NIS2 Transposition Tracker: National Laws, Authorities and Status in All 27 Member States

Directive (EU) 2022/2555 required every Member State to adopt and publish its transposing measures by 17 October 2024 and to apply them from 18 October 2024 (Article 41(1)). The Commission opened infringement procedures for late transposition against 23 Member States, and four of them have reached the Court stage. What the law itself requires is set out under NIS2 Directive on the home page.

Each row of the tracker gives the national act with its gazette reference, a status label, the in-force date and the authority the national law names. Every in-force date shown rests on the national gazette or the competent authority. The row points to the country page instead of giving a date where a date could not be confirmed there.

What NIS2 Transposition Means for Entities

NIS2 transposition is the adoption by each Member State of the national laws, regulations and administrative provisions needed to comply with Directive (EU) 2022/2555, which Article 41(1) required by 17 October 2024 with application from 18 October 2024. Transposition turns the Directive's obligations into national duties with a national authority, a national registration channel and national penalties. Entities carry no NIS2 duties under national law until their Member State completes that step.

The Directive entered into force on 16 January 2023 (Article 45), and its predecessor NIS1, Directive (EU) 2016/1148, was repealed with effect from 18 October 2024 (Article 44). National NIS1 laws therefore remain in place only where a Member State has not replaced them, and each EU date is listed in the NIS2 timeline.

National laws may go further than the Directive. Article 5 makes NIS2 a minimum-harmonisation act: Member States may adopt or maintain provisions that ensure a higher level of cybersecurity. The act in Table 1, not the Directive, sets an entity's duties, its deadlines and its fines. National acts take different forms: a new cybersecurity act (Czechia's Zákon č. 264/2025 Sb.), an amendment of an existing act (Estonia, Bulgaria, Slovakia) or an emergency ordinance later approved by parliament (Romania's OUG nr. 155/2024).

Why Entities Follow the National Law, Not the Directive

An entity's duties come from the national act of the Member State with jurisdiction over it, because the Directive is addressed to Member States (Article 46) and has no direct effect on companies. NIS2 is a directive, not a regulation, and is never directly applicable to an organisation. The national act names the competent authority, sets the registration deadline and fixes the penalties.

Jurisdiction follows the Member State of establishment (Article 26(1)). Providers of public electronic communications networks or services fall under every Member State where they provide services (Article 26(1)(a)). The 11 types of Article 26(1)(b), such as DNS service providers, cloud computing service providers and online marketplaces, fall under the Member State of their main establishment in the Union, and the rules for groups active in several countries are under NIS2 jurisdiction.

NIS2 Transposition Status in the 27 Member States on 2026-10-23

Table 1 gives, for each Member State, the national NIS2 act with its gazette reference, its status as of 23 October 2026, the in-force date where it was checked at the gazette or the competent authority, and the authority named in the national law. The four status labels are defined below.

• In force: the national act applies, with its in-force date where confirmed at the primary source.
• Adopted and published: the act is adopted and in the official gazette; its in-force date is given on the country page.
• Bill pending: a government bill is in parliament and no act has been adopted.
• Draft only: the latest official step is a government draft that has not reached adoption.

The four Member States referred to the Court stand at different stages as of 23 October 2026. France's projet de loi Résilience was adopted by the Senate on 12 March 2025 and is at committee stage in the Assemblée nationale, with committee text n° 1779-A0 of 10 September 2025. Spain's Council of Ministers approved the anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad at first round on 14 January 2025. Ireland's General Scheme of the National Cyber Security Bill 2024 was published on 30 August 2024 as a draft, not law. The Netherlands differs: its Cyberbeveiligingswet entered into force on 15 August 2026, after the Commission decided on 8 July 2026 to refer the Netherlands to the Court.

The Commission's own transposition page was last updated on 1 July 2025, and its per-country pages date from 7 to 8 July 2025 in the NIS1 structure. National gazettes and authorities are therefore the source for every row, and what each type of national body does is explained under NIS2 authorities.

