NIS2 transposition tracker
Browse NIS2 obligations by country →
24 of 27 EU Member States have adopted a national NIS2 law according to the ECSO tracker (last updated 10 Sep 2026; fetched 28 Oct 2026). 3 remain at draft stage. The European Commission counts transposition as complete only when all measures are notified, so its view can differ — see the Commission column.
| National law & official text | Commission | Notes for OT | |||||
|---|---|---|---|---|---|---|---|
| Albania AL non-EU Obligations → |
transposed | 18 Apr 2024 | — | Law 25/2024 on Cybersecurity Document view – Center for Official Publications |
n/a | needs verification Verified 28 Oct 2026 · ECSO Non-EU alignment status is self-reported/secondary; verify with national source. |
|
| Armenia AM non-EU Obligations → |
transposed | 4 Dec 2025 | — | Cybersecurity Law Law |
n/a | needs verification Verified 28 Oct 2026 · ECSO Non-EU alignment status is self-reported/secondary; verify with national source. |
|
| Austria AT Obligations → |
transposed | 23 Dec 2025 | 1 Oct 2026 | Network and Information System Security Act 2026 Final text |
Reasoned opinion 7 May 2025 | Resolved 28 Oct 2026: Bundesamt für Cybersicherheit confirms registration via USP from 1 Oct 2026 to 31 Dec 2026 (the ECSO record contained conflicting dates). ↗ |
secondary source Verified 28 Oct 2026 · ECSO · EC · EC |
| Belgium BE Obligations → |
transposed | 26 Apr 2024 | 18 Oct 2024 | Law of April 26, 2024 establishing a framework for the cybersecurity of networks and information systems of general interest for public... Final text · Royal Decree |
— | National framework CyFun (CyberFundamentals) is based on NIST CSF, ISO 27001/27002, CIS Controls and IEC 62443; conformity assessed by accredited bodies. ↗ |
secondary source Verified 28 Oct 2026 · ECSO · EC |
| Bulgaria BG Obligations → |
transposed | 5 Feb 2026 | — | Final Text | Reasoned opinion 7 May 2025 | secondary source Verified 28 Oct 2026 · ECSO · EC |
|
| Croatia HR Obligations → |
transposed | 15 Feb 2024 | — | Regulation on Cybersecurity Primary Law · Implementing Act |
— | Tiered risk assessment model must cover IT/OT systems; essential entities audited every two years. ↗ |
secondary source Verified 28 Oct 2026 · ECSO · EC |
| Cyprus CY Obligations → |
transposed | 25 Apr 2025 | — | The Security of Networks and Information Systems (Amendment) Law of 2025, (Law 60(I)/2025) amending The Security of Networks and Information... Primary Law |
Reasoned opinion 7 May 2025 | Early warning required within 6 hours (stricter than NIS2 24h). ↗ |
secondary source Verified 28 Oct 2026 · ECSO · EC |
| Czechia CZ Obligations → |
transposed | 4 Aug 2025 | 1 Nov 2025 | Cybersecurity Act / Act No. 264/2025 Final Text |
Reasoned opinion 7 May 2025 | Incident reporting starts 1 year after receipt of registration confirmation; scope adds defence industry. ↗ |
secondary source Verified 28 Oct 2026 · ECSO · EC |
| Denmark DK Obligations → |
transposed | 6 May 2025 | 1 Jul 2025 | Law No. 434, Act on measures to ensure a high level of cybersecurity (NIS 2 Act) Final Text |
Reasoned opinion 7 May 2025 | secondary source Verified 28 Oct 2026 · ECSO · EC |
|
| Estonia EE Obligations → |
transposed | 30 Dec 2025 | 1 Jan 2026 | Amendment of the Cybersecurity Act Law |
Reasoned opinion 7 May 2025 | secondary source Verified 28 Oct 2026 · ECSO · EC |
|
| Finland FI Obligations → |
transposed | 4 Apr 2025 | 8 Apr 2025 | Cybersecurity Law Final Text |
Reasoned opinion 7 May 2025 | secondary source Verified 28 Oct 2026 · ECSO · EC |
|
| France FR Obligations → |
draft Draft Law |
— | — | Draft Law | CJEU referral 8 Jul 2026 | France is folding NIS2 into a Critical Infrastructure Resilience Bill; ANSSI developing its own measures framework. ↗ Referred to the CJEU on 8 Jul 2026 for failing to notify transposition measures. ↗ |
