NIS2 transposition status by country

Why the national law matters

Directive (EU) 2022/2555 sets the common framework. The details that matter in daily practice are set by each Member State: the registration portal and deadline, the authority that receives incident reports, the supervisory authority, the exact fines and any additional sectors or duties. Under Article 41(1), Member States had to adopt and publish their laws by 17 October 2024 and apply them from 18 October 2024. Several missed this deadline by a long way.

For organisations in several countries, the jurisdiction rules of Article 26 decide which national law applies to which legal entity. As a rule, it is the law of the Member State where the entity is established. You will find more on this on the pages about scope and registration.

Countries with a law in force

These 13 Member States have a country version of this guide. They are listed in order of entry into force.

Our country versions explain the national registration portal, deadlines, reporting channel and fines in the language of the country.

Countries without a law in force

In July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for failing to transpose NIS2 and asked for financial penalties. The Netherlands has since adopted its law.

Ireland in detail

Irish organisations cannot yet register under NIS2, and there is no NIS2 reporting duty yet. The NCSC has announced a registration and reporting portal that will be available once the law is in force, and offers an “Am I in Scope?” tool and further information on its NIS2 page. According to the General Scheme, the bill is to follow the directive closely: the reporting stages of Article 23, the risk-management measures of Article 21 and fines of up to €10 million or 2% of worldwide turnover for essential entities and €7 million or 1.4% for important entities, whichever is higher. These are draft provisions and may change.

Until the law arrives, Irish organisations in scope can use the directive as their reference. That is what this EU version of the NIS2 scoring is built on.

Other Member States

We have not yet published a country version for the following 11 Member States. The information comes from official sources where they were available and otherwise from published overviews and law firm reports. Check the national law before relying on it.

The national transposition measures notified to the Commission are listed on EUR-Lex. Until you have checked your national law, the directive is a reliable guide to the minimum requirements, and this EU version of the guide explains them.

EEA countries and Switzerland

As of October 2026, NIS2 has not been incorporated into the EEA Agreement. Liechtenstein has nevertheless adopted its Cybersecurity Act (Cyber-Sicherheitsgesetz, LGBl. 2025 No. 111), in force since 1 February 2025; until incorporation it treats the directive as national law. Its authority is the Cybersecurity Unit (Stabsstelle Cyber-Sicherheit). Norway’s Digital Security Act, in force since 1 October 2025, transposes NIS1 and takes over only parts of NIS2, mainly the reporting duties. Iceland applies only its NIS1 law, Act No. 78/2019, and plans to amend it once NIS2 becomes EEA law.

Switzerland is not an EU member, so NIS2 does not apply there. Swiss companies that are established or provide services in the EU can still fall under the national NIS2 law of a Member State.