Showing 27 of 27

NIS2 and the Non-EU Countries: United Kingdom, Switzerland and Norway

NIS2 has no legal effect in the United Kingdom or Switzerland, which are outside the EU and the EEA, and Norway, an EEA EFTA state, has not incorporated it: the Directive is under scrutiny for the EEA Agreement with no Joint Committee Decision as of 23 October 2026. Each of the three countries runs its own regime, listed in Table 2.

The United Kingdom keeps the Network and Information Systems Regulations 2018, under which operators of essential services notify an incident within 72 hours (regulation 11(3)(b)(i)), and NIS2 does not apply there as UK law. Switzerland's Information Security Act (ISG) sets its own reporting duty: cyberattacks are reported to the BACS within 24 hours of discovery (Article 74e(1) ISG), the same 24-hour span as the NIS2 early warning but under Swiss law.

Norway applies its Digital Security Act, which implements NIS1, so Norwegian operators follow NIS1-based duties until NIS2 is incorporated into the EEA Agreement. When the Directive reaches companies outside the EU is covered under NIS2 for non-EU companies.

Commission Infringement Procedures for Late Transposition

The Commission enforces Article 41(1) through infringement procedures under Article 258 TFEU: letters of formal notice on 28 November 2024, reasoned opinions on 7 May 2025 and a referral of four Member States to the Court of Justice on 8 July 2026. Each step went to the Member States that had not notified full transposition at that date, so the group narrowed from step to step. Table 3 sets out the three steps with their legal basis.

Letters of Formal Notice and Reasoned Opinions

On 28 November 2024 the Commission sent letters of formal notice to 23 Member States that had not notified full transposition, with two months to reply. The infringement package INF/24/5988 names them in protocol order: Bulgaria, Czechia, Denmark, Germany, Estonia, Ireland, Greece, Spain, France, Cyprus, Latvia, Luxembourg, Hungary, Malta, the Netherlands, Austria, Poland, Portugal, Romania, Slovenia, Slovakia, Finland and Sweden.

On 7 May 2025 the Commission sent reasoned opinions to 19 of the 23, again with two months to respond: Bulgaria, Czechia, Denmark, Germany, Estonia, Ireland, Spain, France, Cyprus, Latvia, Luxembourg, Hungary, the Netherlands, Austria, Poland, Portugal, Slovenia, Finland and Sweden. Both steps also reached Member States whose acts entered into force later, among them Germany, Poland, Estonia and Sweden (Table 1).

The Court Referrals of Ireland, Spain, France and the Netherlands

On 8 July 2026 the Commission decided to refer Ireland, Spain, France and the Netherlands to the Court of Justice for failing to notify full transposition of NIS2 (Commission press release IP/26/1499). Each referral carries the number of its infringement file, listed below.

• Ireland: INFR(2024)0279
• Spain: INFR(2024)0270
• France: INFR(2024)0274
• The Netherlands: INFR(2024)0288

The Commission asks the Court to impose a lump sum and daily penalties until complete transposition is notified (Article 260(3) TFEU). No Court has imposed any sanction on these four Member States as of 23 October 2026. This procedure runs between the Commission and a Member State and differs from the supervision of entities, which national authorities carry out under Articles 32 and 33 of the Directive, as set out under NIS2 supervision and enforcement. For an entity, the referral changes no duty directly: its duties arise only once the national act applies, and the penalties requested under Article 260(3) TFEU fall on the Member State, not on companies.

Member States That Received No Letter of Formal Notice

Belgium, Croatia, Italy and Lithuania received no letter of formal notice on 28 November 2024, and Greece, Malta, Romania and Slovakia received a letter but no reasoned opinion on 7 May 2025. Both groups follow from comparing the list of 23 letters with all 27 Member States and with the list of 19 reasoned opinions. For Belgium, Croatia and Italy, the in-force dates in Table 1 precede the letters of 28 November 2024. That a Member State received no further step does not show that a case was closed, and no closure is recorded here for any Member State. Of the four Member States that received a letter but no reasoned opinion, Greece's Ν. 5160/2024 appeared in the gazette of 27 November 2024, Slovakia's Act 366/2024 is dated 28 November 2024 and Romania's ordinance was published on 31 December 2024.

