NIS2 transposition status, country by country
NIS2's transposition deadline was 17 October 2024. As of this page's last verification date below, the picture across the EU is still genuinely mixed: some member states transposed on time, several transposed more than a year late, and a handful had not transposed at all - referred to the Court of Justice of the European Union on 8 July 2026.
The 12-state table
This table covers 12 member states, not all 27, cross-checked against 2-3 independent sources per country. It is not primary gazette text for most rows - see the caveat below before relying on any single date.
| Member state | National law | Status | Registration deadline |
|---|---|---|---|
| Germany | NIS2UmsuCG | Transposed, in force 6 December 2025 | Portal live 6 January 2026; in-scope entities had 3 months from 6 December 2025 |
| Netherlands | Cyberbeveiligingswet | Transposed, enters into force 15 August 2026 | Mandatory from 15 August 2026 (voluntary before) |
| France | Resilience and cybersecurity bill (bundles NIS2, CER, and some DORA provisions) | Not transposed as of August 2026; referred to the CJEU 8 July 2026 | Not yet open |
| Poland | KSC amendment ("KSC 2.0") | Transposed, in force 3 April 2026 | Not confirmed in this research pass |
| Italy | Decreto Legislativo n. 138 of 4 September 2024 | Transposed, in force 16 October 2024 | Registration window closed 1 December 2024 - 28 February 2025 |
| Spain | Cybersecurity coordination and governance bill | Not transposed as of August 2026; referred to the CJEU 8 July 2026 | Not yet open |
| Belgium | Law of 26 April 2024 | Transposed, in force 18 October 2024 | CyberFundamentals compliance-pathway deadline for essential entities: 18 April 2026 (passed) |
| Austria | NISG 2026 | Enters into force 1 October 2026 (the older NISG 2018 applies until then) | Not yet open |
| Sweden | Cybersakerhetslagen (SFS 2025:1506) | Transposed, in force 15 January 2026 | Not confirmed in this research pass |
| Denmark | Act name not independently confirmed | Transposed | Reported April 2025 (act name unconfirmed) |
| Finland | Kyberturvallisuuslaki, adopted 13 March 2025 | Transposed, in force 8 April 2025 | 8 May 2025 (passed) |
| Ireland | No transposition law passed | Not transposed; referred to the CJEU 8 July 2026 | Not yet open |
Competent authorities confirmed in this research: BSI (Germany), NCSC (Netherlands), ANSSI (France, designated but not yet legally active), ACN (Italy), CCB (Belgium), Traficom (Finland), NCSC (Ireland, intended). Not independently confirmed for Poland, Spain, Austria, Sweden, or Denmark in this research pass.
Not yet transposed
Three member states in this table had not transposed NIS2 into national law at all as of August 2026: France, Spain, and Ireland. All three were referred to the Court of Justice of the European Union on 8 July 2026 for failing to notify complete transposition.
The Netherlands nuance, and where France, Spain, and Ireland's legislation stands now
Three member states in this table had not transposed NIS2 into national law at all as of August 2026: France, Spain, and Ireland. All three, along with the Netherlands, were referred to the Court of Justice of the European Union on 8 July 2026 for failing to notify complete transposition - though the Netherlands' law passed its final legislative step (Senate adoption) the very next day, 7 July 2026, and entered into force 15 August 2026. France and Spain have draft legislation in progress with no confirmed date for final passage; Ireland has no transposition law confirmed as before its parliament.
If you operate only in one of these three countries, NIS2's national registration and enforcement machinery is not yet live for you there - though the directive's underlying risk-management logic, and your exposure once the law does pass, is worth preparing for regardless.
A caveat on this table
Every row above rests on secondary sources - law firm client alerts and compliance-vendor trackers - cross-checked against 2-3 independent outlets per country, not against primary gazette text for most states. The European Commission's own per-country tracker pages were confirmed stale by direct check during this research: Germany's page still reported the country as non-compliant eight months after Germany's actual transposition date. Treat every date on this page as best available as of the verification date below, not as a guarantee, and check the relevant national gazette or authority directly before relying on a specific date for a compliance decision.
Last verified: 11 August 2026.
Not sure if NIS2 applies to you yet?
Check your own scope