Last updated: 5 November 2026. Status reflects national laws in force, checked against public trackers and official journals. Always confirm with the official journal of your country before relying on it.
NIS2 at a glance: 24 countries in, 3 still pending
The NIS2 Directive (EU) 2022/2555 had to be transposed into national law by 17 October 2024. Two years later, 24 of the 27 EU Member States have a national NIS2 law in force. Spain, France and Ireland are still pending, and the European Commission has escalated infringement proceedings against late countries — in July 2026 it referred Spain to the Court of Justice of the EU.
Key takeaway: if your company operates in several EU countries, you are very likely subject to more than one national NIS2 law — each with its own registration duty, competent authority and supervisory practice. The core obligations (Article 21 risk-management measures and Article 23 incident reporting) are the same everywhere.
NIS2 transposition status by country
| Member State | Status | National law | In force |
|---|---|---|---|
| Austria | ✅ Transposed | NISG 2026 (BGBl. I No 94/2025) | 1 Oct 2026 |
| Belgium | ✅ Transposed | Law of 26 April 2024 (NIS2 Law) | 18 Oct 2024 |
| Bulgaria | ✅ Transposed | Amendment to the Cybersecurity Act (State Gazette No 17/2026) | Feb 2026 |
| Croatia | ✅ Transposed | Cybersecurity Act (OG 14/2024) | 15 Feb 2024 |
| Cyprus | ✅ Transposed | Law 60(I)/2025 amending the NIS Law | 25 Apr 2025 |
| Czechia | ✅ Transposed | Act No 264/2025 Coll. on Cybersecurity | 1 Nov 2025 |
| Denmark | ✅ Transposed | NIS 2 Act (Act No 434 of 6 May 2025) | 1 Jul 2025 |
| Estonia | ✅ Transposed | Cybersecurity Act amendment (adopted 10 Dec 2025) | 1 Jan 2026 |
| Finland | ✅ Transposed | Cybersecurity Act (124/2025) | 8 Apr 2025 |
| France | ⏳ Pending | Resilience bill (not yet adopted) | — |
| Germany | ✅ Transposed | NIS2UmsuCG (BGBl. 2025 I No 301) | 6 Dec 2025 |
| Greece | ✅ Transposed | Law 5160/2024 | 27 Nov 2024 |
| Hungary | ✅ Transposed | Act LXIX of 2024 | 1 Jan 2025 |
| Ireland | ⏳ Pending | National Cyber Security Bill (in preparation) | — |
| Italy | ✅ Transposed | Legislative Decree 138/2024 | 16 Oct 2024 |
| Latvia | ✅ Transposed | National Cybersecurity Law | 1 Sep 2024 |
| Lithuania | ✅ Transposed | Law No XIV-2902 on Cybersecurity | 18 Oct 2024 |
| Luxembourg | ✅ Transposed | Law of 5 May 2026 on a high level of cybersecurity | 10 May 2026 |
| Malta | ✅ Transposed | Subsidiary Legislation 460.41 | 23 Jan 2026 |
| Netherlands | ✅ Transposed | Cyberbeveiligingswet (Cbw), Stb. 2026, 187 | 15 Aug 2026 |
| Poland | ✅ Transposed | Amendment to the National Cybersecurity System Act | 3 Apr 2026 |
| Portugal | ✅ Transposed | Decree-Law 125/2025 | 3 Apr 2026 |
| Romania | ✅ Transposed | Emergency Ordinance 155/2024 (approved by Law 124/2025) | 31 Dec 2024 |
| Slovakia | ✅ Transposed | Act No 366/2024 Coll. | 1 Jan 2025 |
| Slovenia | ✅ Transposed | Information Security Act (ZInfV-1) | 19 Jun 2025 |
| Spain | ⏳ Pending | Draft Law on Cybersecurity Coordination and Governance | — |
| Sweden | ✅ Transposed | Cybersecurity Act (SFS 2025:1506) | 15 Jan 2026 |
What this means for your company
- In a country that has transposed: check whether you must register with the competent authority, and by when. Most national laws set a registration window of a few months after entry into force.
- In a country still pending (Spain, France, Ireland): the obligations are coming and will not be lighter. Use the time to implement Article 21 measures — waiting usually means a rushed, more expensive project later.
