NIS2 management body training obligation by country
The table shows, for each country, whether and how the law establishes a cybersecurity training obligation: who it applies to, at what frequency (where the provision says so) and on what legal basis. Where national law does not separately provide for training, the baseline of Article 20(2) of Directive (EU) 2022/2555 applies — this is clearly marked in the table.
| Training obligation | Applies to | Frequency | Legal basis | |
|---|---|---|---|---|
| Austria | Yes (EU directive baseline) [↗] | Members of the management body (obligation); employee training is encouraged | On a regular basis (employee training) | Directive (EU) 2022/2555, Art. 20(2) [↗] |
| Belgium | Yes (national law) [↗] | Members of the management body | – | NIS2-wet (Wet van 26 april 2024), art. 31 [↗] |
| Bulgaria | Yes (EU directive baseline) [↗] | Members of the management body (obligation); employee training is encouraged | On a regular basis (employee training) | Directive (EU) 2022/2555, Art. 20(2) [↗] |
| Croatia | Yes (national law) [↗] | Members of the management body and employees | – | Zakon o kibernetičkoj sigurnosti (NN 14/24), čl. 29 [↗] |
| Cyprus | Yes (national law) [↗] | Members of the management body and employees | On a regular basis (employee training) | Ν. 60(Ι)/2025, άρθρο 35Α [↗] |
| Czechia | Yes (EU directive baseline) [↗] | Members of the management body (obligation); employee training is encouraged | On a regular basis (employee training) | Directive (EU) 2022/2555, Art. 20(2) [↗] |
| Denmark | Yes (EU directive baseline) [↗] | Members of the management body (obligation); employee training is encouraged | On a regular basis (employee training) | Directive (EU) 2022/2555, Art. 20(2) [↗] |
| Estonia | Yes (EU directive baseline) [↗] | Members of the management body (obligation); employee training is encouraged | On a regular basis (employee training) | Directive (EU) 2022/2555, Art. 20(2) [↗] |
| Finland | Yes (national law) [↗] | Employees (training as a risk-management measure) | – | Kyberturvallisuuslaki 124/2025, 9 § [↗] |
| Germany | Yes (EU directive baseline) [↗] | Members of the management body (obligation); employee training is encouraged | On a regular basis (employee training) | Directive (EU) 2022/2555, Art. 20(2) [↗] |
| Greece | Yes (national law) [↗] | Members of the management body and employees | At least annually (employee training) | Νόμος 5160/2024, Άρθρο 14 [↗] |
| Hungary | Yes (national law) [↗] | Members of the management body and employees | – | 2024. évi LXIX. törvény, § 6 [↗] |
| Italy | Yes (national law) [↗] | Members of the management body and employees | On a regular basis (employee training) | D.Lgs 138/2024, art 23 [↗] |
| Latvia | Yes (EU directive baseline) [↗] | Members of the management body (obligation); employee training is encouraged | On a regular basis (employee training) | Directive (EU) 2022/2555, Art. 20(2) [↗] |
| Lithuania | Yes (EU directive baseline) [↗] | Members of the management body (obligation); employee training is encouraged | On a regular basis (employee training) | Directive (EU) 2022/2555, Art. 20(2) [↗] |
| Luxembourg | Yes (EU directive baseline) [↗] | Members of the management body (obligation); employee training is encouraged | On a regular basis (employee training) | Directive (EU) 2022/2555, Art. 20(2) [↗] |
| Malta | Yes (national law) [↗] | Members of the management body and employees | On a regular basis (employee training) | S.L. 460.41, article 18 [↗] |
| Poland | Yes (EU directive baseline) [↗] | Members of the management body (obligation); employee training is encouraged | On a regular basis (employee training) | Directive (EU) 2022/2555, Art. 20(2) [↗] |
| Portugal | Yes (national law) [↗] | Members of the management body and employees | – | Decreto-Lei n.º 125/2025, art 27 [↗] |
| Romania | Yes (national law) [↗] | Members of the management body and employees | On a regular basis (employee training) | OUG 155/2024, art. 14 [↗] |
| Slovakia | Yes (EU directive baseline) [↗] | Members of the management body (obligation); employee training is encouraged | On a regular basis (employee training) | Directive (EU) 2022/2555, Art. 20(2) [↗] |
| Slovenia | Yes (EU directive baseline) [↗] | Members of the management body (obligation); employee training is encouraged | On a regular basis (employee training) | Directive (EU) 2022/2555, Art. 20(2) [↗] |
| Sweden | Yes (national law) [↗] | Members of the management body | – | Cybersäkerhetslag (2025:1506), 2 kap. 4 § [↗] |