Missed the NIS2 deadline? What to do now
Register now with your country's authority and start on the measures. Your country's law sets the deadline. The table below shows it for all 27 EU countries, with the authority and the portal.
Programmes and memberships
NIS2 registration deadlines in all 27 EU countries
As of our list of registration bodies: 26 October 2026. The page on your country explains who the deadline applies to.
| Country | Authority and portal |
|---|---|
| AustriaBy 4 January 2027 | Bundesamt für CybersicherheitNIS2 Services (Unternehmensserviceportal) |
| BelgiumPassed on 18 March 2025 | CCB (Centre for Cybersecurity Belgium)Safeonweb@Work |
| BulgariaNone recorded | Ministry of Innovation and Digital Transformation (formerly Ministry of e-Government) / State e-Government AgencyNo portal yet |
| CroatiaNone recorded | NHCSC-HR (National Cybersecurity Center)No portal recorded, the country page explains the way |
| CyprusNone recorded | DSA (Digital Security Authority)No portal yet |
| Czech RepublicPassed on 31 December 2025 | NÚKIB (Národní úřad pro kybernetickou a informační bezpečnost)Portál NÚKIB |
| DenmarkPassed on 1 October 2025 | SAMSIK (Styrelsen for Samfundssikkerhed)Virk |
| EstoniaPassed on 31 March 2026 | RIA (Riigi Infosüsteemi Amet)No portal recorded, the country page explains the way |
| FinlandPassed on 8 May 2025 | Traficom + sector authorities (NCSC-FI as national CSIRT)No portal recorded, the country page explains the way |
| FranceNone recorded | ANSSI (Agence nationale de la sécurité des systèmes d'information)MonEspaceNIS2 |
| GermanyPassed on 6 March 2026 | BSI (Bundesamt für Sicherheit in der Informationstechnik)BSI-Portal |
| GreecePassed on 30 September 2025 | NCSA (National Cyber Security Authority)NIS2 Register (Εγγραφή Οντοτήτων ν. 5160/2024) |
| HungaryNone recorded | SZTFH (Szabályozott Tevékenységek Felügyeleti Hatósága)No portal recorded, the country page explains the way |
| IrelandNone recorded | NCSC (National Cyber Security Centre)No portal yet |
| ItalyBy 28 February 2027 | ACN (Agenzia per la Cybersicurezza Nazionale)ACN NIS Portal |
| LatviaPassed on 1 April 2025 | NCSC (Nacionālais kiberdrošības centrs, Ministry of Defence) / CERT.LVNo portal recorded, the country page explains the way |
| LithuaniaNone recorded | NKSC (National Cybersecurity Center)No portal recorded, the country page explains the way |
| LuxembourgPassed on 10 July 2026 | ILR (Institut Luxembourgeois de Régulation)ILR Guichet (NISS_EE231) |
| MaltaNone recorded | CIPD (Critical Infrastructure Protection Department)No portal recorded, the country page explains the way |
| NetherlandsPassed on 15 August 2026 | NCSC-NL (since 1 Jan 2026 merged with DTC and CSIRT-DSP into "versterkt NCSC", SPOC + national CSIRT) + RDI (Rijksinspectie Digitale Infrastructuur, horizontal supervisor)MijnNCSC / Entiteitenregister |
| PolandPassed on 3 October 2026 | Ministry of Digital Affairs / CSIRTsSystem S46 |
| PortugalPassed on 15 September 2026 | CNCS (Centro Nacional de Cibersegurança) + CERT.PTMyCiber |
| RomaniaPassed on 19 September 2025 | DNSC (Directoratul Național de Securitate Cibernetică)NIS2@RO Platform |
| SlovakiaNone recorded | NBÚ (Národný bezpečnostný úrad)NBÚ NIS2 portal (nis2.nbu.gov.sk) |
| SloveniaPassed on 19 December 2025 | URSIV (Information Security Agency)No portal recorded, the country page explains the way |
| SpainNone recorded | CCN-CERT / INCIBENo portal yet |
| SwedenNone recorded | NCSC (Nationellt cybersäkerhetscenter, at the FRA) + CERT-SENo portal recorded, the country page explains the way |
If your company only comes into scope later, for example because it grows, the period in Germany and Poland starts on that day: three months under § 33(1) BSIG, six months under Art. 7c(1) of the Polish National Cybersecurity System Act (KSC).
Every country with its law and the state of transpositionWhat to do now, in five steps
The steps are the same in every country. Only the authority, the portal and the deadline differ.
