NIS2 is a directive, so it binds through national transposing law rather than directly. The transposition deadline was 17 October 2024 and a substantial number of member states missed it: the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice in July 2026. For financial firms the critical point is Article 4, under which DORA operates as lex specialis and disapplies the NIS2 risk-management and reporting articles, so most in-scope financial entities comply through DORA instead.