NIS2 implementation in Europe: which countries have transposed NIS2
The deadline for transposition was 17 October 2024. Today, a national law applies in 24 of the 27 EU countries. Still without a law: France, Spain, and Ireland. Your company is subject to the law of the country where it is established; that is where you register.
Authority, portal and deadline per country
The tables are grouped by the state of registration. Each country shows its law and deadline.
22
Operational
1
Pre-Registration
0
Planned
4
Not Yet Available
| Country | Competent Authority | Registration Portal | Registration Deadline | National Law |
|---|---|---|---|---|
| Germany | BSI (Bundesamt für Sicherheit in der Informationstechnik) | BSI-Portal | 2026-03-06 | NIS2UmsuCG / BSIG |
| Belgium | CCB (Centre for Cybersecurity Belgium) | Safeonweb@Work | 2025-03-18 | NIS2 Law (Loi NIS2) |
| Italy | ACN (Agenzia per la Cybersicurezza Nazionale) | ACN NIS Portal | 2027-02-28 | D.Lgs. 138/2024 |
| Austria | Bundesamt für Cybersicherheit | NIS2 Services (Unternehmensserviceportal) | 2027-01-04 | NISG 2026 (BGBl. I Nr. 94/2025); NISV 2026 (BGBl. II Nr. 290/2026) |
| Czech Republic | NÚKIB (Národní úřad pro kybernetickou a informační bezpečnost) | Portál NUKIB | 2025-12-31 | Zákon č. 264/2025 Sb. o kybernetické bezpečnosti |
| Denmark | SAMSIK (Styrelsen for Samfundssikkerhed) | Virk | 2025-10-01 | LOV nr 434 af 06/05/2025 (NIS 2-loven) |
| Netherlands | NCSC-NL (since 1 Jan 2026 merged with DTC and CSIRT-DSP into "versterkt NCSC", SPOC + national CSIRT) + RDI (Rijksinspectie Digitale Infrastructuur, horizontal supervisor) | MijnNCSC / Entiteitenregister | 2026-08-15 | Cyberbeveiligingswet (Cbw), Stb. 2026, 187; Cyberbeveiligingsbesluit, Stb. 2026, 189 |
| Poland | Ministry of Digital Affairs / CSIRTs | System S46 | 2026-10-03 | Amended KSC Act (ustawa o KSC) |
| Sweden | NCSC (Nationellt cybersäkerhetscenter, at the FRA) + CERT-SE | Not yet available | TBD | Cybersäkerhetslagen (SFS 2025:1506) |
| Croatia | NHCSC-HR (National Cybersecurity Center) | Not yet available | TBD | Zakon o kibernetičkoj sigurnosti |
| Lithuania | NKSC (National Cybersecurity Center) | Not yet available | TBD | Kibernetinio saugumo įstatymas |
| Latvia | NCSC (Nacionālais kiberdrošības centrs, Ministry of Defence) / CERT.LV | Not yet available | 2025-04-01 | Nacionālās kiberdrošības likums |
| Greece | NCSA (National Cyber Security Authority) | NIS2 Register (Εγγραφή Οντοτήτων ν. 5160/2024) | 2025-09-30 | Law No. 5160/2024 |
| Slovakia | NBÚ (Národný bezpečnostný úrad) | NBÚ NIS2 portal (nis2.nbu.gov.sk) | TBD | Zákon o kybernetickej bezpečnosti |
| Romania | DNSC (Directoratul Național de Securitate Cibernetică) | NIS2@RO Platform | 2025-09-19 | Emergency Ordinance No. 155/2024; Laws No. 52/2025 & No. 124/2025 |
| Finland | Traficom + sector authorities (NCSC-FI as national CSIRT) | Not yet available | 2025-05-08 | Kyberturvallisuuslaki (124/2025) |
| Estonia | RIA (Riigi Infosüsteemi Amet) | Not yet available | 2026-03-31 | Küberturvalisuse seadus |
| Portugal | CNCS (Centro Nacional de Cibersegurança) + CERT.PT | MyCiber | 2026-09-15 | Decreto-Lei n.º 125/2025 |
| Hungary | SZTFH (Szabályozott Tevékenységek Felügyeleti Hatósága) | Not yet available | TBD | Act LXIX of 2024 (Hungarian Cybersecurity Act) |
| Luxembourg | ILR (Institut Luxembourgeois de Régulation) | ILR Guichet (NISS_EE231) | 2026-07-10 | Loi du 5 mai 2026 relative à des mesures visant à assurer un niveau élevé de cybersécurité |
| Malta | CIPD (Critical Infrastructure Protection Department) | Not yet available | TBD | Legal Notice 71/2025, amended by Legal Notice 89/2026 (S.L. 460.41) |
| Slovenia | URSIV (Information Security Agency) | Not yet available | 2025-12-19 | ZInfV-1 (Information Security Act) |
| Country | Competent Authority | Registration Portal | Registration Deadline | National Law |
|---|---|---|---|---|
| France | ANSSI (Agence nationale de la sécurité des systèmes d'information) | MonEspaceNIS2 | TBD | Loi Résilience (bundles NIS2 + DORA + CER) |
| Country | Competent Authority | Registration Portal | Registration Deadline | National Law |
|---|---|---|---|---|
| Spain | CCN-CERT / INCIBE | Not yet available | TBD | Not yet enacted |
| Bulgaria | Ministry of Innovation and Digital Transformation (formerly Ministry of e-Government) / State e-Government Agency | Not yet available | TBD | Cybersecurity Act (amended) |
| Cyprus | DSA (Digital Security Authority) | NIS2 Self-Assessment Tool | TBD | Law on Security of Networks and Information Systems (Amendment) 2025 |
| Ireland | NCSC (National Cyber Security Centre) | Not yet available | TBD | National Cyber Security Bill (draft) |
Which country is responsible for your company
The responsible country is the EU member state where your company is established. That is where you register and where you report incidents.
