NIS2 Implementation Status

    Track the transposition progress of the NIS2 Directive across all EU Member States, including competent authorities and enforcement timelines.

    As of October 2026

    Recent transposition updates

    • October 2026 — Austria: NISG 2026 entered into force on 1 October; entity registration due by 1 January 2027. Italy: full security-measures compliance required from 1 October. Poland: entity registration window closed on 3 October.
    • 15 August 2026 — Netherlands: the Cyberbeveiligingswet (Cbw) entered into force.
    • July 2026 — European Commission referred France, Ireland and Spain to the CJEU for non-transposition. Dutch Senate passed the Cbw on 7 July.
    • 6 May 2026 — Luxembourg: NIS2 transposition law enacted (formerly Bill 8364).

    NIS2 Implementation Status Snapshot

    Fully Notified (16)
    Adopted (8)
    Draft (3)

    Last verified: 09/10/2026 · Reviewed monthly

    Member StateStatusCompetent AuthorityNotesSource
    Austria
    Adopted
    		Federal Ministry of the Interior (BMI) / Bundesamt für Cybersicherheit (operational 1 October 2026)NISG 2026 promulgated 23 December 2025 and in force since 1 October 2026; entity registration due by 1 January 2027; notification completeness under Commission review.Official source
    Verified 09/10/2026
    Belgium
    Fully Notified
    		Centre for Cybersecurity Belgium (CCB) — CyFun® / Safeonweb@WorkNIS2 Law in force 18 October 2024; registration via Safeonweb@Work closed 18 March 2025; CyFun® self-assessment or ISO 27001 SoA deadline 18 April 2026 (now passed); full certification by 18 April 2027.Official source
    Verified 09/10/2026
    Bulgaria
    Adopted
    		Multiple national competent authorities (Ministry of Defence, Ministry of Interior, State Agency for National Security) — Minister of e-Government maintains national registerCybersecurity Act amendments in force 17 February 2026; reduced sanctions for breaches before 1 June 2026; Council of Ministers designation methodology due ~17 August 2026 — administrative designation model.Official source
    Verified 09/10/2026
    Croatia
    Fully Notified
    		Security and Intelligence Agency (SOA) — National Cybersecurity Center (NCSC-HR); CERT.hr (CARNET) for incident reporting via PiXi; autonomous sector supervisors (HNB, HANFA, HACZ)Cybersecurity Act (NN 14/2024) in force 15 February 2024 — among earliest EU transpositions; Cybersecurity Regulation (NN 135/2024) in force 30 November 2024; authority-led notification model with 12-month compliance window; national deviations include Education sector, biennial self-assessment for important entities, and stricter technical controls.Official source
    Verified 09/10/2026
    Cyprus
    Adopted
    		Digital Security Authority (DSA) — primary; Commissioner of Communications also designated as supervisory authorityNetwork and Information Systems Security (Amendment) Law 60(I)/2025 enacted 10 April 2025, in force 25 April 2025; national deviations include a 6-hour early warning deadline (stricter than the Directive's 24h) and a DSA-led entity identification model (no self-registration); Commission notification completeness under review.Official source
    Verified 09/10/2026
    Czech Republic
    Adopted
    		National Cyber and Information Security Agency (NUKIB)Act on Cybersecurity No. 264/2025 Coll. in force since 1 November 2025; self-identification via NÚKIB portal (registration deadline 31 December 2025 for entities in scope); 12-month compliance window for security and reporting measures from registration decision; essential entities must report all cyber-origin incidents (stricter than Directive); NÚKIB empowered to restrict or prohibit insecure supply chain vendors for strategically important entities.Official source
    Verified 09/10/2026
    Denmark
    Adopted
    		Ministry for Societal Resilience and Contingency (MSSB) — coordinator; sector regulators (Danish Energy Agency, Finanstilsynet, telecom regulators) — primary supervisors; CFCS — National CSIRTNIS2 Act (L 141) in force since 1 July 2025 with no transitional grace period; self-registration via Virk.dk (deadline 1 October 2025 — passed); minimum transposition approach (no gold-plating); national deviations: direct administrative fines not available (sanctions follow criminal prosecution via the public prosecution authority) and personal management liability not transposed (governed by Danish Companies Act duty of care); Commission notification completeness under review.Official source
    Verified 09/10/2026
    Estonia
    Fully Notified
    		Estonian Information System Authority (RIA)Amended Cybersecurity Act in force since 1 January 2026; ~3,500 → ~6,500 entities in scope; research institutions added as national sector beyond Directive baseline; risk management aligned with E-ITS baseline controls; phased compliance — self-registration via RIA deadline ~1 April 2026 (now passed), governance controls by 1 January 2027, full technical compliance and first audits by 1 January 2028.Official source
