Cybersecurity Database

Transposition of the NIS 2 Directive in the EU Member States

For each Member State: the national act transposing the NIS 2 Directive, its entry-into-force date and a link to the official source. Where transposition is not yet complete, the latest known stage of the bill.

Text of the directive: Directive (EU) 2022/2555

Map of transposition status

Sweden: Transposed, in forceSpain: Draft in preparationSlovakia: Transposed, in forceSlovenia: Transposed, in forceRomania: Transposed, in forcePortugal: Transposed, in forcePoland: Transposed, in forceNetherlands: Transposed, in forceMalta: Transposed, in forceLuxembourg: Transposed, in forceLithuania: Transposed, in forceLatvia: Transposed, in forceItaly: Transposed, in forceIreland: Draft in preparationHungary: Transposed, in forceGreece: Transposed, in forceGermany: Transposed, in forceFrance: Bill before parliamentFinland: Transposed, in forceEstonia: Transposed, in forceDenmark: Transposed, in forceCzechia: Transposed, in forceCyprus: Transposed, in forceCroatia: Transposed, in forceBulgaria: Transposed, in forceBelgium: Transposed, in forceAustria: Transposed, in forceMalta: Transposed, in forceLuxembourg: Transposed, in force

Country by country

The most important milestones, past and future: those set by the directive for all Member States and those of the national law.

Technical terms: see the glossary

Transposed, in force: 24 · Bill before parliament: 1 · Draft in preparation: 2 · Download the table (CSV)

