NIS2 transposition status by EU country
The table shows, for each country we cover, the national act transposing the NIS2 Directive and the date it takes effect. Every entry is quoted verbatim from our legal knowledge base and links to the official source.
| National act | Effective date | Supervisory authority | |
|---|---|---|---|
| Austria | NISG 2026 [↗] | 2026-10-01 [↗] | Zuständige Behörde und Meldepflicht (Cybersicherheitsbehörde, sektorspezifische CSIRTs — NISG § 4, § 34) [↗] |
| Belgium | NIS2-wet [↗] | 2024-10-18 [↗] | Bevoegde autoriteit en meldingsplicht (nationale cyberbeveiligingsautoriteit, nationale CSIRT — NIS2-wet art. 16, art. 35) [↗] |
| Bulgaria | ЗКС [↗] | 2026-02-13 [↗] | Компетентен орган и задължение за уведомяване (национален компетентен орган, СЕРИКС/CSIRT — ЗКС чл. 16, чл. 23) [↗] |
| Croatia | Uredba o kibern. sigurnosti [↗] | 2024-11-30 [↗] | Nadležno tijelo i obveza obavještavanja (nadležni CSIRT / CARNET — Zakon o kibernetičkoj sigurnosti čl. 4, čl. 37) [↗] |
| Cyprus | Ν. 60(Ι)/2025 [↗] | 2025-04-25 [↗] | Αρμόδια αρχή και υποχρέωση κοινοποίησης (Αρχή Ψηφιακής Ασφάλειας — Ν. 60(Ι)/2025 άρθρο 30, 35Β) [↗] |
| Czechia | zákon 264/2025 Sb. [↗] | 2025-11-01 [↗] | Příslušný úřad a ohlašovací povinnost (Úřad, Národní CERT — zákon 264/2025 Sb. § 42, § 43, § 16) [↗] |
| Denmark | NIS2-loven [↗] | 2025-07-01 [↗] | Kompetent myndighed og underretningspligt (kompetent myndighed, CSIRT — NIS2-loven § 12, § 13) [↗] |
| Estonia | KüTS [↗] | 2026-01-01 [↗] | Estonian supervisory and competent authority: Estonian Information System Authority (RIA) [↗] |
| Finland | kyberturvallisuuslaki [↗] | 2025-04-08 [↗] | Keskitetty yhteyspiste Suomessa: Liikenne- ja viestintäviraston Kyberturvallisuuskeskus (18 §) [↗] |
| France | Transposition in progress — no act in force yet | – | – |
| Germany | BSIG [↗] | 2025-12-06 [↗] | Competent supervisory authority in Germany: Federal Office for Information Security (BSI) [↗] |
| Greece | Νόμος 5160/2024 [↗] | 2024-11-27 [↗] | Αρμόδια αρχή και υποχρέωση αναφοράς (Εθνική Αρχή Κυβερνοασφάλειας, CSIRT — Νόμος 5160/2024 άρθρο 8, 16) [↗] |
| Hungary | 2024. évi LXIX. törvény [↗] | 2025-01-01 [↗] | Kiberbiztonsági hatóság és bejelentési kötelezettség (nemzeti kiberbiztonsági hatóság — 2024. évi LXIX. törvény § 23, § 8) [↗] |
| Ireland | Transposition in progress — no act in force yet | – | – |
| Italy | dlgs_138_2024 [↗] | 2024-10-16 [↗] | Autorità nazionale competente NIS e Punto di contatto unico in Italia: ACN (art 10) [↗] |
| Latvia | NKDL [↗] | 2024-09-01 [↗] | Kompetentā iestāde un ziņošanas pienākums (Nacionālais kiberdrošības centrs — NKDL 4. pants, 34. pants) [↗] |
| Lithuania | KSĮ Nr. XII-1428 [↗] | 2024-10-18 [↗] | Kompetentinga institucija ir registravimasis (Nacionalinis kibernetinio saugumo centras — KSĮ 7 str., 11 str.) [↗] |
| Luxembourg | loi du 5 mai 2026 [↗] | 2026-05-10 [↗] | Autorité compétente et obligation d'enregistrement (Institut luxembourgeois de régulation — loi du 5 mai 2026, art. 3, art. 11, art. 14) [↗] |
| Malta | S.L. 460.41 [↗] | 2026-04-07 [↗] | Supervisory authority and notification duty (CIP Department, national CSIRT — S.L. 460.41 article 7, article 20) [↗] |
| Netherlands | cyberbeveiligingswet [↗] | 2026-08-15 [↗] | Bevoegde autoriteit, CSIRT en meldpunt (Minister van Justitie en Veiligheid als CSIRT — Cbw art. 15, 26–27, 43–44; Cbb art. 2, 25, 27) [↗] |
| Poland | uKSC [↗] | 2026-04-03 [↗] | Właściwy CSIRT sektorowy i obowiązek zgłaszania incydentów (CSIRT sektorowy — uKSC art. 11) [↗] |
| Portugal | Decreto-Lei n.º 125/2025 [↗] | 2026-04-03 [↗] | Autoridade competente e registo (CNCS — Decreto-Lei n.º 125/2025 artigo 19.º, artigo 8.º) [↗] |
| Romania | OUG 155/2024 [↗] | 2024-12-31 [↗] | Autoritate competentă și obligația de raportare (DNSC, CSIRT național — OUG 155/2024 art. 24, art. 15) [↗] |
| Slovakia | zákon č. 69/2018 Z. z. [↗] | 2026-04-30 [↗] | Príslušný orgán a registračná povinnosť (Národný bezpečnostný úrad — zákon č. 69/2018 Z. z. § 4, § 17) [↗] |
| Slovenia | ZInfV-1 [↗] | 2025-06-04 [↗] | Pristojni organ in obveznost priglasitve (Urad Vlade RS za informacijsko varnost, CSIRT — ZInfV-1 10. člen, 30. člen) [↗] |
| Spain | Transposition in progress — no act in force yet | – | – |
| Sweden | cybersakerhetslag_2025_1506 [↗] | 2026-01-15 [↗] | Gemensam kontaktpunkt (SPOC) i Sverige: Försvarets radioanstalt (1 kap. 17 §; förordning 2025:1507 § 23) [↗] |
Last updated: 2026-09-17
Frequently asked questions
Which act transposes the NIS2 Directive in Malta?
In Malta, the NIS2 Directive is transposed by S.L. 460.41; effective date: 2026-04-07. The table links to the official source.