    Verified 09/10/2026
    Finland
    Fully Notified
    		Traficom (NCSC-FI) — coordinator; sector authorities superviseCybersecurity Act (124/2025) in force since 8 April 2025; registration deadline 8 May 2025 and risk management deadline 8 July 2025 both passed; decentralised supervision across seven sector-specific authorities coordinated by Traficom's NCSC-FI; administrative fines imposed by a separately established sanctions board on supervisory authority proposal; public sector entities cannot be fined; financial sector excluded (covered by DORA).Official source
    Verified 09/10/2026
    France
    Draft
    		ANSSI (French National Agency for Information Systems Security)Loi Résilience (consolidating NIS2, CER and DORA) cleared the Senate on 12 March 2025 and the National Assembly special committee on 10 September 2025; final adoption and promulgation still pending. After the 7 May 2025 reasoned opinion, the Commission referred France to the CJEU in July 2026. ANSSI's MonEspaceNIS2 pre-registration portal is live; ~15,000–18,000 entities in scope across 18 sectors.Official source
    Verified 09/10/2026
    Germany
    Fully Notified
    		Bundesamt für Sicherheit in der Informationstechnik (BSI)NIS2UmsuCG in force since 6 December 2025 with no transitional period; ~4,500 → ~29,000–30,000 entities in scope; BSI registration deadline of 6 March 2026 has passed; two-step BSI portal / Mein Unternehmenskonto (MUK) registration; mandatory 3-yearly management cybersecurity training; "negligible activities" exemption under § 28(3) BSIG.Official source
    Verified 09/10/2026
    Greece
    Fully Notified
    		National Cybersecurity Authority (NCSA)Law 5160/2024 in force since 28 November 2024; supplemented by MD 1645/2025 (registration) and MD 1689/2025 (22-topic security framework); registration deadlines (28 Mar 2025 for digital infrastructure; 30 Sep 2025 general) have passed; mandatory ICSSO appointment (incompatible with DPO); NCSA audits commenced Q4 2025.Official source
    Verified 09/10/2026
    Hungary
    Adopted
    		SZTFH (primary) / NKI/NCSC (CSIRT)Act LXIX of 2024 in force since 1 January 2025; SZTFH is the primary regulator (registration, auditor registry, supervisory fees); NKI/NCSC is the national CSIRT; banking, financial market infrastructure, and public administration are excluded from scope; registration and auditor-contract deadlines have passed; first cybersecurity audit deadline 30 June 2026 (now passed); EC reasoned opinion 7 May 2025 — Commission assessment ongoing.Official source
    Verified 09/10/2026
    Ireland
    Draft
    		National Cyber Security Centre (NCSC-IE)National Cyber Security Bill 2024 still progressing through the Oireachtas and not yet enacted; the Commission referred Ireland to the CJEU in July 2026 for non-transposition. NIS1 (S.I. 360 of 2018) continues to apply; proposed federated supervision (NCSC lead + CRU, ComReg, Central Bank of Ireland).Official source
    Verified 09/10/2026
    Italy
    Fully Notified
    		Italian National Cybersecurity Authority (ACN) + sector regulatorsLegislative Decree No. 138/2024 in force since 16 October 2024; ACN is the primary regulator with a central portal for registration and reporting. Scope extended via national Annexes III & IV. Registration deadlines passed in 2025; incident reporting mandatory since 1 January 2026; full compliance with security measures required since 1 October 2026. Fully notified to the Commission.Official source
    Verified 09/10/2026
    Latvia
    Fully Notified
    		National Cybersecurity Centre (NCSC)Latvia's National Cybersecurity Law has been in force since 1 September 2024 (replacing the former IT Security Law); Cabinet Regulation No. 397 (minimum cybersecurity requirements) in force since 2 July 2025; the European Commission's May 2025 reasoned opinion has been resolved. The National Cybersecurity Centre (NCSC) — Ministry of Defence with CERT.LV — is the primary supervisor, while the Constitution Protection Bureau oversees critical ICT infrastructure. Entities must appoint a cybersecurity manager, classify systems into three tiers (A/B/C), and conduct annual ICT security reviews. All initial deadlines (entity registration, cybersecurity manager appointment, first self-assessment) have passed; transposition fully notified.Official source
    Verified 09/10/2026
    Lithuania
    Fully Notified
