NIS2 tracker: where every EU country stands on transposition
As of 16 October 2026: a national NIS2 law is in force in 24 of the 27 EU countries. Still without a law in force: France, Ireland, and Spain. The EU deadline for transposition was 17 October 2024. The table shows each country's law, authority, CSIRT and status.
The status in every EU country
For each country, the national law, the lead authority, the national CSIRT and the status. Where a country has its own page, its name links to it.
| Country | National law | Competent authority | National CSIRT | Status |
|---|---|---|---|---|
ATAustria | NISG 2026 (BGBl. I Nr. 94/2025); NISV 2026 (BGBl. II Nr. 290/2026) Original NISG (BGBl. I Nr. 111/2018) transposed NIS 1; replaced by NISG 2026 (BGBl. I Nr. 94/2025), in force 1 October 2026. | Bundesamt für Cybersicherheit | GovCERT (public administration, run by the Bundesamt für Cybersicherheit), HealthCERT (health sector), national CSIRT (all other sectors), under §§ 8 to 11 NISG 2026 | In force |
BEBelgium | NIS2 Law (Loi NIS2) One of the first Member States to transpose. Entered into force 18 October 2024. | CCB (Centre for Cybersecurity Belgium) | CERT.be (under CCB) | In force |
BGBulgaria | Cybersecurity Act (amended) | Ministry of Innovation and Digital Transformation (formerly Ministry of e-Government) / State e-Government Agency | CERT Bulgaria | In force |
HRCroatia | Zakon o kibernetičkoj sigurnosti Adopted in 2024. Sectoral supervision model. | NHCSC-HR (National Cybersecurity Center) | CERT.hr (CARNet) | In force |
CYCyprus | Law on Security of Networks and Information Systems (Amendment) 2025 | DSA (Digital Security Authority) | CSIRT-CY | In force |
CZCzechia | Zákon č. 264/2025 Sb. o kybernetické bezpečnosti The earlier Cybersecurity Act (Zákon č. 181/2014 Sb.) transposed NIS 1. It was replaced by Act 264/2025 Sb., in force since 1 November 2025. | NÚKIB (Národní úřad pro kybernetickou a informační bezpečnost) | GovCERT.CZ (NÚKIB), CSIRT.CZ | In force |
DKDenmark | LOV nr 434 af 06/05/2025 (NIS 2-loven) Denmark uses a sectoral supervision model. CFCS, which runs the national CSIRT, has been part of SAMSIK since 29 January 2025. | SAMSIK (Styrelsen for Samfundssikkerhed) | CFCS (Centre for Cyber Security) | In force |
EEEstonia | Küberturvalisuse seadus Estonia transposed quickly via amendment to its existing 2018 Cybersecurity Act. | RIA (Riigi Infosüsteemi Amet) | CERT-EE (within RIA) | In force |
FIFinland | Kyberturvallisuuslaki (124/2025) Transposition act Kyberturvallisuuslaki (124/2025) in force since 8 April 2025. | Traficom + sector authorities (NCSC-FI as national CSIRT) | NCSC-FI (Kyberturvallisuuskeskus, within Traficom) | In force |
FRFrance | Loi Résilience (bundles NIS2 + DORA + CER) Layered on top of existing OIV / OSE regime under the Code de la défense. Registration via MonEspaceNIS2. The Assemblée nationale withdrew the transposition bill from its 7 and 9 October 2026 floor sessions; no new date is set (next Conférence des présidents on 20 October 2026). | ANSSI (Agence nationale de la sécurité des systèmes d'information) | CERT-FR (ANSSI) | Adopted or in the legislative process |
DEGermany | NIS2UmsuCG / BSIG Germany missed the 17 October 2024 EU deadline. Commission opened infringement proceedings May 2025. | BSI (Bundesamt für Sicherheit in der Informationstechnik) | CERT-Bund (BSI) | In force |
GRGreece | Law No. 5160/2024 | NCSA (National Cyber Security Authority) | GR-CERT (within NCA) | In force |
HUHungary | Act LXIX of 2024 (Hungarian Cybersecurity Act) Hungary transposed early via Act XXIII of 2023. Layered with SZTFH as cybersecurity supervisor. | SZTFH (Szabályozott Tevékenységek Felügyeleti Hatósága) | National Cyber Defence Institute (NBSZ) | In force |
IEIreland | National Cyber Security Bill (draft) Bill in legislative process at the Houses of the Oireachtas; referred to the CJEU on 8 July 2026. | NCSC (National Cyber Security Centre) | NCSC-IE | Drafting |
ITItaly | D.Lgs. 138/2024 Entered into force 16 October 2024. One of the few Member States that met the EU deadline. | ACN (Agenzia per la Cybersicurezza Nazionale) | CSIRT Italia (within ACN) | In force |
