Resource
NIS2 Implementation Tracker by EU Member State
Where NIS2 stands in all 27 member states: transposition status, national law, competent authority, registration duty and sources. Every row is cited, and anything we could not confirm is marked as such. Last checked 24 October 2026.
What transposition means
NIS2 (Directive (EU) 2022/2555) is a directive, not a regulation. It does not apply directly: each member state has to write it into national law, and the deadline for doing so was 17 October 2024. The national law is what decides which authority supervises you, how and by when you register, how incidents are reported and what fines actually apply.
For a company active in several member states, that means there is not one NIS2 but up to 27 versions of it. As a rule, the member state where an entity is established has jurisdiction; for certain digital services (such as cloud, data centres and managed services) it is the main establishment (Article 26). A group with subsidiaries in several countries can quickly face several registers, reporting channels and deadlines. This tracker shows the current position in each country, with the official source.
24
Transposed and in force
0
Adopted, not yet in force
3
Draft law, not yet adopted
0
No bill yet
Number of member states per status, as of 24 October 2026.
NIS2 transposition by member state · verified only
Showing 27 of 27 member states
| National law | Authority / CSIRT | Registration | National specifics and EU case | Sources | ||
|---|---|---|---|---|---|---|
| AustriaAT | Transposed and in force in force since Published 23 December 2025 (BGBl. I Nr. 94/2025); replaces the NISG 2018. | Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026) Network and Information Systems Security Act 2026 | Bundesamt für Cybersicherheit (BCS), Federal Ministry of the Interior | Required Within three months of entry into force: by 1 January 2027, at the latest 4 January 2027 (§ 33 AVG), via the Unternehmensserviceportal (USP). [source] | checked | |
| BelgiumBE | Transposed and in force in force since Published in the Moniteur belge on 17 May 2024; repeals the NIS1 Act of 2019. | Loi du 26 avril 2024 établissant un cadre pour la cybersécurité des réseaux et des systèmes d'information d'intérêt général pour la sécurité publique / Wet van 26 april 2024 tot vaststelling van een kader voor de cyberbeveiliging van netwerk- en informatiesystemen van algemeen belang voor de openbare veiligheid Act of 26 April 2024 on a cybersecurity framework for network and information systems of general interest for public security (NIS2 Act) | Centre for Cybersecurity Belgium (CCB), which also hosts the national CSIRT | Required Within five months of entry into force (Art. 13), i.e. by 18 March 2025, on Safeonweb@work. [source] |
| checked |
| BulgariaBG | Transposed and in force Amending act published in State Gazette No. 17 of 13 February 2026. Exact in-force date not confirmed from an official text. | Закон за изменение и допълнение на Закона за киберсигурност (ДВ, бр. 17 от 13.02.2026 г.) Act amending and supplementing the Cybersecurity Act (State Gazette No. 17/2026) | Minister of Innovation and Digital Transformation (keeps the register), plus sectoral competent authorities; national CSIRT: GovCERT Bulgaria | Not confirmed Authority-led: sectoral authorities identify essential and important entities; the Minister keeps the register (Art. 6). No general self-registration deadline found. |
| checked |
| CroatiaHR | Transposed and in force in force since Published in Narodne novine 14/2024; in force on the eighth day after publication. | Zakon o kibernetičkoj sigurnosti (NN 14/2024) Cybersecurity Act | Sectoral competent authorities; Security and Intelligence Agency (SOA) as central body with its National Cyber Security Centre (NCSC-HR); CARNET CERT as second CSIRT | No separate duty No self-registration: competent authorities categorise entities and notify them (first round within one year of entry into force). [source] |
| checked |
