Analysis of the implementation of the NIS2 directive in the Weimar Triangle countries

This paper presents a comparative legal analysis of the implementation of the NIS2 Directive (Directive (EU) 2022/2555) in three EU Member States forming the Weimar Triangle: France, Germany, and Poland. These countries were selected due to their distinct legal-administrative models and their significant influence within the European Union. The study examines key elements of the national transposition processes, including legislative frameworks, scope of regulated entities, supervisory structures, enforcement mechanisms, and incident reporting systems. The analysis reveals considerable divergences in the timing and structure of implementation, largely shaped by national governance traditions, historical approaches to cybersecurity, and institutional readiness. France, with its centralized administrative model, has proposed an extensive regulatory scope including local authorities but faces delays due to political instability. Germany, leveraging its federal expertise and centralized supervisory body (BSI), has developed a coherent though still incomplete framework. Poland, in turn, has revised its initial legislative draft following stakeholder criticism, yet continues to face challenges regarding institutional fragmentation and enforcement clarity. The paper concludes that while all three states pursue the same strategic objectives—namely improved cyber resilience and regulatory harmonization—national context significantly impacts both the pace and effectiveness of implementation. The study highlights the critical role of established cybersecurity institutions and coherent legal design in ensuring successful adaptation of EU digital policies.