Reports
Analyses drawn from the whole database: transposition of EU law, deadlines, incident reporting obligations and national strategies compared. Figures, tables and charts update themselves when the records change. Each report can be read here and downloaded as a PDF; at the end of each quarter we keep a copy.
Transposition of NIS 2 in the EU Member States
Who has transposed the directive, with which law and how late; the Commission’s infringement procedures.
Data as of 2 November 2026
CER and the CRA in the EU Member States
Transposition of the CER Directive on the resilience of critical entities and national measures for the Cyber Resilience Act.
Data as of 29 October 2026
Deadlines in the next 18 months
Entry into force, staggered application and transposition deadlines, month by month, for EU and national acts.
Data as of 2 November 2026
The EU rules on a timeline
The application dates of EU cybersecurity acts, from NIS 2 to the CRA and from the AI Act to DORA, on a single timeline.
Data as of 29 October 2026
Incident reporting: deadlines compared
How fast and to whom a cyber incident must be reported, in the main regimes worldwide, from the fastest to the slowest.
Data as of 2 November 2026
Cyber rules by sector
Energy, health, finance, telecoms, transport, industry, AI and connected products: how many acts, in how many countries, the reference EU acts and the next deadline for each sector.
Data as of 2 November 2026
National cybersecurity strategies
Which countries have a strategy in force, which let it lapse, which periods are about to end, and the most common objectives.
Data as of 2 November 2026
Italy: the cybersecurity framework
National strategy, laws and decrees in force, transposition of NIS 2, CER and the CRA, incident reporting obligations and deadlines in the next 24 months.
Data as of 2 November 2026