CountryStatusNational actAuthoritiesIn force sinceAgainst the deadlineProgressNotes
Austria Transposed, in forceNetz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026)
BGBl. I Nr. 94/2025
Official source · Database entry		Competent authority and single point of contact: Federal Office for Cybersecurity (Bundesamt für Cybersicherheit), under the Ministry of the Interior. CSIRT: GovCERT Austria for public administration, which also acts as national CSIRT until the Office authorises one; CERT.at and Austrian HealthCERT are also members of the EU CSIRTs Network.1 October 202623 months late
8 milestones, 5 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 17 October 2024 · Transposition deadline for Member States EU
  3. 17 April 2025 · Member States establish the list of essential and important entities EU
  4. 12 December 2025 · National law adopted National
  5. 1 October 2026 · National law enters into force National
  6. 4 January 2027 · Final deadline for the initial registration of essential and important entities National
  7. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  8. 17 October 2027 · First review of the directive by the Commission EU
Notes · Published on 23 December 2025, it applies from 1 October 2026; the NISG 2018 remained in force until then. Risk-management measures and the criteria for significant incidents are specified in the NISV 2026 ordinance (BGBl. II Nr. 290/2026) of the Federal Office for Cybersecurity. Initial registration is due within three months of entry into force; the deadline would fall on 1 January 2027, a public holiday, and therefore moves to 4 January 2027.
Belgium Transposed, in forceLoi du 26 avril 2024 établissant un cadre pour la cybersécurité des réseaux et des systèmes d'information d'intérêt général pour la sécurité publique
Moniteur belge, 17.05.2024
Official source · Database entry		National authority, single point of contact and CSIRT: Centre for Cybersecurity Belgium (CCB); sectoral authorities take part in inspections in their sectors.18 October 2024on time
9 milestones, 6 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 26 April 2024 · National law adopted National
  3. 17 October 2024 · Transposition deadline for Member States EU
  4. 18 October 2024 · National law enters into force National
  5. 18 March 2025 · Deadline for entities to register National
  6. 17 April 2025 · Member States establish the list of essential and important entities EU
  7. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  8. 18 April 2027 · First conformity assessment of essential entities National
  9. 17 October 2027 · First review of the directive by the Commission EU
Notes · Transposed on time. The Royal Decree of 9 June 2024 implements it; the authority is the Centre for Cybersecurity Belgium (CCB).
Bulgaria Transposed, in forceЗакон за изменение и допълнение на Закона за киберсигурност
ДВ, бр. 17 от 13.02.2026
Official source · Database entry		Competent authorities: designated sector by sector by the Council of Ministers; for administrative bodies, the Ministry of Innovation and Digital Transformation, which also hosts the single point of contact. CSIRT: the national team CERT Bulgaria, with sectoral CSIRTs at the competent authorities.17 February 202615 months late
7 milestones, 5 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 17 October 2024 · Transposition deadline for Member States EU
  3. 17 April 2025 · Member States establish the list of essential and important entities EU
  4. 5 February 2026 · National law adopted National
  5. 17 February 2026 · National law enters into force National
  6. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  7. 17 October 2027 · First review of the directive by the Commission EU
Notes · Transposed by amending the 2018 Cybersecurity Act. The link points to the consolidated text published by the Communications Regulation Commission (CRC).
Croatia Transposed, in forceZakon o kibernetičkoj sigurnosti
NN 14/2024
Official source · Database entry		Central authority and single point of contact: Security and Intelligence Agency (SOA), through its National Cyber Security Centre. Other competent authorities: Office of the National Security Council, the network industries regulator (HAKOM), the body for the digital society and the Ministry of Science and Education. CSIRT: the SOA's (NCSC-HR) or CARNET's (CERT.hr), depending on the sector.15 February 2024on time
8 milestones, 6 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 26 January 2024 · National law adopted National
  3. 15 February 2024 · National law enters into force National
  4. 17 October 2024 · Transposition deadline for Member States EU
  5. 15 February 2025 · Deadline for the authorities' first categorisation of entities and for setting up the register of entities National
  6. 17 April 2025 · Member States establish the list of essential and important entities EU
  7. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  8. 17 October 2027 · First review of the directive by the Commission EU
Notes · Among the first Member States to transpose the directive. It replaced the 2018 act on operators of essential services (NN 64/18).
Cyprus Transposed, in forceΟ περί Ασφάλειας Δικτύων και Συστημάτων Πληροφοριών (Τροποποιητικός) Νόμος του 2025
Ν. 60(Ι)/2025
Official source · Database entry		Competent authority and single point of contact: Digital Security Authority (DSA). CSIRT: CSIRT-CY, the national CSIRT within the Authority.25 April 20256 months late
7 milestones, 5 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 17 October 2024 · Transposition deadline for Member States EU
  3. 17 April 2025 · Member States establish the list of essential and important entities EU
  4. 25 April 2025 · National law published National
  5. 25 April 2025 · National law enters into force National
  6. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  7. 17 October 2027 · First review of the directive by the Commission EU
Notes · Amends Law 89(I)/2020 on the security of network and information systems. Published in Official Gazette No. 5036 of 25 April 2025.
Czechia Transposed, in forceZákon o kybernetické bezpečnosti
264/2025 Sb.
Official source · Database entry		Competent authority and single point of contact: National Cyber and Information Security Agency (NÚKIB). CSIRT: NÚKIB's GovCERT.CZ and CSIRT.CZ, the national CSIRT run by CZ.NIC.1 November 202512 months late
8 milestones, 6 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 17 October 2024 · Transposition deadline for Member States EU
  3. 17 April 2025 · Member States establish the list of essential and important entities EU
  4. 11 June 2025 · National law adopted National