LVLatvia | Nacionālās kiberdrošības likums Latvia adopted the National Cyber Security Law in 2024, transposing NIS 2. | NCSC (Nacionālais kiberdrošības centrs, Ministry of Defence) / CERT.LV | CERT.LV | In force |
Kibernetinio saugumo įstatymas Lithuania adopted the transposition act in late 2024. | NKSC (National Cybersecurity Center) | CERT-LT (within NKSC) | In force | |
Loi du 5 mai 2026 relative à des mesures visant à assurer un niveau élevé de cybersécurité | ILR (Institut Luxembourgeois de Régulation) | CIRCL (Computer Incident Response Center Luxembourg) | In force | |
MTMalta | Legal Notice 71/2025, amended by Legal Notice 89/2026 (S.L. 460.41) | CIPD (Critical Infrastructure Protection Department) | CSIRTMalta | In force |
Cyberbeveiligingswet (Cbw), Stb. 2026, 187; Cyberbeveiligingsbesluit, Stb. 2026, 189 Cbw published 10 July 2026 (Stb. 2026, 187), in force 15 August 2026. Replaces the Wbni (NIS 1 transposition). | NCSC-NL (since 1 Jan 2026 merged with DTC and CSIRT-DSP into "versterkt NCSC", SPOC + national CSIRT) + RDI (Rijksinspectie Digitale Infrastructuur, horizontal supervisor) | NCSC-NL | In force | |
PLPoland | Amended KSC Act (ustawa o KSC) Amendment to the Act on the National Cybersecurity System (Ustawa o KSC) in force since 3 April 2026. Self-registration in the register closed on 3 October 2026. | Ministry of Digital Affairs / CSIRTs | CSIRT NASK, CSIRT GOV, CSIRT MON | In force |
PTPortugal | Decreto-Lei n.º 125/2025 | CNCS (Centro Nacional de Cibersegurança) + CERT.PT | CERT.PT (within CNCS) | In force |
RORomania | Emergency Ordinance No. 155/2024; Laws No. 52/2025 & No. 124/2025 Romania transposed via OUG 155/2024 in December 2024. | DNSC (Directoratul Național de Securitate Cibernetică) | DNSC CSIRT | In force |
SKSlovakia | Zákon o kybernetickej bezpečnosti | NBÚ (Národný bezpečnostný úrad) | SK-CERT (within NBÚ) | In force |
SISlovenia | ZInfV-1 (Information Security Act) | URSIV (Information Security Agency) | SI-CERT | In force |
ESSpain | - No transposition law in the BOE as of August 2026; referred to the CJEU on 8 July 2026. Spain operates a two-CSIRT model, with sectoral supervisors under the existing Royal Decree 43/2021 (NIS 1). | CCN-CERT / INCIBE | CCN-CERT (public sector), INCIBE-CERT (private sector) | Drafting |
SESweden | Cybersäkerhetslagen (SFS 2025:1506) | NCSC (Nationellt cybersäkerhetscenter, at the FRA) + CERT-SE | CERT-SE (within the NCSC at the FRA since 1 July 2026) | In force |
Most recently in force
The countries whose law took effect most recently, newest first.
- Austria: in force since 1 October 2026
- Netherlands: in force since 15 August 2026
- Luxembourg: in force since 10 May 2026
- Poland: in force since 3 April 2026
- Portugal: in force since 3 April 2026
Why countries are at different stages
NIS2 is a directive. It is addressed to the member states. Each EU country has to transpose it into its own law.
The deadline for that was 17 October 2024. Many countries were later. The European Commission therefore opened proceedings against several countries and referred some to the Court of Justice of the EU.
Duties for companies only arise with the national law. Until then, older rules from the first NIS directive may still apply in a country.
Art. 41(1) NIS 2
What this means for a company with 50 to 150 employees
What matters most for your company is the country where it is established. If it is established only in Germany, the BSI Act applies to you, since 6 December 2025.
The tracker helps if you have subsidiaries or plants in other EU countries. There, that country's law decides whether and from when duties apply.
A law in force does not mean every deadline has already passed. Each country sets its own registration deadline.
Which country is responsible for your companyAn example
A made-up company: a packaging machinery manufacturer with 110 employees in Germany, its own plant in Poland and a sales subsidiary in Ireland.
The German GmbH: machinery manufacturing is listed in Annex 2 of the BSIG, and with 110 employees it is an important entity. It registers with the BSI.
