NIS2 obligations in Denmark

Competent authority & CSIRT Legal ref: Chapter 3, § 20

• Minister for Civil Protection and Emergency Planning ecs-org.eu · 28 Oct 2026 · secondary source
• The Minister for Civil Protection and Emergency Planning, in consultation with other sector-specific ministers, will define which authority serves as the competent authority for each sector, subsector, or entity type, as outlined in the Act’s annexes. ecs-org.eu · 28 Oct 2026 · secondary source
• Access the list of sector-specific authorities via this Link: Link ecs-org.eu · 28 Oct 2026 · secondary source

Referenced documents: Link

Who's in scope (national deviations) Legal ref: Article 1; Annex 1,2

• Sectors covered by the Act correspond to sectors of high criticality and other critical sectors under NIS2. The Act does not apply to: ecs-org.eu · 28 Oct 2026 · secondary source
• Entities covered by the Act on Strengthened Preparedness in the Energy Sector. ecs-org.eu · 28 Oct 2026 · secondary source
• Entities covered by the Act on Security and Emergency Preparedness in the Telecommunications Sector. ecs-org.eu · 28 Oct 2026 · secondary source
• Entities pursuant to Section 333(1) of the Danish Financial Business Act. ecs-org.eu · 28 Oct 2026 · secondary source
• Entities to which sector-specific EU acts have at least the same effect as the provisions of Sections 6, 12, 13 and 15. ecs-org.eu · 28 Oct 2026 · secondary source
• Public administration entities that carry out their activities in the fields of national security, public security, defence, or law enforcement. ecs-org.eu · 28 Oct 2026 · secondary source
• Responsible ministers may exempt entities involved in national security, defence, law enforcement, or those serving such bodies, from certain obligations under the Act. Full exemptions may apply if these are the entities’ sole activities. Ministers may also extend the Act to local public administration units and educational institutions, in consultation with the Minister for Civil Protection. ecs-org.eu · 28 Oct 2026 · secondary source
• In addition to the primary NIS2 Act, Denmark is adopting and implementing sector-specific legislation. ecs-org.eu · 28 Oct 2026 · secondary source

Registration Legal ref: Chapter 3, § 9, 10

• Entities under scope must register with the relevant competent authority and provide the following information: ecs-org.eu · 28 Oct 2026 · secondary source
• Name of the organisation. ecs-org.eu · 28 Oct 2026 · secondary source
• Address of the entity’s principal place of business and its other places of business in the European Union or, if it is not established in the EU, the legal representative. ecs-org.eu · 28 Oct 2026 · secondary source
• Up-to-date contact details, including email addresses, IP ranges, telephone numbers, and the contact details of the legal representative. ecs-org.eu · 28 Oct 2026 · secondary source
• Sector and subsector classification. ecs-org.eu · 28 Oct 2026 · secondary source
• List of member states where the entity provides services (if applicable). ecs-org.eu · 28 Oct 2026 · secondary source
• Timelines for submitting the requested information differ: ecs-org.eu · 28 Oct 2026 · secondary source
• DNS service providers, top-level domain name administrators, entities providing domain name registration services, and providers of cloud computing services, data centre services, content delivery networks, managed services, managed security services, online marketplaces, online search engines, and social networking platforms (no later than 3 months after falling under the Act’s scope). ecs-org.eu · 28 Oct 2026 · secondary source
• Essential entities, important entities, and entities providing domain name registration service (no later than 2 weeks after falling under the Act’s scope). ecs-org.eu · 28 Oct 2026 · secondary source
• Entities should self-assess whether they fall under the scope of the Act and register by October 1, 2025. An assessment tool is available via this Link ecs-org.eu · 28 Oct 2026 · secondary source

Referenced documents: Link

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Chapter 3, § 12, 13

• Essential and important entities must notify the relevant competent authority and the CSIRT of significant incidents, including the necessary information allowing authorities to determine any cross-border effects of the incident. ecs-org.eu · 28 Oct 2026 · secondary source
• An incident is considered significant if it causes or could cause serious operational disruption or financial loss, significantly harms natural or legal persons, or meets criteria set by relevant ministers through specific regulations. ecs-org.eu · 28 Oct 2026 · secondary source
• Reporting requirements: ecs-org.eu · 28 Oct 2026 · secondary source
• Early warning within 24 hours of becoming aware of the significant incident. ecs-org.eu · 28 Oct 2026 · secondary source
• Incident notification within 72 hours, plus an initial impact assessment. ecs-org.eu · 28 Oct 2026 · secondary source
• Interim report at the request of the national CSIRT (if necessary). ecs-org.eu · 28 Oct 2026 · secondary source
• Final report no later than 1 month after sending the incident notification. ecs-org.eu · 28 Oct 2026 · secondary source
• Progress report (if the incident is still ongoing), no later than 1 month after sending the incident notification, and a final report within another month after the end of the incident. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: § 33

• Up to 10,000,000 EUR or 2% of the total worldwide annual turnover (essential entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Up to 7,000,000 EUR or 1.4% of the total worldwide annual turnover (important entities). ecs-org.eu · 28 Oct 2026 · secondary source
• The Act provides information on the different types of offences. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

Supervisory guidance

Not yet published / needs verification No regulator guidance links recorded yet. Official text: Final Text

What changed recently

1. 1 Jul 2025
   National NIS2 law enters into force (per tracker) ecs-org.eu secondary source