| CyprusCY | Transposed and in force in force since In force on publication in the Official Gazette (25 April 2025), except one article; amends Law 89(I)/2020. | Ο περί Ασφάλειας Δικτύων και Συστημάτων Πληροφοριών (Τροποποιητικός) Νόμος του 2025 (Ν. 60(Ι)/2025) Security of Networks and Information Systems (Amending) Law of 2025 | Digital Security Authority (DSA), which hosts the national CSIRT-CY | Required Entities submit their details when the DSA requests them and report changes within two weeks. No fixed statutory date found. [source] |
| checked |
| CzechiaCZ | Transposed and in force in force since | Zákon č. 264/2025 Sb., o kybernetické bezpečnosti Act No. 264/2025 Coll. on Cybersecurity | Národní úřad pro kybernetickou a informační bezpečnost (NÚKIB), which also runs the governmental CERT | Required Notify NÚKIB within 60 days of meeting the criteria (§ 6); for entities in scope from the start, by 31 December 2025, via the NÚKIB Portal. [source] |
| checked |
| DenmarkDK | Transposed and in force in force since Act No. 434 of 6 May 2025; replaces four sectoral NIS1 acts. | Lov om foranstaltninger til sikring af et højt cybersikkerhedsniveau (NIS 2-loven) Act on measures to ensure a high level of cybersecurity (NIS 2 Act) | Styrelsen for Samfundssikkerhed (SAMSIK) with sector authorities; national CSIRT: Danish Defence Intelligence Service | Required By 1 October 2025 for entities in scope at entry into force, via a single form on virk.dk. [source] |
| checked |
| EstoniaEE | Transposed and in force in force since Amends the existing Cybersecurity Act (RT I, 30.12.2025, 4). | Küberturvalisuse seaduse ja teiste seaduste muutmise seadus (küberturvalisuse 2. direktiivi ülevõtmine) Act amending the Cybersecurity Act and other Acts (transposition of NIS2) | Riigi Infosüsteemi Amet (RIA, Information System Authority), home of CERT-EE | Required Within three months of entry into force or of meeting the criteria, through the state portal eesti.ee. [source] | checked | |
| FinlandFI | Transposed and in force in force since | Kyberturvallisuuslaki (124/2025) Cybersecurity Act (124/2025) | Sectoral supervisory authorities, coordinated by Traficom’s National Cyber Security Centre (NCSC-FI), the national CSIRT | Required Within one month of entry into force (by 8 May 2025) or of meeting the criteria, in the entity list of the sector supervisor. [source] |
| checked |
| FranceFR | Draft law, not yet adopted Adopted by the Senate on 12 March 2025; still at first reading in the National Assembly. A floor debate set for 7 October 2026 was postponed. | Projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité Bill on the resilience of critical infrastructure and stronger cybersecurity (transposes NIS2, CER and the DORA directive) | Agence nationale de la sécurité des systèmes d'information (ANSSI), as designated in the bill | Not confirmed No legal duty yet. ANSSI offers voluntary pre-registration on MonEspaceNIS2 until the law and its decrees are published. [source] | checked | |
| GermanyDE | Transposed and in force in force since BGBl. 2025 I Nr. 301; amends the BSI Act (BSIG). No general transition period. | Gesetz zur Umsetzung der NIS-2-Richtlinie und zur Regelung wesentlicher Grundzüge des Informationssicherheitsmanagements in der Bundesverwaltung (NIS2UmsuCG) NIS2 Implementation and Cybersecurity Strengthening Act | Bundesamt für Sicherheit in der Informationstechnik (BSI), also the national CSIRT | Required Within three months of qualifying (§ 33 BSIG); for entities in scope from the start, by 6 March 2026, via the BSI portal. [source] |
| checked |
| GreeceGR | Transposed and in force in force since Published in FEK A 195 of 27 November 2024; in force on publication. | Νόμος 5160/2024: Ενσωμάτωση της Οδηγίας (ΕΕ) 2022/2555 σχετικά με μέτρα για υψηλό κοινό επίπεδο κυβερνοασφάλειας στο σύνολο της Ένωσης Law 5160/2024 transposing the NIS2 Directive | National Cybersecurity Authority (Εθνική Αρχή Κυβερνοασφάλειας), also the national CSIRT | Required Self-declaration on the gov.gr platform set up by Joint Ministerial Decision 1381/2025; changes within two weeks. Current deadline not confirmed from an official source. [source] |
