Most EU countries miss NIS2 deadline

Impact on the domain name industry

NIS2 makes specific reference to the domain name industry, for which it consequently has major implications. Some of the directive's requirements apply to DNS service providers and domain name registration service providers active in the EU, regardless of their size. For example, Article 28 says that, when a domain name is registered, the details of the registrant have to be checked to make sure they're accurate and complete. In practice, that implies that domain name registration must involve some form of data verification. That's no small matter, given that roughly 1.1 million new domain names are registered in the Netherlands every year, of which about 700,000 are .nl domain names.

Slow progress on implementation

Across Europe, the implementation of NIS2 is going slowly. Only Belgium and Croatia have definitely met the deadline. In various other countries, the position is unclear, because a phased approach to implementation has been adopted. In the Netherlands, draft legislation has been published and consultation has taken place, but the resulting Cyber Security Act isn't expected until Q3 2025.

Progress has been slow mainly because the directive allows member states considerable discretion in terms of how the European rules are translated into national legislation. As a result, many countries have become mired in time-consuming debate about how the directive's requirements should be interpreted. In Germany, for example, the Bundesrat (the representation of the 16 state governments) last month recommended a very strict regime for verifying registrants' identities, only for the recommendations to be largely rejected by the government last week.

Impact already being felt

Despite all the confusion and delay, enterprises and institutions covered by the directive have no choice but to act, because compliance with the new rules involves considerable preparation in many cases. It's also impractical for a business that's active across the EU to keep abreast of the implementation situation in every member state, and to adapt their procedures accordingly. Many are choosing to avoid unmanageable complexity by adopting EU-wide procedures.

That's the case, for example, with the approach registrars are taking to the verification of registrant data. Rather than wait to see what each member state will require, a lot of registrars are looking to immediately introduce verification procedures for all European registrations. That's certainly the situation with e-mail address validation, which registrars already need to carry out for generic domain name extensions such as .com.

SIDN publishes online trust centre

The need to verify registrant data is just one of NIS2's implications for registrars and hosting service providers. Such businesses are also required to ensure that their own security, and that of other service providers in their supply chains, is in order. For a .nl registrar, SIDN is a supply-chain service provider. However, it clearly isn't practical for each of the 1,100 .nl registrars to independently verify that SIDN has appropriate security measures in place. We have therefore made the relevant information about our security status and policies available in a public 'trust centre', which registrars and other stakeholders can access at https://trust.sidn.nl/. The existence of the trust centre means that registrars in the Netherlands and other countries can easily comply with the requirement to check that our security is in order.

More information

In the period ahead, NIS2 will come into effect right across Europe, as member states introduce national legislation one by one. We will continue to monitor developments and share updates on this site whenever appropriate. If in the meantime you'd like to know more about NIS2's implications for you as a registrar, drop a line to support@sidn.nl.