NIS2 · National implementations
NIS2 by country
NIS2 is a directive, which means it does not apply to your organisation directly. Each EU member state passes its own national law implementing the directive, and it is that law — with its own registration deadlines, supervisory authorities, penalty scales and national additions — that binds you.
This page tracks all 27 national implementations. Each country links to a dedicated page with the national law, the authority you answer to, how registration works, and where the national rules go beyond the directive. Every entry links to the country's statute book and national cybersecurity authority, and the EU's own record of notified transposition measures is on EUR-Lex.
| Country | National law | Status | In force | Authority |
|---|---|---|---|---|
| Austria | Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026) | Adopted, not yet in force | 1 October 2026 | Bundesministerium für Inneres (BMI) |
| Belgium | Loi du 26 avril 2024 / Wet van 26 april 2024 | In force | 18 October 2024 | Centre for Cybersecurity Belgium (CCB) |
| Bulgaria | Закон за киберсигурност (amended) | In force | 13 February 2026 | Ministry of e-Government and sector bodies |
| Croatia | Zakon o kibernetičkoj sigurnosti (NN 14/2024) | In force | 15 February 2024 | SOA / NCSC-HR |
| Cyprus | Law 60(I)/2025 | In force | 25 April 2025 | Digital Security Authority (DSA) |
| Czechia | Zákon č. 264/2025 Sb. o kybernetické bezpečnosti | In force | 1 November 2025 | NÚKIB |
| Denmark | Lov nr. 434 af 6. maj 2025 | In force | 1 July 2025 | Center for Cybersikkerhed (CFCS) |
| Estonia | Küberturvalisuse seadus (KüTS, amended) | In force | 1 January 2026 | RIA |
| Finland | Kyberturvallisuuslaki (124/2025) | In force | 8 April 2025 | Traficom / NCSC-FI and sector regulators |
| France | Projet de loi résilience (pending) | Not transposed | Not in force | ANSSI (designated) |
| Germany | NIS2-Umsetzungs- und Cybersicherheitsstärkungsgesetz (NIS2UmsuCG) | In force | 6 December 2025 | BSI |
| Greece | Νόμος 5160/2024 | In force | 27 November 2024 | National Cybersecurity Authority |
| Hungary | 2024. évi LXIX. törvény | In force | 1 January 2025 | SZTFH |
| Ireland | National Cyber Security Bill 2024 (pending) | Not transposed | Not in force | NCSC Ireland (designated) |
| Italy | Decreto Legislativo 4 settembre 2024, n. 138 | In force | 16 October 2024 | ACN |
| Latvia | Nacionālās kiberdrošības likums (NKDL) | In force | 1 September 2024 | National Cybersecurity Centre |
| Lithuania | Kibernetinio saugumo įstatymas (No XIV-2902) | In force | 18 October 2024 | NKSC |
| Luxembourg | Loi du 5 mai 2026 relative à la cybersécurité | In force | 2026 | ILR (CSSF for financial entities) |
| Malta | Subsidiary Legislation 460.41 (Legal Notice 71 of 2025) | In force | 2026 | Critical Infrastructure Protection (CIP) Department |
| Netherlands | Cyberbeveiligingswet (Cbw) | Adopted, not yet in force | Adopted, expected in force during 2026 | RDI and sector regulators; NCSC-NL as CSIRT |
| Poland | Ustawa o krajowym systemie cyberbezpieczeństwa (amended) | In force | 2026 | Minister of Digital Affairs and sector authorities |
| Portugal | Decreto-Lei n.º 125/2025 (Regime Jurídico da Cibersegurança) | In force | 2026 | CNCS |
| Romania | OUG 155/2024, as amended by Legea 124/2025 | In force | 31 December 2024 | DNSC |
| Slovakia | Zákon č. 366/2024 Z. z. | In force | 1 January 2025 | NBÚ |
| Slovenia | Zakon o informacijski varnosti (ZInfV-1) | In force | 19 June 2025 | URSIV |
| Spain | Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad | Not transposed | Not in force | Centro Nacional de Ciberseguridad (proposed) |
| Sweden | Cybersäkerhetslagen (SFS 2025:1506) | In force | 15 January 2026 | MSB (coordinating) and sector authorities |
Operating in several member states?
Under NIS2's jurisdiction rules you generally answer to the authority in each member state where you provide in-scope services, with special main-establishment rules for digital infrastructure and digital providers. See our glossary entries on national transposition and lex specialis, or start from the NIS2 overview.