| checked |
| HungaryHU | Transposed and in force in force since Replaces Act XXIII of 2023, Hungary’s earlier NIS2 law. | 2024. évi LXIX. törvény Magyarország kiberbiztonságáról Act LXIX of 2024 on the Cybersecurity of Hungary | Szabályozott Tevékenységek Felügyeleti Hatósága (SZTFH) for businesses; national CSIRT: NCSC Hungary (Nemzeti Kibervédelmi Intézet) | Required Register with SZTFH within 30 days of starting operations or coming into scope; data already registered under the 2023 Act need not be re-filed. [source] |
| checked |
| IrelandIE | Draft law, not yet adopted Only a General Scheme (2024) exists; as of 7 October 2026 the bill had not been introduced in the Oireachtas. NIS1 rules still apply. | General Scheme of the National Cyber Security Bill 2024 Draft outline of the National Cyber Security Bill | National Cyber Security Centre (NCSC), proposed as competent authority and CSIRT under the bill | Not confirmed The NCSC says its NIS2 registration portal will only open once the law is enacted. [source] |
| checked |
| ItalyIT | Transposed and in force in force since Published in Gazzetta Ufficiale No. 230 of 1 October 2024. | Decreto legislativo 4 settembre 2024, n. 138 Legislative Decree No. 138 of 4 September 2024 transposing NIS2 | Agenzia per la cybersicurezza nazionale (ACN), home of CSIRT Italia | Required Every year from 1 January to 28 February on the ACN platform, with an annual information update from 15 April to 31 May. [source] |
| checked |
| LatviaLV | Transposed and in force in force since Published in Latvijas Vēstnesis 128A of 4 July 2024; amended in 2026. | Nacionālās kiberdrošības likums National Cybersecurity Law | Nacionālais kiberdrošības centrs (National Cybersecurity Centre, Ministry of Defence); CSIRT: CERT.LV | Required Initial self-notification to the National Cybersecurity Centre by 1 April 2025; cybersecurity manager and self-assessment by 1 October 2025. [source] |
| checked |
| LithuaniaLT | Transposed and in force in force since New wording of the existing Cybersecurity Law (No. XIV-2902). | Lietuvos Respublikos kibernetinio saugumo įstatymo Nr. XII-1428 pakeitimo įstatymas (Nr. XIV-2902) Law amending the Law on Cybersecurity No. XII-1428 | Nacionalinis kibernetinio saugumo centras (NKSC, National Cyber Security Centre), home of CERT-LT | Not confirmed Entities are entered in the national register of cybersecurity entities, and duties apply from registration (Art. 11(2)). Whether entities must self-register by a deadline is not confirmed. [source] | checked | |
| LuxembourgLU | Transposed and in force in force since Law of 5 May 2026, published in Mémorial A No. 225 on 6 May 2026. | Loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité Law of 5 May 2026 on measures for a high level of cybersecurity | Institut Luxembourgeois de Régulation (ILR); CSSF for banking and financial market infrastructures | Required Within two months of entry into force, i.e. by 10 July 2026, through the ILR self-registration form. [source] | checked | |
| MaltaMT | Transposed and in force in force since Order L.N. 71 of 2025 brought into force by L.N. 22 of 2026; amended by L.N. 89 of 2026. | Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order (S.L. 460.41) NIS2 transposition Order, Subsidiary Legislation 460.41 | Critical Infrastructure Protection (CIP) Department; Malta Communications Authority for listed digital infrastructure; national CSIRT within MITA | Required Self-registration with the CIP Department, naming the CSIRT that monitors the entity. Deadline not confirmed. [source] |
| checked |
| NetherlandsNL | Transposed and in force in force since Published as Stb. 2026, 187; replaces the Wbni. | Cyberbeveiligingswet (Cbw) Cybersecurity Act | Sectoral ministers as competent authorities with their inspectorates (e.g. RDI); NCSC keeps the register and acts as CSIRT | Required In the NCSC entity register (mijn.ncsc.nl) from entry into force; changes within two weeks. [source] |
