Written 2026-10-07. Every date below is sourced, and every source was fetched between 2026-10-06 and 2026-10-07. Research notes, not legal advice.
A court case that quietly became a case study
On 8 July 2026, the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for failing to transpose the NIS2 Directive on cybersecurity, and asked for a lump sum plus a daily penalty (the infringement file for the Netherlands is INFR(2024)0288, opened with a formal notice on 27 November 2024, a reasoned opinion on 7 May 2025).
Then, on 1 October 2026 — four and a half months after the referral — the Commission closed the case. The Dutch cyber law (the Cyberbeveiligingswet, Cbw) had entered into force on 15 August 2026; the Netherlands notified its full transposition after that date, and the CJEU referral became moot before the Court ever ruled.
So in the span of one quarter: the rulebook went into force, the member state was in court, and the case was quietly shut. If that is your operating environment, "the law changed" is not a rumor you can dismiss — it is the normal operating condition. Here is the map as of this week.
The matrix (for a company with 50–500 employees)
| Instrument | In scope? | What it requires | When | Where I verified it (all fetched 2026-10-06/07) |
|---|---|---|---|---|
| NIS2 — Dir (EU) 2022/2555 | Yes, if you have ≥50 employees in an affected sector (and a few size-independent sectors beyond that) | National transposition: security measures, governance, incident reporting (24h / 72h / 1 month tiers in NL) | Transposition deadline was 17 Oct 2024. 23 of 27 member states have transposed. IE/ES/FR/NL referred 08-07-2026; NL case closed 01-10-2026. A targeted NIS2 amendment proposal was tabled 20-01-2026 | EC press release ip/26_1499 (08-07-2026); EC infringement decisions database (case timeline) |
| CSRD — Dir (EU) 2022/2464 | Mostly no, post-Omnibus | The scope was narrowed to >1,000-employee PIEs, listed companies, and non-EU groups with ≥€450M EU turnover. The 250–999-employee cohort is largely out for now; first binding wave FY2028, reports 2029 | Amendment Dir (EU) 2025/794 (OJ L 2025/794 of 16-04-2025) + Dir (EU) 2026/470 (OJ L 2026/470 of 26-02-2026), both In force | EUR-Lex 32025L0794 / 32026L0470 (both fetched) |
| CSDDD — Dir (EU) 2024/1760 | No, except via your value chain | Applies to "very large" undertakings: ≥5,000 employees and ≥€1.5B turnover; first duties 01-01-2029. Mid-market obligations are indirect — upstream information duties | Same two Omnibus amendments as CSRD | EC CSDDD topic page + the two OJ acts |
| AI Act — Reg (EU) 2024/1689 | Yes — size-independent | Art. 50 transparency (disclosure + AI-content marking) applies from 02-08-2026, with a marking grace period to 02-12-2026; Annex III high-risk applies from 02-12-2027; Annex I (AI embedded in regulated products) from 02-08-2028 | The AI Omnibus entered into force 27-07-2026 (OJ L 2026/1744; proposed 19-11-2025) — it is what moved Annex III from Aug 2026 to Dec 2027 | EC "AI Omnibus enters into force" (27-07-2026, updated 31-07-2026) + EUR-Lex OJ:L_202601744 |
| GPSR — Reg (EU) 2023/988 | Yes, if you sell products — any size | Product safety duties: traceability, online-marketplace information, responsible-person details | Applies since 13-12-2024 | EC DG Trade GPSR page |
| EAA — Dir (EU) 2019/882 | Yes, in covered sectors (digital products and services, banking services, transport, e-books) | Accessibility requirements for covered products/services | In force since 28-06-2025. A deferral to 2030 was proposed in the 19-11-2025 digital omnibus package; as of this writing I have not verified a final OJ text for the EAA part — and NL is already transposing and enforcing | EC digital omnibus proposal page (19-11-2025) |
Three real gaps I found while building this
The matrix above is mostly "what the Commission says." The interesting part is where the tooling doesn't cover the cohort:
- NIS2 "am I in scope" across 23 different national laws. The directive is uniform; the transpositions are not — thresholds, sector lists, and reporting tiers differ by member state. The incumbents I found (ISMS Copilot, NIS2Have, ECSO) are trackers and enterprise suites. Nobody owns the 50-person company that needs a plain-language yes/no and a deadline list for its own country.
- Post-Omnibus CSRD scope checks for the 250–999 cohort. That cohort was squeezed out of the new scope, but a lot of them are still reporting (or preparing) under the old one. The check "do I still have to report, and for which fiscal year" is a one-pager — and the tools I found skew to trackers and to the UK market.
- An AI Act deployer tool for the new dates. Art. 50 just started applying (02-08-2026). The only tool I could find for the dates is the official AI Act Service Desk timeline. A deployer-grade checklist for "what does Art. 50 require of my product, and what changes on 02-12-2027" does not appear to exist for non-lawyer audiences.
Honest caveats
- The Omnibus texts are fresh (2025–26); transition clauses can still shift details.
- The CSDDD numbers come from the EC's own topic page, which may lag the final OJ.
- The EAA 2030 deferral is, as of 2026-10-07, a proposed deferral — I could not verify a final act for that part, so treat the 28-06-2025 in-force date as the operative one until proven otherwise.
- National detail (thresholds, sector lists, reporting deadlines) differs per member state. This map is a dated starting point, not a substitute for advice from your own counsel.
Method
Primary sources, all fetched 2026-10-06/07: EUR-Lex (32025L0794, 32026L0470, OJ L 2026/1744), EC press corner (ip/26_1499, 08-07-2026), the EC infringement decisions database (INFR(2024)0288 timeline through its 01-10-2026 closure), EC digital-strategy news (AI Omnibus, 27-07-2026), and the EC's CSDDD/GPSR/EAA topic pages. Where a claim rests on a topic page rather than an OJ act, it is labelled above.
This is a dated status note, not legal advice. Pennyforge is a small one-person studio; if a date or a scope line above looks wrong to you, the cheapest way to fix it is a comment.
Top comments (0)