NIS2 transposition by country: laws, dates and authorities

NIS2 transposition by country is uneven. On 4 November 2026, national laws transposing NIS2 are in force in 24 of the 27 EU Member States; France, Ireland and Spain have not yet adopted theirs. The national law that applies depends mainly on where each entity is established, and it applies from its own entry into force, not from the EU date of 18 October 2024.

NIS2 transposition refers to the national acts by which each Member State turns Directive (EU) 2022/2555 into binding law: scope, essential and important entities, registration, risk-management measures, incident reporting, supervision and fines. Because NIS2 is a directive, organisations are bound by their national law, not by the directive text itself.

This tracker lists, for each Member State, the national law, its status, its entry into force, the registration step for entities and the competent authority. It changes often: each row was checked on official sources (official journals, national cybersecurity agencies, the European Commission). Where a point could not be confirmed, the table says "to be confirmed".

What did the EU require, and when?

• 27 December 2022: NIS2 published in the Official Journal (L 333); it entered into force on 16 January 2023.
• 17 October 2024: deadline for Member States to adopt and publish their national measures (Article 41). The same day, the Commission adopted Implementing Regulation (EU) 2024/2690, which details the technical measures and "significant incident" thresholds for certain digital providers.
• 18 October 2024: national measures to apply; the first NIS Directive (EU) 2016/1148 is repealed (Article 44).
• 17 January 2025: those digital providers (DNS, cloud, data centres, managed services, online platforms…) submit their details to their authority for the ENISA registry (Article 27).
• 17 April 2025: Member States draw up their list of essential and important entities (Article 3(3)), to be reviewed at least every two years.

Which Member States did the Commission pursue for late transposition?

Most Member States missed the deadline. The Commission opened infringement procedures in three steps:

Belgium, Croatia, Italy and Lithuania received no letter: they had notified their transposition measures by then. The Netherlands brought its law into force on 15 August 2026, about five weeks after the referral.

Where does each Member State stand on 4 November 2026?

Deadlines already past still apply to entities that come into scope later: they register within the national time limit (for instance three months in Germany, 60 days in Czechia, 30 days in Hungary, Romania and Slovenia).

Next dates to watch

• 29 November 2026: general election in Spain; the new Cortes meet on 23 December 2026 (Royal Decree 806/2026).
• 1 January 2027: initial registration deadline in Austria.
• 1 January to 28 February 2027: annual registration window in Italy.
• 8 March 2027 (indicative): European Parliament plenary vote on the proposed NIS2 amendment.
• 3 April 2027: in Poland, essential and important entities must meet the new obligations.

Belgium, France, the Netherlands, Germany and Luxembourg: what to know

• Belgium: the law of 26 April 2024 (published in the Moniteur belge on 17 May 2024) and its royal decree of 9 June 2024 apply since 18 October 2024. Entities had to register on Safeonweb@work by 18 March 2025. Essential entities must undergo a periodic conformity assessment against CyberFundamentals (CyFun) or ISO/IEC 27001; the CCB set 18 April 2026 as their first milestone. Authority: Centre for Cybersecurity Belgium (CCB), CSIRT CERT.be.
• France: no NIS2 law yet. The bill on the resilience of critical infrastructure and the strengthening of cybersecurity (which also transposes CER and part of DORA) was adopted by the Senate on 12 March 2025 and by a special committee of the Assemblée nationale on 10 September 2025, then withdrawn from the agenda of the 7 and 9 October 2026 sittings; no new date was confirmed on 4 November 2026. ANSSI already offers voluntary pre-registration on MonEspaceNIS2.
• Netherlands: the Cyberbeveiligingswet (law of 8 July 2026, Stb. 2026, 187) entered into force on 15 August 2026 and replaced the Wbni; its obligations apply from that date. Registration in the NCSC entity register (mijn.ncsc.nl) is mandatory from that date (Rijksoverheid). Directors' training has a two-year deadline. Supervision is sector by sector (RDI, ILT, IGJ, DNB…).
• Germany: the Act implementing the NIS2 Directive (known as NIS2UmsuCG, law of 2 December 2025, BGBl. 2025 I No. 301) was published on 5 December 2025 and entered into force on 6 December 2025. It amends the BSI Act (BSIG). Registration with the BSI (BSI portal, access via "Mein Unternehmenskonto" with an ELSTER certificate) was due within three months, by 6 March 2026.
• Luxembourg: the law of 5 May 2026 on measures for a high level of cybersecurity applies since 10 May 2026. Entities had to self-register with the Institut luxembourgeois de régulation (ILR) by 10 July 2026 (government press release). The CSSF is the authority for banking and financial market infrastructures. CSIRTs: GOVCERT.LU (State, critical entities) and CIRCL (all others).

Is my small business affected by NIS2?

Usually not directly, unless it is medium-sized or works in a sector covered regardless of size. The size-cap rule of Article 2(1) brings into scope entities of a type listed in Annex I or II that are at least medium-sized under Recommendation 2003/361/EC:

Exceptions apply regardless of size (Article 2(2) to (4)): providers of public electronic communications networks or services, trust service providers, top-level domain registries, DNS service providers and domain name registration services; entities that a Member State identifies, for instance because they are the sole national provider of an essential service or because a disruption would significantly affect public safety, security or health; critical entities under the CER Directive (EU) 2022/2557; and central government bodies. Member States may also cover local authorities and education institutions (Article 2(5)): see our observatory of NIS2 and local authorities.