    		National Cyber Security Centre (NCSC)Lithuania's amended Law on Cybersecurity entered into force on 18 Oct 2024; the Government Resolution on Implementation followed on 12 Nov 2024. The NCSC notified the initial register of 1,443 entities around 17 Apr 2025; phased compliance follows (organisational measures ~17 Apr 2026 — now passed; technical measures ~17 Apr 2027). Lithuania expands scope beyond the Directive (local public administration, critical R&D entities, electronic information hosting providers), mandates appointment of a cybersecurity manager, and requires essential entities to undergo a triennial independent conformity assessment. Fully notified to the European Commission.Official source
    Verified 09/10/2026
    Luxembourg
    Adopted
    		ILR (most sectors) / CSSF (financial); HCPN coordinationNIS2 transposed by the Law of 6 May 2026 (formerly Bill 8364), replacing the NIS1 law; notification completeness under Commission review. Split supervisory model — ILR for most sectors, CSSF for financial entities, HCPN for coordination; expanded scope (~6,000–8,000 entities); incident notification and registration via ILR's SERIMA platform.Official source
    Verified 09/10/2026
    Malta
    Fully Notified
    		CIPD (primary) / MCA (digital + postal); CSIRT Malta (incidents)NIS2 transposed via Legal Notice 71 of 2025 (S.L. 460.41), published 8 April 2025 and fully in force on 23 January 2026 via L.N. 22 of 2026; replaces NIS1 (L.N. 216/2018). CIPD is primary supervisor; MCA is competent for digital infrastructure and postal/courier; CSIRT Malta (within CIPD) handles incident response; CIPAB advises on penalties. Entities must self-register with the CIPD and designate an internal/autonomous CSIRT; first formal audits expected H2 2027.Official source
    Verified 09/10/2026
    Netherlands
    Adopted
    		Sector-specific competent authorities under the Cbw; NCSC (CSIRT)The Cyberbeveiligingswet (Cbw) passed the Senate (Eerste Kamer) on 7 July 2026 and entered into force on 15 August 2026, replacing the Wbni; notification completeness under Commission review. Multi-regulator model with sector-specific competent authorities (e.g., RDI for digital infrastructure, ILT for transport); NCSC is national CSIRT and coordinator. Dual incident reporting (NCSC + sector authority); mandatory management cybersecurity training; registration via mijn.ncsc.nl now mandatory.Official source
    Verified 09/10/2026
    Poland
    Fully Notified
    		Ministry of Digital Affairs (lead) / sectoral ministries (supervision); CSIRT GOV, NASK, MON (incidents)Amended UKSC (Act on the National Cybersecurity System) in force since 3 April 2026; EC infringement resolved on transposition. Ministry of Digital Affairs leads and keeps the register; sector ministries supervise; CSIRT GOV/NASK/MON handle incidents. Mandatory ISMS (ISO 27001 + ISO 22301), non-delegable board training and personal liability; penalties up to PLN 100M. Registration window closed 3 October 2026; next milestones: full ISMS by 3 April 2027, first audit by 3 April 2028.Official source
    Verified 09/10/2026
    Portugal
    Fully Notified
    		CNCS (lead) / sectoral + special supervisory authorities; Crisis Office (coordination)Portugal completed NIS2 transposition via Decree-Law No. 125/2025 (Regime Jurídico da Cibersegurança); published 4 December 2025; in force 3 April 2026 (120 days after publication); replaces Law 46/2018 and Decree-Law 65/2021 entirely; missed 17 October 2024 deadline; EC reasoned opinion 7 May 2025 resolved on publication. Multi-layered supervisory model — CNCS lead + sectoral and special supervisory authorities + new Crisis Office. Mandatory cybersecurity officer (management body member or direct report) + permanent 24/7 CNCS point of contact, both due 4 May 2026 (20 working days from entry into force — now passed). Group A / Group B classification for public entities. Phased compliance — CNCS platform registration 60 days from launch (date TBC); major obligations (risk management, supply chain, annual reporting) apply 24 months after CNCS implementing regulations are published.Official source
    Verified 09/10/2026
    Romania
    Fully Notified
    		National Cybersecurity Directorate (DNSC)Romania completed NIS2 transposition via GEO 155/2024 (adopted 30 Dec 2024; in force 31 Dec 2024); refined by Law 124/2025 (in force 10 Jul 2025) extending healthcare to pharmaceutical supply chain and retail pharmacies (NACE 4773); operationalized via DNSC Orders 1/2025 (registration) and 2/2025 (risk assessment), both in force 20 Aug 2025; sanction provisions from 30 Jan 2025; primary authority DNSC; doubled-maximum-fine power in aggravated cases (incl. €10M / 2% caps); mandatory designation of person responsible for cybersecurity (independent from operational IT head) and mandatory management cybersecurity training; entity registration via NIS2@RO platform — initial deadline ~19 Sep 2025 (passed); only post-20 Aug 2025 registrations legally valid; four-step compliance chain — registration → risk-level self-assessment → maturity self-assessment (within 60 days) → remediation plan (within 30 days); national defence, public order, national security, MFA, law enforcement entities excluded.Official source