- Operating in several countries: NIS2 generally assigns jurisdiction by establishment (and, for some digital providers, by main establishment). Map where you are established and which authority supervises each entity of your group.
- Supplier to NIS2 entities: regardless of your own status, your clients will push security requirements down the supply chain. Being able to demonstrate controls — for example with ISO 27001 — is a commercial advantage.
Spain: still waiting for its NIS2 law
Spain approved its draft Ley de Coordinación y Gobernanza de la Ciberseguridad (Law on Cybersecurity Coordination and Governance) in January 2025, but the law has not yet been published in the Official State Gazette (BOE). After a reasoned opinion in May 2025, the Commission referred Spain to the Court of Justice of the EU on 8 July 2026.
The draft creates a National Cybersecurity Centre as single point of contact and distributes supervision among several authorities. Until the law is enacted, the previous NIS1 regime (Royal Decree-law 12/2018) still applies to entities designated under it. Spanish companies in NIS2 sectors should not wait: the measures required by Article 21 take months to implement.
The Digital Omnibus: what changes for NIS2 — and what doesn’t
In November 2025 the European Commission presented the Digital Omnibus, a package to simplify EU digital rules. For cybersecurity, its main proposal is a single entry point for incident reporting, so that one incident falling under several laws (NIS2, GDPR, DORA and others) does not have to be reported several times through different channels.
- Commission proposal (Nov 2025): one EU-level reporting portal operated by ENISA, which forwards notifications to the competent national CSIRTs and authorities.
- Council position (21 October 2026): Member States prefer a national single entry point in each country, plus an EU information point run by ENISA. The Council also proposes extending the GDPR breach notification deadline from 72 to 96 hours and limiting it to high-risk breaches.
- Targeted NIS2 amendments (January 2026): a separate proposal adds a ‘small mid-cap’ category (fewer than 750 employees and under €150 million turnover) generally treated as important entities, harmonises technical requirements, adds ransomware-specific reporting details and links NIS2 to a future EU cybersecurity certification under the Cybersecurity Act 2.
- What does not change: the NIS2 incident reporting deadlines (24 hours / 72 hours / one month), the Article 21 measures and the management accountability rules.
NIS2 Article 23 · reporting deadlines (unchanged by the Omnibus)
24 HOURS
Early warning
Suspected malicious act or cross-border impact.
72 HOURS
Incident notification
Initial assessment, severity, impact and indicators of compromise.
ON REQUEST
Intermediate report
Status updates requested by the CSIRT or authority.
1 MONTH
Final report
Root cause, mitigation measures and cross-border impact.
Status: these are still proposals. The European Parliament has to adopt its position and agree a final text with the Council. Until then, the current NIS2, GDPR and DORA rules apply in full — plan your compliance on today’s obligations.
How to prepare, wherever you operate
1. Confirm your scope
Sector, size and establishment in each country. Essential or important entity — or supplier to one.
2. Close the Article 21 gaps
Risk analysis, incident handling, business continuity, supply chain, access control, MFA and encryption.
3. Get reporting ready
Incident classification, 24h/72h procedures and contacts for each national CSIRT.
4. Prove it
Management training, documented controls, penetration testing and, ideally, ISO 27001.
Frequently asked questions
Which EU countries have not transposed NIS2?
As of November 2026, Spain, France and Ireland do not yet have a national NIS2 law in force. The other 24 Member States have transposed the directive.
Does NIS2 apply if my country has not transposed it?
Not directly to companies: directives must be transposed into national law to create obligations for businesses. However, the obligations are imminent, clients already demand compliance and, in Spain, the previous NIS1 regime still applies to designated operators.
Does the Digital Omnibus change NIS2 deadlines?
No. The proposals would change where incidents are reported (a single entry point), not the 24-hour, 72-hour and one-month deadlines. They are still under negotiation.
If we operate in several EU countries, which NIS2 law applies?
As a general rule, the law of each Member State where your entities are established. Certain digital providers fall under the jurisdiction of their main establishment in the EU. A scope assessment per entity is the safest approach.
Need a NIS2 scope assessment across several EU countries? See our NIS2 compliance service or talk to a specialist.
Sources: European Commission infringement decisions; national official journals; public NIS2 transposition trackers (ISMS Copilot, directive-nis2.eu, nisd2.eu); Council of the EU press release of 21 October 2026; European Commission proposals of 19 November 2025 and 20 January 2026.