| checked |
| PolandPL | Transposed and in force in force since Dz. U. 2026 poz. 252; amends the National Cybersecurity System Act (KSC). | Ustawa z dnia 23 stycznia 2026 r. o zmianie ustawy o krajowym systemie cyberbezpieczeństwa oraz niektórych innych ustaw Act of 23 January 2026 amending the National Cybersecurity System Act and certain other acts | Minister of Digital Affairs (register), sectoral competent authorities; CSIRT GOV, CSIRT NASK and CSIRT MON | Required Self-registration in Wykaz KSC: by 3 October 2026 for entities in scope on 3 April 2026; otherwise within six months of meeting the criteria. [source] | checked | |
| PortugalPT | Transposed and in force in force since In force 120 days after publication; CNCS Regulation 756/2026 (22 June 2026) sets the implementing rules. | Decreto-Lei n.º 125/2025, de 4 de dezembro (Regime Jurídico da Cibersegurança) Decree-Law 125/2025 approving the Cybersecurity Legal Regime | Centro Nacional de Cibersegurança (CNCS), with sectoral cybersecurity authorities | Required On the CNCS MyCiber platform: within 60 business days of the platform opening (23 June 2026) for entities already active; 30 business days for new ones. [source] | checked | |
| RomaniaRO | Transposed and in force in force since Emergency Ordinance published on 31 December 2024; approved with amendments by Law 124/2025. | Ordonanța de urgență nr. 155/2024 privind instituirea unui cadru pentru securitatea cibernetică a rețelelor și sistemelor informatice din spațiul cibernetic național civil Emergency Ordinance 155/2024 on a cybersecurity framework for networks and information systems in the national civil cyberspace | Directoratul Național de Securitate Cibernetică (DNSC), competent authority and national CSIRT | Required Notify DNSC within 30 days (Art. 18); DNSC then issues an identification decision. Portal details not confirmed from an official source. [source] |
| checked |
| SlovakiaSK | Transposed and in force in force since Amends the Cybersecurity Act No. 69/2018. | Zákon č. 366/2024 Z. z., ktorým sa mení a dopĺňa zákon č. 69/2018 Z. z. o kybernetickej bezpečnosti a o zmene a doplnení niektorých zákonov Act 366/2024 amending Act 69/2018 on Cybersecurity | Národný bezpečnostný úrad (NBÚ, National Security Authority), with the national CSIRT SK-CERT | Required Notify NBÚ within 60 days of starting the activity; changes within 14 days. [source] |
| checked |
| SloveniaSI | Transposed and in force in force since Published in Uradni list RS 40/2025 on 4 June 2025. | Zakon o informacijski varnosti (ZInfV-1) Information Security Act | Urad Vlade Republike Slovenije za informacijsko varnost (URSIV); CSIRTs: SI-CERT and SIGOV-CERT | Required Entities in scope on 19 June 2025 had until 19 December 2025; new entities within 30 days, via the URSIV web form. [source] |
| checked |
| SpainES | Draft law, not yet adopted Government draft approved in first reading by the Council of Ministers on 14 January 2025; not yet sent to parliament. The NIS1 law (Real Decreto-ley 12/2018) still applies. | Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad Draft Law on Cybersecurity Coordination and Governance | Not confirmed | Not confirmed No NIS2 registration regime yet; the draft has not been enacted. | checked | |
| SwedenSE | Transposed and in force in force since SFS 2025:1506; replaces the NIS1 act. | Cybersäkerhetslag (2025:1506) Cybersecurity Act | National Cybersecurity Centre (NCSC) at FRA for registration and CSIRT since 1 July 2026 (previously MCF); supervision by sector authorities | Required As soon as possible after coming into scope (registration opened 2 February 2026); changes within 14 days. Filed with NCSC since 1 July 2026. [source] |
| checked |
Last checked:
Commission infringement procedures
A member state that misses the transposition deadline faces an infringement procedure by the European Commission. It runs in three steps: a letter of formal notice, a reasoned opinion, and a referral to the Court of Justice of the EU. The steps taken on NIS2 so far:
