in-scope systems
- Documented Recovery Time Objective (RTO) and Recovery Point Objective (RPO) per service
- Air-gapped or logically segregated backup copies
- Regular restore drills with evidence retained for the audit
- Incident reporting within 24 hours of awareness, full report within 72 hours

See our [3-2-1 backup rule](/3-2-1-backup-rule) and [air-gapped backups](/air-gapped-backups) guides for the technical building blocks.

## Member-state timing snapshot

Several member states transposed late and are running phased audit programmes. Treat any 2026 milestone as a *minimum*, your national CSIRT may already be requesting evidence.

## Penalties

Up to **EUR 10 million or 2% of global annual turnover** for essential entities, and **EUR 7 million or 1.4%** for important entities. Management bodies can be held personally liable.

## How Loop Backup helps

[Loop Backup](/) provides immutable, geographically separated backups with documented RTO/RPO, full restore drill reporting, and EU data residency, see [data centre locations](/data-center-eu) and [security overview](/data-centre-security).

## Bottom line

The transposition deadline has passed. The enforcement runway has not. Use the checklist below to be defensible.