Timelines and status

All EU and national milestones from 2022 to today.

Free NIS2, GDPR and CRA events from authorities and non-profit bodies.

BSIG, BSI, German implementation status and next steps.

Which member states are done, which are behind.

The NIS2 Implementation and Cybersecurity Strengthening Act puts the NIS 2 Directive into German law. What it changes, where it stands (as of 2026) and why Germany missed the EU deadline.

Cyberbeveiligingswet, RDI and NCSC-NL — how the Netherlands implements NIS 2.

NISG, BMI and GovCERT.AT — how Austria transposes NIS 2 into national law.

Ordonnance 2024-1093, ANSSI and French supervision — how France implements NIS 2.

Real Decreto-ley and the Spanish CSIRT network INCIBE-CERT plus CCN-CERT — how Spain implements NIS 2.

Decreto Legislativo n. 138/2024 and the Agenzia per la Cybersicurezza Nazionale (ACN) — how Italy implements NIS 2.

Belgian NIS 2 law of 26 April 2024 and the Centre for Cybersecurity Belgium (CCB) — how Belgium implements NIS 2.

Amendment to the Polish National Cybersecurity Act (KSC) and CSIRT NASK plus CSIRT GOV — how Poland implements NIS 2.

Swedish NIS 2 transposition, MSB (Swedish Civil Contingencies Agency) and CERT-SE.

Danish NIS 2 transposition, CFCS (Centre for Cyber Security) and the sectoral supervision model.

Portuguese NIS 2 transposition and CNCS (National Cybersecurity Centre).

Irish NIS 2 transposition, NCSC-IE and the Department of the Environment, Climate and Communications (DECC).

Czech Cybersecurity Act (Zákon o kybernetické bezpečnosti) and NÚKIB as supervisory authority.

Hungarian Cybersecurity Act (Act XXIII of 2023) and SZTFH as supervisory authority — Hungary was one of the first Member States to transpose NIS 2.

Romanian NIS 2 transposition law (Law 58/2024) and DNSC as competent authority.

Greek NIS 2 transposition law and the National Cybersecurity Authority as competent authority.

Slovak NIS 2 transposition law (Act 366/2024) and NBÚ as competent authority.

Bulgarian NIS 2 transposition law and the e-Government Agency as competent authority.

Croatian NIS 2 transposition law (Zakon o kibernetičkoj sigurnosti) and CERT.hr / SOA as competent authorities.

Luxembourg NIS 2 transposition law (Law of 1 August 2024) and HCPN / ILR as competent authorities.

Slovenian NIS 2 transposition law and URSIV / SI-CERT as competent authorities.

Cypriot NIS 2 transposition law and DSA (Digital Security Authority) as competent authority.

Estonian Cybersecurity Act (Küberturvalisuse seadus) and RIA (Information System Authority) as competent authority.

Lithuanian Cybersecurity Act (Kibernetinio saugumo įstatymas) and NKSC as competent authority.

Latvian Cybersecurity Act (Kiberdrošības likums) and CERT.LV as competent authority.

Maltese NIS 2 transposition law (Legal Notice 71/2025) and CIPD / CSIRTMalta as competent authorities.

Finnish NIS 2 transposition, Traficom and NCSC-FI.

Status of NIS 2 transposition across all 27 EU Member States in a single table: national act, competent authority, status of the procedure.