needs verification Verified 28 Oct 2026 · ECSO · EC · EC Draft status as of ECSO update 10 Sep 2026; check national legislature for progress since. |
| Germany DE Obligations → |
transposed | 5 Dec 2025 | 6 Dec 2025 | Law implementing the NIS-2 Directive and regulating essential principles of information security management in the federal administration Final Text |
Reasoned opinion 7 May 2025 | BSI: law promulgated 5 Dec 2025, in force 6 Dec 2025. ↗ |
secondary source Verified 28 Oct 2026 · ECSO · EC |
| Greece GR Obligations → |
transposed | 27 Nov 2024 | — | Law No. 5160 Final Text · Joint Ministerial decision · Joint Ministerial decision |
— | secondary source Verified 28 Oct 2026 · ECSO · EC |
|
| Hungary HU Obligations → |
transposed | 23 May 2023 | 19 Oct 2024 | Act LXIX of 2024 on cybersecurity in Hungary Primary Law · Implementing Act |
Reasoned opinion 7 May 2025 | Deadline for first NIS2 compliance audit moved from 31 Dec 2025 to 30 Jun 2026 (per ECSO). ↗ ECSO notes delays in implementing decrees; Commission counts transposition as complete only when secondary legislation is in place. ↗ |
needs verification Verified 28 Oct 2026 · ECSO · EC Conflicting or incomplete signals between ECSO and Commission / within record. |
| Ireland IE Obligations → |
draft Draft Law |
— | — | Draft Law | CJEU referral 8 Jul 2026 | Referred to the CJEU on 8 Jul 2026 for failing to notify transposition measures. ↗ |
needs verification Verified 28 Oct 2026 · ECSO · EC · EC Draft status as of ECSO update 10 Sep 2026; check national legislature for progress since. |
| Italy IT Obligations → |
transposed | 9 Apr 2024 | 16 Oct 2024 | Legislative Decree No. 138 Final Text |
— | ACN technical annexes set minimum security requirements to be implemented by October 2026, based on the national framework (NIST CSF adaptation). ↗ Gazzetta Ufficiale: D.Lgs. 138/2024 published 1 Oct 2024 (GU n.230), in force 16 Oct 2024. ↗ |
secondary source Verified 28 Oct 2026 · ECSO · EC |
| Latvia LV Obligations → |
transposed | 20 Jun 2024 | 1 Sep 2024 | National Cyber Security Act Final Text · Regulation No. 397 on Minimum cybersecurity requirements; Entered into force on 02/07/2025 |
Reasoned opinion 7 May 2025 | ECSO flags delays in Cabinet regulations defining technical requirements; Regulation No. 397 (minimum requirements) in force 02/07/2025. ↗ |
needs verification Verified 28 Oct 2026 · ECSO · EC Conflicting or incomplete signals between ECSO and Commission / within record. |
| Lithuania LT Obligations → |
transposed | 11 Jul 2024 | 18 Oct 2024 | XII-1428 Law on Cybersecurity of the Republic of Lithuania; Governmental decree on the implementation of the Law of the Republic of... Final Text |
— | secondary source Verified 28 Oct 2026 · ECSO · EC |
|
| Luxembourg LU Obligations → |
transposed | 6 May 2026 | 10 May 2026 | Law of May 5, 2026 concerning measures aimed at ensuring a high level of cybersecurity Law |
Reasoned opinion 7 May 2025 | secondary source Verified 28 Oct 2026 · ECSO · EC |
|
| Malta MT Obligations → |
transposed | 8 Apr 2025 | — | Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, 2025 Final Text |
— | secondary source Verified 28 Oct 2026 · ECSO · EC |
|
| Moldova MD non-EU Obligations → |
partial Approved Law/ NIS2 Partially transposed |
1 Jan 2025 | — | Law No. 48/2023 on Cybersecurity Final text · Government Decision on how to fulfil cybersecurity obligations by service providers in critical sectors; Adopted on 05-09-2025 |
n/a | needs verification Verified 28 Oct 2026 · ECSO Non-EU alignment status is self-reported/secondary; verify with national source. |
|
| Montenegro ME non-EU Obligations → |
transposed | 11 Dec 2024 | — | Law on Information Security Zakon o informacionoj bezbjednosti |
n/a | needs verification Verified 28 Oct 2026 · ECSO Non-EU alignment status is self-reported/secondary; verify with national source. |
|
| Netherlands NL Obligations → |