    Verified 09/10/2026
    Slovakia
    Fully Notified
    		NBÚ (lead) / sector ministries (supervision); SK-CERT (incidents)Slovakia completed NIS2 transposition via Act No. 366/2024 Coll. amending Cybersecurity Act No. 69/2018 Coll.; National Council adoption 28 Nov 2024; Collection of Laws publication 19 Dec 2024; in force 1 Jan 2025; Slovakia 4th EU Member State to complete transposition; ~3,500–14,000 entities expected in scope; primary authority NBÚ (Národný bezpečnostný úrad); SK-CERT (National Cyber Security Centre, within NBÚ) handles incident response; sector-specific ministries (e.g., Health, Transport) have supplementary roles; framework aligned with ISO 27000 family of standards; supporting Ordinance on Security Measures developed during 2025; supply-chain third parties explicitly regulated as direct entities (beyond Directive minimum); registration via JISKB portal — initial deadline ~1 Mar 2025 (passed); new entities 60 days from becoming in-scope; full compliance with all obligations required by 31 Dec 2026; intermediate incident report may be requested by SK-CERT between 72-hour notification and final report.Official source
    Verified 09/10/2026
    Slovenia
    Fully Notified
    		URSIV (lead/NCC-SI/SPOC); SI-CERT (private) / SIGOV-CERT (gov) (incidents)Slovenia completed NIS2 transposition via the Information Security Act (ZInfV-1) (Zakon o informacijski varnosti); adopted by the National Assembly 23 May 2025; published in Official Gazette No. 40/25 on 4 June 2025; in force 19 June 2025; new comprehensive statute replacing the prior ZInfV (2018); adopted under emergency procedure following EC reasoned opinion of 7 May 2025; primary authority URSIV (Government Office for Information Security), also acting as NCC-SI and national single point of contact; SI-CERT (operated by ARNES) as national CSIRT for private sector; SIGOV-CERT for government institutions; scope extended beyond Directive minimum to include research and higher-education institutions; cybersecurity requirements framework annexed to the law; ISO/IEC 27001 referenced as applicable standard; ISMS + BCMS mandatory; URSIV registration deadline 19 December 2025 (passed); new entities 30 days from becoming in-scope; phased risk-management deadlines — 19 June 2026 (prior ZInfV essential service providers) / 19 December 2026 (all other essential/important entities); compliance assessment by accredited CAB at least every 2 years for essential entities.Official source
    Verified 09/10/2026
    Spain
    Draft
    		CNC (proposed lead/SPOC); CCN-CERT (public) / INCIBE-CERT (private) / ESPDEF-CERT (defence) (CSIRTs)Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad approved by the Council of Ministers on 14 January 2025 and still before the Cortes Generales; the Commission referred Spain to the CJEU in July 2026. NIS1 (RD-Law 12/2018) continues to apply. Draft creates the Centro Nacional de Ciberseguridad (CNC) as lead authority; CSIRTs CCN-CERT (public), INCIBE-CERT (private), ESPDEF-CERT (defence); scope beyond the Directive minimum; tiered fines €10k–€2M with NIS2 caps for the most serious cases.Official source
    Verified 09/10/2026
    Sweden
    Fully Notified
    		MSB/MCF (lead/coordinator/SPOC/CSIRT); PTS (digital sectors); sector authoritiesSweden completed its NIS2 transposition via the Cybersäkerhetslagen (Cybersecurity Act, SFS 2025:1506), adopted by the Riksdag 10 Dec 2025 and in force 15 Jan 2026 — a new comprehensive statute replacing Information Security Act 2018:1174, with the Cybersäkerhetsförordningen issued concurrently. Sweden missed the 17 Oct 2024 deadline and received an EC reasoned opinion 7 May 2025 (resolved post-enactment). MSB (Myndigheten för samhällsskydd och beredskap) was renamed MCF (Myndigheten för civilt försvar — Swedish Civil Defence and Resilience Agency) as of 1 Jan 2026; MSB/MCF serves as national coordinator, EU single point of contact, and national CSIRT. Sweden operates a decentralised supervisory model — sector-specific authorities supervise their respective sectors, with PTS (Post- och telestyrelsen — Swedish Post and Telecom Agency) co-regulating digital infrastructure, digital providers, ICT service management (B2B), space, and postal and courier services. Whole-entity approach — the entire IT footprint of in-scope entities must comply. Mandatory management training is sanctionable. Trust service providers must submit both early warning and incident notification within 24 hours (deviation from 72h). Time-limited prohibition on holding management functions possible for essential-entity board members. Registration deadline 16 Feb 2026 (passed); MSB/MCF notification portal launched 2 Feb 2026; all obligations apply immediately from 15 Jan 2026 with no general grace period.Official source
    Verified 09/10/2026

