NIS2 transposition remains incomplete — France and Spain still among the laggards

NIS2 transposition is still incomplete across several Member States more than 18 months after the October 2024 deadline, with most of the EU now compliant but a minority — France and Spain among them — still lagging (EC Digital Strategy — NIS transposition tracker; Viktoria Compliance NIS2 tracker). France in particular has not yet enacted its NIS2 transposition vehicle, which means the national authority cannot formally designate in-scope entities or apply sanctions there — and NIS2-derived incident-notification obligations on French entities are therefore not yet enforceable. The operational consequence for Swiss organisations with French or Spanish supply-chain or data-processing counterparts: do not assume NIS2 notification and security obligations are operative in those jurisdictions yet, and confirm the contractual basis for any incident-notification flow rather than relying on a not-yet-transposed statutory one.