Q-Secur Back to insights
May 2026 · updated November 2026

Regulation or directive, does it matter?

The question comes up on every assignment. A client shows me a European text and asks what to apply. The answer starts with what kind of text it is.

Two instruments, two logics

Article 288 of the Treaty on the Functioning of the European Union distinguishes several kinds of legal act. Two of them matter here.

A regulation is binding in its entirety and directly applicable in every Member State. No national text sits in between. On the day it becomes applicable, it takes effect the same way in Lisbon, in Brussels and in Paris.

A directive binds Member States as to the result to be achieved. Each country then chooses the form and the means, and passes its own law within the deadline the directive set. What you apply is that national law, not the directive.

What that changes for you

With a regulation, the European text governs. You read it in whichever language you prefer, since every version published in the Official Journal of the EU carries the same legal weight. The AI Act, Regulation (EU) 2024/1689, works that way. So does PART-IS in aviation.

With a directive, the European text gives you the spirit and the scope. Your obligation itself lives in your own country's law. If you operate in several Member States, you have as many texts to read as countries you are established in.

Transposition does leave room for choices. Thresholds, reporting deadlines, the penalty regime and the competent authorities vary from one country to the next, within the limits the directive sets.

NIS 2, three countries, three situations

Directive (EU) 2022/2555, known as NIS 2, had to be transposed by 17 October 2024 at the latest. The three countries we work in show three different paths.

Belgium kept to the calendar. Its transposing act came into force on 18 October 2024. The Centre for Cybersecurity Belgium supports the entities concerned through its CyberFundamentals framework.

Portugal transposed later, through Decree-Law no. 125/2025. The Portuguese National Cybersecurity Centre completed the regime with an implementing regulation published in June 2026.

France still has not transposed. The bill on the resilience of critical infrastructure and the strengthening of cybersecurity was tabled in October 2024, passed by the Senate, then voted through in special committee at the National Assembly in September 2025. Its debate in plenary has been put off several times, most recently in early October 2026. The European Commission referred France to the Court of Justice of the European Union on 8 July 2026 and is asking for financial penalties. Ireland, Spain and the Netherlands are covered by the same decision.

A company present in those three countries therefore lives through three situations under a single directive. In Belgium it has been covered since October 2024. In Portugal since 2025. In France it is waiting for a text with no date attached.

What we do with this in audit

A late Member State suspends nothing. Your clients' requirements, the clauses in your contracts and your insurers' expectations do not wait for the Official Journal. Plenty of French organisations are already preparing on the basis of the European text and the pending bill.

So we audit on two levels. We check conformity with the national text where one exists. We measure the gap against the directive where it does not yet. The second piece of work prepares the first.

Worth remembering

Before asking how to comply, ask which kind of text you are dealing with. A regulation points you to Brussels. A directive points you to your own legislator, and to no one else.

Sources