Find your authority
The member state where your company is established is in charge (Art. 26(1) NIS 2). Exceptions apply, among others, to providers of public electronic communications networks or services and to certain digital providers, such as cloud computing or data centre services. The table above names the authority and the portal.
Register now
If the deadline has passed, register now through your authority's portal. Under NIS 2 you give at least your name, address and up-to-date contact details including email addresses, IP ranges and phone numbers, your sector and the EU countries where you provide these services (Art. 3(4)).
Write down when you acted
Note when you learned of the duty, when you registered and with which access to the portal. Then you can show later when you acted.
Start on the measures
The measures under Art. 21 NIS 2 apply to your company because it is an essential or important entity (Art. 3), not because it registered. Your country sets by when they must be in place. Poland, for example, gives companies that were in scope when its law took effect twelve months.
Involve management
Your company's management approves the measures, oversees their implementation and takes part in training (Art. 20 NIS 2).
How the walkthrough does it
Registration is the first step of the walkthrough on nisd2.eu. The step knows the authorities of every EU country.
The step explains in plain words what registration is for.
It shows where you register: your country at the top, with its authority and the way to its portal.
You record two details: the ID of your access to the portal and the day you registered.
If it is not possible yet, for example because a letter with your access has not arrived, choose "Not possible yet" and carry on with the next step.
After that the walkthrough takes you through the measures, one item at a time. At the end your management approves them in the app.
Frequently asked questions
When do I have to register for NIS2?
Your country's law sets the deadline. The table above shows it for every EU country. In Germany you register no later than three months after your company first counts as an entity (§ 33(1) BSIG). For companies covered since the BSIG entered into force on 6 December 2025, the deadline was 6 March 2026.
Can I still register after the deadline?
In Germany, yes, through the same BSI portal. Registrations kept coming in there after the deadline: the federal government reported 19,058 by 31 July 2026, and the BSI counted 20,141 by 30 September 2026. For other countries, ask the authority in the table.
Do the other duties only apply after registration?
No. NIS 2 ties the measures (Art. 21) and management's duties (Art. 20) to your company being an essential or important entity (Art. 3), not to registration. Your country sets by when they must be in place.
We provide cloud or data centre services, or manage other companies' IT. Where do we register?
In the member state of your main establishment in the EU (Art. 26(1)(b) NIS 2). For these providers ENISA also keeps a registry, fed by the information the member states pass on (Art. 27(1)). NIS 2 required the member states to ask for this information by 17 January 2025 (Art. 27(2)).
Our country has no deadline in the table. What does that mean?
Our list has no deadline recorded for that country. That can mean its law does not apply yet, that it names no fixed day, or that no portal is ready yet. The page on your country explains where things stand. You can start on the measures either way.
Sources
- Directive (EU) 2022/2555 (NIS 2), Art. 3, 20, 21, 26 and 27 (https://eur-lex.europa.eu/eli/dir/2022/2555/oj)
- German BSI Act (BSIG), § 33, in force since 6 December 2025 (https://www.gesetze-im-internet.de/bsig_2025/__33.html)
- Poland: Act of 23 January 2026 amending the Act on the National Cybersecurity System (KSC), Dz.U. 2026 item 252, Art. 1 with Art. 7c KSC, and Art. 33 (https://api.sejm.gov.pl/eli/acts/DU/2026/252/text.pdf)
- German Bundestag, printed paper 21/7573 of 10 August 2026, the federal government's answer (https://dserver.bundestag.de/btd/21/075/2107573.pdf)
- BSI, NIS-2 in Zahlen, figures as at 30.09.2026 (https://www.bsi.bund.de/DE/Themen/Regulierte-Wirtschaft/NIS-2-regulierte-Unternehmen/NIS-2-in-Zahlen/nis-2-in-zahlen.html)
- Authorities, portals and deadlines by country: our list of registration bodies, which names its sources for each country
In practice
What the national law changes, and what it doesn't
The national law decides, among other things, where you register and whom you report incidents to. The measures themselves start from the same minimum list in every member state (Art. 21 NIS 2). The walkthrough takes you through them one step at a time:
Risk Management
Write down what your company has
A list of the processes, software and devices you work with.
Incident Handling
Plan what happens in an incident
Who decides, whom you call, how you reach each other.
Effectiveness Assessment
Record the management review
Management checks whether the measures work and approves your documents.
What the walkthrough costs
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days, before the first export or sign-off: invoice cancelled or money back.
Guided NIS 2 implementation, step by step
A history of changes and sign-offs to show your regulator
Deadlines and reminders for each requirement
Security questionnaire for your suppliers
Export to PDF or CSV at any time
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.