transposed | 10 Jul 2026 | 15 Aug 2026 | Cyberbeveiligingswet (Cbw) – Cybersecurity Act. It replaces the old Wbni (Network and Information Systems Security Act) and is backed up by... Primary Law · Secondary Law |
CJEU referral 8 Jul 2026 | Commission referred NL to the CJEU on 8 Jul 2026 for failing to notify transposition; ECSO records the Cbw adopted 10/07/2026 and in force 15/08/2026. ↗ NCSC confirms the Cbw entered into force on 15 Aug 2026 (after the Commission's 8 Jul 2026 referral). ↗ |
secondary source Verified 28 Oct 2026 · ECSO · EC · EC · EC |
| North Macedonia MK non-EU Obligations → |
transposed | 27 Jun 2025 | — | Law on Security of Network and Information Systems Law |
n/a | needs verification Verified 28 Oct 2026 · ECSO Non-EU alignment status is self-reported/secondary; verify with national source. |
|
| Poland PL Obligations → |
transposed | 2 Mar 2026 | 3 Apr 2026 | Law Amending the Act on the National Cybersecurity System Final Text |
Reasoned opinion 7 May 2025 | Adds mining and nuclear energy subsectors to energy as high-criticality sectors. ↗ gov.pl gives entry into force as 3 Apr 2026; ECSO lists 2 Apr 2026. gov.pl date used. ↗ |
secondary source Verified 28 Oct 2026 · ECSO · EC · EC |
| Portugal PT Obligations → |
transposed | 4 Dec 2025 | — | Decree-Law No. 125/2025 Final Text |
Reasoned opinion 7 May 2025 | secondary source Verified 28 Oct 2026 · ECSO · EC |
|
| Romania RO Obligations → |
transposed | 1 Jan 2025 | — | Emergency Ordinance on the establishment of a framework for the cybersecurity of networks and information systems in civil national... Final Text · Draft Implementing Laws |
— | secondary source Verified 28 Oct 2026 · ECSO · EC |
|
| Serbia RS non-EU Obligations → |
transposed | 22 Oct 2025 | 30 Oct 2025 | Law on Information Security Final Text |
n/a | needs verification Verified 28 Oct 2026 · ECSO Non-EU alignment status is self-reported/secondary; verify with national source. |
|
| Slovakia SK Obligations → |
transposed | 1 Jan 2025 | 22 Jan 2025 | Law on cyber security Final Text |
— | secondary source Verified 28 Oct 2026 · ECSO · EC |
|
| Slovenia SI Obligations → |
transposed | 23 May 2025 | 19 Jun 2025 | Law on information security (ZInfV-1) Link to Law |
Reasoned opinion 7 May 2025 | secondary source Verified 28 Oct 2026 · ECSO · EC |
|
| Spain ES Obligations → |
draft Draft Law |
— | — | Draft Law | CJEU referral 8 Jul 2026 | Draft adds nuclear industry as high-criticality sector. Referred to the CJEU on 8 Jul 2026. ↗ |
needs verification Verified 28 Oct 2026 · ECSO · EC · EC Draft status as of ECSO update 10 Sep 2026; check national legislature for progress since. |
| Sweden SE Obligations → |
transposed | 17 Dec 2025 | 15 Jan 2026 | Cybersecurity Act Final text |
Reasoned opinion 7 May 2025 | Registration now handled by NCSC (FRA) since 1 Jul 2026. ↗ |
secondary source Verified 28 Oct 2026 · ECSO · EC |
| Ukraine UA non-EU Obligations → |
partial Transposed, except for Articles 28, 34, 35 NIS2 Directive |
27 Mar 2025 | 20 Apr 2025 | The Law of Ukraine 4336-IX “On Amendments to Certain Laws of Ukraine Concerning the Information Protection and Cyberprotection of State... The Law of Ukraine 4336-IX · The Law of Ukraine 2163-VIII |
n/a | needs verification Verified 28 Oct 2026 · ECSO Non-EU alignment status is self-reported/secondary; verify with national source. |
Status and dates are taken from the ECSO NIS2 Transposition Tracker (a secondary aggregator) with links to the national official texts it cites; Commission infringement steps from 7 May 2025 and 8 Jul 2026 press releases. Download: JSON · CSV. Not legal advice.
Get NIS2 transposition updates weekly
What changed in OT/ICS regulation this week, who it applies to, the deadlines, and which IEC 62443 controls it touches — plus a short CISA ICS advisory digest. One email, every week. No spam.
Free. Unsubscribe any time. See privacy.