NIS2 transpositions: what actually diverges, read in the official gazettes
The directive is not what applies to your customers. The national transpositions are, and they diverge more than the word "harmonisation" suggests.
I have spent the last few weeks reading transpositions in their official gazettes rather than in summaries of them. Three things surprised me.
Training scope
Article 20(2) asks member states to make management body members take training. Every country I have read so far widened the circle. Croatia requires the director to train and to let employees train (čl. 29 st. 3), and extends the personal scope to anyone with supervisory, representative or decision-making power over the measures (st. 4). Poland makes it annual, once per calendar year, documented, and applies it to whoever the obligations were delegated to (art. 8e). France targets the management body and "les personnes exposées aux risques" (art. 14, 1°). Three out of three. If your training plan stops at the board, it is probably too narrow.
Poland invented an obligation that is not in the directive at all
Articles 67b to 67c create a high-risk supplier regime. A ministerial designation published in Monitor Polski is immediately enforceable and carries no request for reconsideration. Once it lands you cannot deploy the covered products, you have seven years to withdraw what you already run (four years for telecom operators on the critical-function categories), and public-procurement entities cannot buy them. Nothing in NIS2 anticipates a seven-year clock attached to a named vendor.
Croatia turned a soft recommendation into a hard deadline
Article 23 says entities should inform the recipients of their services where appropriate, and sets no deadline. Croatia gives 72 hours, with mandatory content (čl. 85). The directive's three notification acts also became five, and the final report runs from the initial notification rather than from the moment the incident is closed (čl. 65).
The divergence that costs money to get wrong
On supply chain, Italy and Portugal both require you to document what a supplier can actually reach: "valutato e documentato" for access to data and intellectual property, weighted by criticality (Misure ACN GV.SC-07.R1), and "a exposição da sua informação" as a categorisation input (QNRCS GR.CA-7). Poland and Germany require nothing of the sort, and Germany did not transpose art. 21(3) at all. A tool that demands that field everywhere is as wrong as one that offers it nowhere.
Which national text applies to you?
The free scoping assessment names the statute that binds you, the authority you report to and the deadlines that country actually sets — not the directive's defaults. No card required.