Delivering into a country does not make it responsible. A subsidiary in another EU country is established there; that country's law applies to it.
Exceptions apply to telecommunications, which falls under the country where it provides its services, and to certain digital providers such as cloud, data centres and managed services. For them, the main establishment in the EU counts: the country where decisions on cybersecurity are mainly taken.
Art. 26(1) and (2) NIS 2
What is the same everywhere, and what is not
The minimum list of security measures and the reporting deadlines, 24 hours, 72 hours and one month, are in the directive itself. Every country has to adopt them.
What differs is the authority, the portal, the registration deadline and some details. A country may adopt stricter rules.
Art. 5, 21 and 23 NIS 2
What this means for a company with 50 to 150 employees
If your company is established only in Germany, the BSI Act applies to you, even if you deliver to other countries.
If it has subsidiaries in other EU countries, check for each one whether it is in scope under that country's law. For size, linked and partner enterprises count under Recommendation 2003/361/EC.
You can set up the measures jointly. Each company has to register and report in its own country.
An example
A made-up company: a measurement technology manufacturer with 130 employees in Germany and a sales subsidiary in Austria with 12 employees.
Manufacturing of electronic and optical products is listed in Annex 2 of the BSIG. The German GmbH is an important entity and registers with the BSI.
The Austrian company is a company of its own. Whether it is in scope under the Austrian law depends on its sector and size, with the parent company counted in.
The company delivers to customers in France and Italy from Germany. It does not have to register there for that.
How the walkthrough does this
The walkthrough at nisd2.eu asks where your company is established and goes by that.
The registration step shows the competent authority for your country and its portal.
It explains in which EU country you register, with the exceptions for telecommunications and digital providers.
The security measures follow the directive's minimum list, which applies in every EU country.
The explanations in the walkthrough are available in German and English.
Common questions
Which countries have transposed NIS2?
A national law applies in 24 of the 27 EU countries. Still without a law: France, Spain, and Ireland. The tables above show each country's law, authority, portal and deadline.
Do I have to register in every country I deliver to?
No. The responsible country is the one where your company is established (Art. 26(1) NIS 2). A subsidiary in another country registers there if it is in scope there.
Is there a register for the whole EU?
No. Each country keeps its own. For certain digital providers such as cloud and data centres, ENISA also keeps a register (Art. 27 NIS 2).
What applies in a country that has not transposed NIS2 yet?
The directive is addressed to the member states. Duties for companies only arise with the national law. Until then, older rules from the first NIS directive may still apply there.
Sources
- Directive (EU) 2022/2555 (NIS 2), Art. 5, 21, 23, 26, 27 and 41, EUR-Lex
- Commission Recommendation 2003/361/EC, EUR-Lex
- Laws, authorities and portals per country: the national authorities' own information, linked in the tables
In practice
What the national law changes, and what it doesn't
The national law decides, among other things, where you register and whom you report incidents to. The measures themselves start from the same minimum list in every member state (Art. 21 NIS 2). The walkthrough takes you through them one step at a time:
Risk Management
Write down what your company has
A list of the processes, software and devices you work with.
Incident Handling
Plan what happens in an incident
Who decides, whom you call, how you reach each other.
Effectiveness Assessment
Record the management review
Management checks whether the measures work and approves your documents.
What the walkthrough costs
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days: invoice cancelled or money back.
Guided NIS 2 implementation, step by step
A history of changes and sign-offs to show your regulator
Deadlines and reminders for each requirement
Security questionnaire for your suppliers
Export to PDF or CSV at any time
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
