Cybersecurity Database

Cybersecurity Database

Reports

Transposition of NIS 2 in the EU Member States

Who has transposed the directive, with which law and how late; the Commission’s infringement procedures.

Data as of 2 November 2026Download the PDF

Always up-to-date version: https://www.cybersecuritydatabase.org/en/reports/nis2/

As of 2 November 2026, 24 of 27 Member States have a NIS 2 transposition law in force, but only 5 did so by the 17 October 2024 deadline. Still missing: France, Ireland and Spain.

  • 24 / 27Member States with the national act in force
  • 5on time
  • 13months of median delay for late transposers
  • 3Member States still without an act in force

Map of transposition status

Sweden: Transposed, in forceSpain: Draft in preparationSlovakia: Transposed, in forceSlovenia: Transposed, in forceRomania: Transposed, in forcePortugal: Transposed, in forcePoland: Transposed, in forceNetherlands: Transposed, in forceMalta: Transposed, in forceLuxembourg: Transposed, in forceLithuania: Transposed, in forceLatvia: Transposed, in forceItaly: Transposed, in forceIreland: Draft in preparationHungary: Transposed, in forceGreece: Transposed, in forceGermany: Transposed, in forceFrance: Bill before parliamentFinland: Transposed, in forceEstonia: Transposed, in forceDenmark: Transposed, in forceCzechia: Transposed, in forceCyprus: Transposed, in forceCroatia: Transposed, in forceBulgaria: Transposed, in forceBelgium: Transposed, in forceAustria: Transposed, in forceMalta: Transposed, in forceLuxembourg: Transposed, in force
  • Transposed, in force 24
  • Bill before parliament 1
  • Draft in preparation 2
  • Outside the EU

Country by country

CountryStatusNational actIn force sinceDelay
Austria Transposed, in forceNetz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026) · BGBl. I Nr. 94/20251 October 202623 months late
Belgium Transposed, in forceLoi du 26 avril 2024 établissant un cadre pour la cybersécurité des réseaux et des systèmes d'information d'intérêt général pour la sécurité publique · Moniteur belge, 17.05.202418 October 2024on time
Bulgaria Transposed, in forceЗакон за изменение и допълнение на Закона за киберсигурност · ДВ, бр. 17 от 13.02.202617 February 202615 months late
Croatia Transposed, in forceZakon o kibernetičkoj sigurnosti · NN 14/202415 February 2024on time
Cyprus Transposed, in forceΟ περί Ασφάλειας Δικτύων και Συστημάτων Πληροφοριών (Τροποποιητικός) Νόμος του 2025 · Ν. 60(Ι)/202525 April 20256 months late
Czechia Transposed, in forceZákon o kybernetické bezpečnosti · 264/2025 Sb.1 November 202512 months late
Denmark Transposed, in forceLov om foranstaltninger til sikring af et højt cybersikkerhedsniveau (NIS 2-loven) · Lov nr. 434 af 6. maj 20251 July 20258 months late
Estonia Transposed, in forceKüberturvalisuse seaduse ja teiste seaduste muutmise seadus (küberturvalisuse 2. direktiivi ülevõtmine) · RT I, 30.12.2025, 41 January 202614 months late
Finland Transposed, in forceKyberturvallisuuslaki · 124/20258 April 20255 months late
France Bill before parliamentProjet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité–24 months and still late
Germany Transposed, in forceGesetz zur Umsetzung der NIS-2-Richtlinie und zur Regelung wesentlicher Grundzüge des Informationssicherheitsmanagements in der Bundesverwaltung (NIS2UmsuCG) · BGBl. 2025 I Nr. 3016 December 202513 months late
Greece Transposed, in forceΝόμος 5160/2024 – Ενσωμάτωση της Οδηγίας (ΕΕ) 2022/2555 για μέτρα για υψηλό κοινό επίπεδο κυβερνοασφάλειας σε ολόκληρη την Ένωση · ΦΕΚ Α' 195/27.11.202427 November 20241 month late
Hungary Transposed, in force2024. évi LXIX. törvény Magyarország kiberbiztonságáról · 2024. évi LXIX. törvény1 January 20252 months late
Ireland Draft in preparationNational Cyber Security Bill (General Scheme, 2024)–24 months and still late
Italy Transposed, in forceDecreto legislativo 4 settembre 2024, n. 138 · D.Lgs. 138/202416 October 2024on time
Latvia Transposed, in forceNacionālās kiberdrošības likums · Latvijas Vēstnesis, 128A, 04.07.20241 September 2024on time
Lithuania Transposed, in forceKibernetinio saugumo įstatymo Nr. XII-1428 pakeitimo įstatymas · Nr. XIV-290218 October 2024on time
Luxembourg Transposed, in forceLoi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité · Mémorial A n° 225 de 202610 May 202618 months late
Malta Transposed, in forceMeasures for a High Common Level of Cybersecurity across the European Union (Malta) Order, 2025 (S.L. 460.41) · L.N. 71 of 202523 January 202615 months late
Netherlands Transposed, in forceCyberbeveiligingswet (Cbw) · Stb. 2026, 18715 August 202621 months late
Poland Transposed, in forceUstawa z dnia 23 stycznia 2026 r. o zmianie ustawy o krajowym systemie cyberbezpieczeństwa oraz niektórych innych ustaw · Dz.U. 2026 poz. 2523 April 202617 months late
Portugal Transposed, in forceDecreto-Lei n.º 125/2025 – Regime jurídico da cibersegurança · Decreto-Lei n.º 125/20253 April 202617 months late
Romania Transposed, in forceOrdonanța de urgență a Guvernului nr. 155/2024 privind instituirea unui cadru pentru securitatea cibernetică a rețelelor și sistemelor informatice din spațiul cibernetic național civil · OUG 155/2024 (Monitorul Oficial nr. 1332 din 31.12.2024)31 December 20242 months late
Slovakia Transposed, in forceZákon, ktorým sa mení a dopĺňa zákon č. 69/2018 Z. z. o kybernetickej bezpečnosti · 366/2024 Z. z.1 January 20252 months late
Slovenia Transposed, in forceZakon o informacijski varnosti (ZInfV-1) · Uradni list RS, št. 40/202519 June 20258 months late
Spain Draft in preparationAnteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad–24 months and still late
Sweden Transposed, in forceCybersäkerhetslag · SFS 2025:150615 January 202614 months late

Commission infringement procedures

How many of the Member States addressed later brought the national law into force, and how many only after the stage shown.

StageDateMember States addressedCompliant todayCompliant after this stageStill without a law
Letters of formal notice28 November 2024232018France, Ireland and Spain
Reasoned opinions7 May 2025191612France, Ireland and Spain
Referral to the EU Court of Justice8 July 2026411France, Ireland and Spain