Essential or important? Article 3 sets the category. Both have the same duties (risk-management measures under Article 21, incident reporting under Article 23, management-body accountability under Article 20). The difference lies in supervision (proactive for essential entities, after the fact for important ones) and in maximum fines, which national law must set at no less than €10 million or 2% of worldwide annual turnover (whichever is higher) for essential entities, and €7 million or 1.4% for important ones (Article 34). Our guide on essential and important entities covers the details.

Two points often missed by small firms:

• Group data count. Under the Recommendation, headcount and financial figures of linked and partner enterprises are added, so a 30-person subsidiary of a large group may be "large". Recital 16 lets Member States take into account the entity's independence (its own information systems and services) to avoid disproportionate results; national laws use this option differently.
• Out of scope does not mean unaffected. In-scope customers must manage supply-chain security (Article 21(2)(d)) and pass requirements down to their suppliers through contracts and questionnaires.

Which law applies to a group with entities in several countries?

As a rule, each entity follows the law of the Member State where it is established (Article 26(1)). A group with subsidiaries in Belgium, the Netherlands and Germany therefore applies three national laws, registers each subsidiary on three different portals and reports incidents to three sets of authorities.

The main establishment rule (Article 26(1)(b) and (2)) is the exception. It covers DNS service providers, top-level domain registries, domain name registration services, cloud computing, data centre and content delivery network providers, managed service providers, managed security service providers, and online marketplaces, search engines and social networking platforms. These fall only under the Member State of their main establishment in the EU: where decisions on cybersecurity risk-management measures are predominantly taken; failing that, where cybersecurity operations are carried out; failing that, the establishment with the most employees in the EU. Providers of public electronic communications follow each Member State where they provide services, and public administration entities follow the State that set them up.

In practice, for a group:

1. List every legal entity, its country, its NIS2 sector and its size calculated with group data.
2. Check whether one of them provides a service covered by the main establishment rule, and document where cybersecurity decisions are taken.
3. Register each entity in each country concerned, by that country's deadline (see table).
4. Build one group baseline (for instance ISO/IEC 27001, CyberFundamentals or, for digital providers, Implementing Regulation (EU) 2024/2690), then add national specifics: reporting portals, conformity assessment, local deadlines.
5. Remember that fines are calculated on the worldwide turnover of the undertaking to which the entity belongs, which in a group can mean group turnover.

Financial entities covered by DORA follow DORA for ICT risk management and incident reporting (Article 4 of NIS2, lex specialis): see DORA vs NIS2.

What should you do now?

1. Find the country (or countries) whose law applies to each of your entities, using the table above.
2. Check scope and category with that country's tool or guidance, then register if you have not done so.
3. Note the national deadlines that follow registration (conformity assessment, directors' training, first reports).
4. Prepare incident reporting to the right CSIRT within 24 hours, 72 hours and one month (Article 23): see our NIS2 incident notification guide.
5. Assess your Article 21 measures. ResiPlan's free NIS2 self-assessment (7 questions) gives a first score; the NIS2 framework page summarises the directive.

FAQ

Does NIS2 apply in a country that has not transposed it yet?

Not directly to companies: a directive binds Member States. Until the national law is in force, organisations stay under the national rules that transposed the first NIS Directive, for the operators designated under them. Obligations under NIS2 start with the national law's entry into force.

Does the Court referral change anything for companies in France, Ireland or Spain?

No. A referral to the Court of Justice can lead to financial penalties for the State, not for companies. It increases pressure to adopt the national law, which then sets the obligations and deadlines.

My registration deadline has passed. What now?

Register now and keep a record of your scoping analysis. Several authorities, such as the CCB in Belgium, have said they look for entities that have not registered and may take enforcement measures.

Will the NIS2 rules change again?

Possibly. In January 2026 the Commission proposed a targeted amendment of NIS2 (COM(2026) 13, procedure 2026/0012(COD)) to simplify it and align it with the revised Cybersecurity Act. On 4 November 2026 it is still at committee stage in the European Parliament; current national laws apply until it is adopted and transposed.

Sources

• Directive (EU) 2022/2555 (NIS2), EUR-Lex: Articles 2, 3, 20, 21, 23, 26, 27, 34, 41 and 44, recital 16
• Commission Implementing Regulation (EU) 2024/2690, EUR-Lex
• Commission Recommendation 2003/361/EC (SME definition), EUR-Lex
• Directive (EU) 2022/2557 (CER), EUR-Lex
• European Commission, NIS2 transposition by Member State
• European Commission: letters of formal notice, 28 November 2024; reasoned opinions, 7 May 2025; referral to the Court of Justice, 8 July 2026
• ENISA, NIS2 technical implementation guidance (June 2025)
• European Parliament, Legislative Observatory, 2026/0012(COD)
• National sources, besides the official journals linked in the table: Commission page on NIS2 in Belgium; Sénat, legislative file of the French bill; Rijksoverheid, 7 July 2026; Government of Luxembourg, 6 July 2026; Austrian business service portal; Polish Ministry of Digital Affairs; Swedish NCSC