The plant in Poland is a company of its own. If the tracker shows a law in force for Poland, the company checks whether the plant is in scope under the Polish law and by when it has to register there.
The sales subsidiary in Ireland does not manufacture anything itself. Whether it falls under NIS2 depends on what it does. If the tracker shows no law in force for Ireland yet, no duties arise there from an Irish NIS2 law yet.
The company checks the tracker once a quarter. It chose that interval itself.
How the walkthrough does this
The walkthrough at nisd2.eu uses the same data as this table.
The registration step shows the competent authority for your country and its portal, from the same list as this page.
It explains in which EU country you register, with the exceptions for telecommunications and digital providers.
The security measures follow the directive's minimum list, which applies in every EU country.
The explanations in the walkthrough are available in German and English.
Pages on individual countries
Bundesamt für Cybersicherheit
CCB (Centre for Cybersecurity Belgium)
Ministry of Innovation and Digital Transformation (formerly Ministry of e-Government) / State e-Government Agency
NHCSC-HR (National Cybersecurity Center)
DSA (Digital Security Authority)
NÚKIB (Národní úřad pro kybernetickou a informační bezpečnost)
SAMSIK (Styrelsen for Samfundssikkerhed)
RIA (Riigi Infosüsteemi Amet)
Traficom + sector authorities (NCSC-FI as national CSIRT)
ANSSI (Agence nationale de la sécurité des systèmes d'information)
NCSA (National Cyber Security Authority)
SZTFH (Szabályozott Tevékenységek Felügyeleti Hatósága)
NCSC (National Cyber Security Centre)
ACN (Agenzia per la Cybersicurezza Nazionale)
NCSC (Nacionālais kiberdrošības centrs, Ministry of Defence) / CERT.LV
NKSC (National Cybersecurity Center)
ILR (Institut Luxembourgeois de Régulation)
CIPD (Critical Infrastructure Protection Department)
NCSC-NL (since 1 Jan 2026 merged with DTC and CSIRT-DSP into "versterkt NCSC", SPOC + national CSIRT) + RDI (Rijksinspectie Digitale Infrastructuur, horizontal supervisor)
Ministry of Digital Affairs / CSIRTs
CNCS (Centro Nacional de Cibersegurança) + CERT.PT
DNSC (Directoratul Național de Securitate Cibernetică)
NBÚ (Národný bezpečnostný úrad)
URSIV (Information Security Agency)
CCN-CERT / INCIBE
NCSC (Nationellt cybersäkerhetscenter, at the FRA) + CERT-SE
Common questions
Which countries have transposed NIS2?
As of 16 October 2026, a national NIS2 law is in force in 24 of the 27 EU countries. The table above shows each country's law, authority and status.
Which countries have not transposed NIS2 yet?
As of 16 October 2026, no national law is in force yet in: France, Ireland, and Spain.
What is a CSIRT?
A CSIRT (computer security incident response team) is a team that receives reports of security incidents in a country and helps deal with them. Every EU country designates at least one (Art. 10 NIS 2). In Germany it is CERT-Bund at the BSI.
How up to date is the tracker?
The table is as of 16 October 2026. The authoritative sources are each country's official journal and the European Commission's overview, listed below.
Sources
- Directive (EU) 2022/2555 (NIS 2), Art. 10 and 41, EUR-Lex
- European Commission, NIS 2 transposition status: digital-strategy.ec.europa.eu/en/policies/nis-transposition
- European Commission, infringement procedures for failure to communicate transposition (letters of formal notice 28 November 2024, reasoned opinions 7 May 2025, referrals to the Court of Justice of the EU 8 July 2026, IP/26/1499)
- National official journals, such as BGBl (DE), Moniteur belge / Belgisch Staatsblad (BE), Gazzetta Ufficiale (IT), BOE (ES), JORF (FR), Sbírka zákonů (CZ)
In practice
What the national law changes, and what it doesn't
The national law decides, among other things, where you register and whom you report incidents to. The measures themselves start from the same minimum list in every member state (Art. 21 NIS 2). The walkthrough takes you through them one step at a time:
Risk Management
Write down what your company has
A list of the processes, software and devices you work with.
Incident Handling
Plan what happens in an incident
Who decides, whom you call, how you reach each other.
Effectiveness Assessment
Record the management review
Management checks whether the measures work and approves your documents.
What the walkthrough costs
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days: invoice cancelled or money back.
Guided NIS 2 implementation, step by step
A history of changes and sign-offs to show your regulator
Deadlines and reminders for each requirement
Security questionnaire for your suppliers
Export to PDF or CSV at any time
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