What Applies in a Member State Without a National Law

Where a Member State has not adopted its NIS2 law, entities there have no NIS2 duties under national law yet, and the earlier national rules based on NIS1 continue to apply to the operators they designated. The Directive cannot fill the gap, because it binds the Member State and not the entity (Article 46).

Ireland shows the interim regime most clearly. The NIS1 regulations, S.I. No. 360 of 2018, still apply, and the National Cyber Security Centre states that no NIS2 registration is required until the new law is enacted. In France, the NIS2 duties for entities await the adoption of the loi Résilience, so NIS2 incident reporting does not yet legally apply there.

An entity active in several Member States follows each national law that applies to it, including those already in force elsewhere. Preparing against the Directive's minimum keeps the work usable once the missing law arrives: management body approval and training (Article 20), the 10 measures (a) to (j) (Article 21(2)) and the 24-hour, 72-hour and one-month reporting stages (Article 23). The steps to prepare are set out under NIS2 compliance requirements.

What the Tracker Does Not Cover

The tracker records which law applies and its status; the national details on reporting, registration and later changes sit on each country page and on the topic pages below. National fine amounts, sector lists and supervision practice also differ by Member State, and each country page states them with the section of its national act.

Do National Laws Change the Reporting Clock?

Yes, some do: Cyprus requires an early warning within 6 hours (section 35B(4)(a) of Law 89(I)/2020 as amended) and Portugal a final report within 30 working days (RJC Articles 41(2) and 42 to 44), while the Directive sets 24 hours, 72 hours and a final report one month after the incident notification (Article 23(4)). Portugal also requires a notification 24 hours after the significant impact ends, and an incident resolved within 2 hours needs only that end-of-impact notification.

Germany keeps the Directive's clock in § 32 BSIG: an early report within 24 hours, a notification within 72 hours and a final report one month after the notification. Each national clock runs from the national act, and the Directive's clock is explained under NIS2 incident reporting.

Where Do Entities Register in Each Member State?

Entities register with the authority or channel their national law names, not with ENISA. The Directive sets the registration data under Article 3(4) and, for the 11 types of Article 26(1)(b), the Article 27 registry data due by 17 January 2025. Changes to the Article 3(4) data reach the authority within two weeks, and changes to the Article 27 data within three months (Article 27(3)).

Deadlines are national. Hungary requires registration with the SZTFH within 30 days (Section 8(5) Act LXIX of 2024), Czechia requires regulated services to be notified to NÚKIB within 60 days (§ 6(1) Act 264/2025) and Germany requires registration within three months of first qualifying (§ 33(1) BSIG).

The single point of contact forwards the Article 27 data to ENISA, so no entity files with ENISA directly. The data and national deadlines are compared under NIS2 registration.

Will the National Laws Change Again?

Yes: the Commission's proposal for targeted NIS2 amendments, COM(2026) 13 of 20 January 2026 (procedure 2026/0012(COD)), is pending in the European Parliament, stage "Awaiting committee decision" as of 23 October 2026, and any adopted change would need new national measures. The committee referral was announced on 25 March 2026, the ITRE draft report PE792.221 is dated 24 September 2026 and the amendments PE796.471 are dated 13 October 2026.

The Digital Omnibus, COM(2025) 837 of 19 November 2025 (procedure 2025/0360(COD)), is also pending; the Council's negotiating mandate was agreed by Coreper on 21 October 2026. Neither proposal is law, and no amending act to NIS2 has been adopted as of 23 October 2026.

Article 40 adds a fixed review: the Commission reports on the functioning of the Directive by 17 October 2027 and every 36 months after that. What the proposals would change is tracked under NIS2 amendments and review.