    Many of these Member States have adopted primary laws but still need full secondary legislation and Commission notification before enforcement is considered complete.

    Status Legend

    • Fully Notified = national transposition adopted and no open Commission reasoned opinion about incomplete notification.
    • Adopted = national transposition law adopted (or published) but Commission has requested further information / notification completeness (or notification still to be confirmed). If the law is already in force but notification is pending review, it is indicated.
    • Draft = legislative process ongoing / no final national law published.
    View Country and Sector Guides

    Key Implementation Notes

    Deadline & Commission Action

    All Member States were required to transpose NIS2 by 17 October 2024; most missed this deadline. On 7 May 2025, the European Commission issued reasoned opinions to 19 Member States for failing to notify full transposition. In July 2026 the Commission referred France, Ireland and Spain to the Court of Justice of the EU (CJEU) for failing to transpose NIS2, and may request financial penalties.

    "Adopted" vs "Fully Notified"

    Some Member States have enacted national laws but have not yet fully notified all implementing measures to the Commission. Other Member States are still in draft or legislative/parliamentary review.

    Enforcement & Regulatory Readiness

    Where national law is in force, entity registration, incident reporting, supervisory powers, and penalties (up to EUR 10 million or 2% of turnover for essential entities) are being phased in through secondary regulations.

    Pending Enforcement

    In Member States with Adopted or Draft status, registration and reporting obligations are not yet enforceable until national law is in force and authorities have published legal instruments and portals. This does not preclude diligent organizations from starting their NIS2 compliance journeys now.

    Competent Authority Clarifications

    Across the EU, Member States designate one or more competent authorities responsible for NIS2 implementation and enforcement.

    Supervising Compliance

    Overseeing adherence to NIS2 obligations across essential and important entities

    Receiving Incident Reports

    Processing and coordinating responses to cybersecurity incident notifications

    Maintaining Entity Lists

    Keeping registers of essential and important entities within their jurisdiction

    Enforcing Requirements

    Implementing risk management and governance requirements through regulatory action

    Typical Authority Types

    • National Cybersecurity Authorities/Agencies or dedicated cybersecurity regulators (e.g., CCB, ACN, NUKIB, ANSSI)
    • Sectoral regulators for finance, telecoms, energy where responsibilities are delegated
    • CSIRTs serve coordination and reporting functions under national law