NIS2 Transposition Status by Country: All 27 EU Member States

Updated monthly. Last full check of all 27 countries: 4 November 2026. We check national gazettes, authorities and the European Commission every month and list each change at the end of this page.

The short answer

• 24 Member States have a NIS2 law in force. The most recent to start applying were Austria (1 October 2026), the Netherlands (15 August 2026) and Luxembourg (law of 5 May 2026).
• France, Ireland and Spain have not adopted one. Their NIS1 laws still apply in the meantime.
• The deadline was 17 October 2024. Most countries missed it: the Commission sent letters of formal notice to 23 Member States on 28 November 2024 and reasoned opinions to 19 on 7 May 2025.
• On 8 July 2026 the Commission referred Ireland, Spain, France and the Netherlands to the EU Court of Justice and asked for financial penalties. The Dutch law has applied since 15 August 2026, but the referral was about notifying the Commission of complete transposition, so the case may continue until the Commission withdraws it.

Status in all 27 Member States

"Applies from" is the date the national NIS2 rules started to apply. Where only a month is given, the exact date differs between official sources or depends on publication. The authority is the main competent authority or the body that keeps the list of entities; many countries add sector authorities, for example for finance or energy.

What this means for your company

If your country's law is in force

Your obligations come from that national law, not from the directive directly. Check four things in it: whether your sector and size are covered (some countries add sectors, such as Italy, Czechia and Poland), how you register, what the incident reporting channel is, and whether there is a transition period before supervision and fines start. Poland, for example, gives entities until 3 April 2027 to meet most obligations.

Registration is usually the first legal deadline. Many have already passed. See NIS2 registration by country for where and when to register in each country.

If your country has no law yet

In France, Ireland and Spain the NIS1 rules still apply to operators of essential services and digital service providers. Companies cannot be fined under NIS2 rules that do not exist in national law yet. Waiting is still a poor plan: the bills are published, their content follows the directive closely, and the measures in Article 21 take months to put in place. Customers in other Member States may also ask for NIS2-level security in contracts already.

If you operate in several countries

As a rule, an entity falls under the law of each Member State where it is established (Article 26). Some digital providers fall only under the country of their main EU establishment: DNS service providers, TLD name registries, domain name registration services, cloud computing, data centre, content delivery network, managed service and managed security service providers, online marketplaces, online search engines and social networking platforms. Public electronic communications providers fall under each country where they provide services.

Not sure whether NIS2 applies to you at all? Start with Does NIS2 apply to my company? and the free NIS2 Readiness Check.

Ready to close the gaps? The NIS2 Compliance Starter Kit includes a gap-assessment workbook against Article 21, an incident response plan template, a supply chain security policy template and a board briefing deck. It follows the directive, so it works whichever national law applies to you.

How we check this page

Each month we check the national gazette or the authority's own pages for every country, the Commission's infringement decisions and its NIS2 country pages. A press or law firm source is used only where no official page states the fact, and it is named in the table. The Commission's own country pages were last updated in July 2025 and no longer show the current status, so we do not rely on them for dates.

Change log

• 2026-11-04: First published. All 27 Member States checked.

Sources

• Directive (EU) 2022/2555 (NIS2), Articles 3, 26, 41, EUR-Lex
• European Commission: referral of Ireland, Spain, France and the Netherlands to the Court of Justice (8 July 2026)
• European Commission: NIS2 transposition in EU countries
• ACN: NIS
• Agency for Digital Government: registration obligation
• BDO Malta: what Legal Notice 89 of 2026 changes
• BSI: NIS-2 Implementation Act in force
• BSI: registration guide
• BTA: Parliament adopts amendments to the Cybersecurity Act
• CCB
• CNCS
• Cybersecurity Act NN 14/2024 (English, Ministry of Foreign and European Affairs)
• DNSC
• Government of Luxembourg: NIS 2 (6 July 2026)
• Government of the Netherlands: Cbw in force 15 August 2026
• Grant Thornton Estonia: the Cybersecurity Act is in force
• Harneys: Cyprus adopts NIS2
• Ministry of Digital Affairs: amended KSC Act
• NBÚ
• NKI: guidance on the scope of the Cybersecurity Act
• NKSC
• NÚKIB Portal
• RIS: NISG 2026, s. 29
• Riksdagen: Cybersecurity Act (2025:1506)
• SOA: national cybersecurity authority
• Saeima: new law strengthens cybersecurity
• Traficom: register for the list of NIS 2 entities
• URSIV: obligations under ZInfV-1
• gov.gr: NIS2 self-declaration of entities

Related tools