Letters of formal notice to 23 member states that had not notified full transposition by the 17 October 2024 deadline. source
Reasoned opinions to 19 member states: Austria, Bulgaria, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Hungary, Ireland, Latvia, Luxembourg, the Netherlands, Poland, Portugal, Slovenia, Spain and Sweden. source
Referral of Ireland, Spain, France and the Netherlands to the Court of Justice of the EU, with a request for financial penalties. source
Latest closures recorded: by this date 16 of the 24 NIS2 cases in the Commission database were closed, including the Netherlands after its new law took effect. Eight remain open: Ireland, Spain and France before the Court, and Germany, Estonia, Finland, Portugal and Sweden at reasoned-opinion stage. A case can stay open after a law is in force until the Commission has assessed it. source
How we verify
We apply the same rule as the NIS2 Enforcement Tracker: a field appears only when we can cite it, preferably to the official gazette, the responsible ministry, the national cybersecurity authority or the European Commission. Law-firm trackers served only as leads; where possible we cite the official source instead.
Where a field cannot be sourced, it says “Not confirmed”. We do not estimate or fill gaps with assumptions. Each row carries its own check date; the tracker as a whole was last checked on 24 October 2026. Transposition keeps moving. If you know of a more recent official source, tell us.
Not legal advice. This tracker is for orientation. It does not replace the legal text or advice from a lawyer qualified in the member state concerned. The officially published version of each law always prevails.
Related tools and guides
NIS2 Scope Checker
Check whether your company is an essential or an important entity.
NIS2 Enforcement Tracker
Verified NIS2 sanctions, each cited to a primary source.
What is NIS2?
The Directive in plain terms: sectors, duties, deadlines.
NIS2 fines and penalties
The Article 34 ceilings and how national laws apply them.
NIS2 board liability
What Article 20 asks of management bodies.
Frequently asked questions
Which EU countries have transposed NIS2?
As of 24 October 2026, 24 of the 27 member states have a NIS2 transposition law in force. France, Ireland and Spain have not yet brought a law into force. The tracker lists each country's law, date in force, competent authority and registration duty, with an official source per row.
What happens in a member state that has not transposed NIS2?
The European Commission opens an infringement procedure: a letter of formal notice, then a reasoned opinion, then a referral to the Court of Justice, which can impose financial penalties. In July 2026 the Commission referred Ireland, Spain, France and the Netherlands to the Court. For companies, the directive itself does not create duties; they come from the national law, so until it is adopted the earlier NIS1 rules continue to apply there.
Do I have to register under NIS2 in every country where I operate?
Not automatically. As a rule an entity falls under the member state where it is established, so a group with subsidiaries in several countries usually registers each subsidiary in its own country. Certain digital providers, such as cloud, data centre and managed service providers, fall under the member state of their main establishment (Article 26). Deadlines and portals differ by country, which is why the tracker lists them per row.
How do you verify the data?
Each field is cited, preferably to the official gazette, the responsible ministry, the national cybersecurity authority or the European Commission. Law-firm trackers serve only as leads. Where a field cannot be confirmed from a source we show "Not confirmed" rather than an estimate, and every row carries the date it was last checked.
See what NIS2 means for you in euros.
Run the free simulation on your external perimeter: no login, no integration, results in minutes.