  5. 1 November 2025 · National law enters into force National
  6. 31 December 2025 · Deadline for entities to register National
  7. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  8. 17 October 2027 · First review of the directive by the Commission EU
Notes · New act replacing Act 181/2014 Sb. Security measures are set by Decrees 409/2025 and 410/2025 Sb.; the authority is NÚKIB.
Denmark Transposed, in forceLov om foranstaltninger til sikring af et højt cybersikkerhedsniveau (NIS 2-loven)
Lov nr. 434 af 6. maj 2025
Official source · Database entry		Competent authorities: sectoral, including the Danish Agency for Societal Security (Styrelsen for Samfundssikkerhed), the Agency for Digital Government, the Energy Agency, the Health Data Authority, the Civil Aviation and Railway Authority and the Maritime Authority. CSIRT: the Danish Defence Intelligence Service (FE), formerly the Centre for Cyber Security (CFCS).1 July 20258 months late
8 milestones, 6 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 17 October 2024 · Transposition deadline for Member States EU
  3. 17 April 2025 · Member States establish the list of essential and important entities EU
  4. 6 May 2025 · National law adopted National
  5. 1 July 2025 · National law enters into force National
  6. 1 October 2025 · Deadline for entities to register National
  7. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  8. 17 October 2027 · First review of the directive by the Commission EU
Notes · Telecommunications and energy are covered by separate sectoral acts (Lov nr. 435/2025 and Lov nr. 258/2025).
Estonia Transposed, in forceKüberturvalisuse seaduse ja teiste seaduste muutmise seadus (küberturvalisuse 2. direktiivi ülevõtmine)
RT I, 30.12.2025, 4
Official source · Database entry		Competent authority and single point of contact: Information System Authority (RIA). CSIRT: CERT-EE, within RIA.1 January 202614 months late
9 milestones, 6 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 17 October 2024 · Transposition deadline for Member States EU
  3. 17 April 2025 · Member States establish the list of essential and important entities EU
  4. 10 December 2025 · National law adopted National
  5. 1 January 2026 · National law enters into force National
  6. 1 April 2026 · Deadline for entities already in scope to send their data to RIA National
  7. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  8. 17 October 2027 · First review of the directive by the Commission EU
  9. 1 January 2029 · Deadline for entities already in scope to meet all the requirements of the act National
Notes · Transposed by amending the Cybersecurity Act (KüTS). Entities already in scope had to send their data to RIA within three months and must meet all requirements within three years. Since 1 September 2026 the new version of the Estonian information security standard applies (E-ITS, Regulation No 30, RT I, 29.08.2026, 1). An amendment to the KüTS (RT I, 06.10.2026, 1), in force since 16 October 2026, introduces voluntary reporting of near misses and allows RIA to order security audits of essential entities, either periodic (once every three years) or targeted.
Finland Transposed, in forceKyberturvallisuuslaki
124/2025
Official source · Database entry		Authorities: Transport and Communications Agency (Traficom), also the single point of contact, together with sectoral supervisory authorities. CSIRT: Traficom's National Cyber Security Centre (NCSC-FI).8 April 20255 months late
9 milestones, 7 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 17 October 2024 · Transposition deadline for Member States EU
  3. 7 April 2025 · National law adopted National
  4. 8 April 2025 · National law enters into force National
  5. 17 April 2025 · Member States establish the list of essential and important entities EU
  6. 8 May 2025 · Deadline for entities to register National
  7. 8 July 2025 · Deadline to implement security measures National
  8. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  9. 17 October 2027 · First review of the directive by the Commission EU
Notes · The central authority is Traficom, alongside sectoral supervisory authorities. Act 785/2026 extends the scope, from 1 January 2027, to holders of an operating licence for a nuclear facility, supervised by the Radiation and Nuclear Safety Authority (STUK).
France Bill before parliamentProjet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité
Bill on the resilience of critical infrastructure and strengthening cybersecurity
Official source		Under the bill: national authority and single point of contact, the National Cybersecurity Agency (ANSSI); national CSIRT, ANSSI's CERT-FR. Pending transposition, ANSSI remains the NIS 1 authority.–24 months and still late
5 milestones, 3 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 17 October 2024 · Transposition deadline for Member States EU
  3. 17 April 2025 · Member States establish the list of essential and important entities EU
  4. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  5. 17 October 2027 · First review of the directive by the Commission EU
  6. National transposing law not yet in force
Notes · The bill transposes NIS 2, the CER Directive and part of DORA together. Adopted by the Senate on 12 March 2025 and by the National Assembly's special committee on 10 September 2025; on 6 October 2026 the plenary debate scheduled for 7 and 9 October was withdrawn from the agenda. The Conference of Presidents of 27 October 2026 did not reschedule it (agenda set up to the week of 16 November). Referred to the Court of Justice on 8 July 2026. Meanwhile still in force: Loi n° 2018-133.
Germany Transposed, in forceGesetz zur Umsetzung der NIS-2-Richtlinie und zur Regelung wesentlicher Grundzüge des Informationssicherheitsmanagements in der Bundesverwaltung (NIS2UmsuCG)
BGBl. 2025 I Nr. 301
Official source · Database entry		Competent authority and single point of contact: Federal Office for Information Security (BSI). CSIRT: BSI's CERT-Bund.6 December 202513 months late
8 milestones, 6 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 17 October 2024 · Transposition deadline for Member States EU
  3. 17 April 2025 · Member States establish the list of essential and important entities EU
  4. 2 December 2025 · National law adopted National
  5. 6 December 2025 · National law enters into force National
  6. 6 March 2026 · Deadline for entities to register National
  7. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  8. 17 October 2027 · First review of the directive by the Commission EU
Notes · A comprehensive reform of the BSI Act (BSIG). The Commission had opened infringement proceedings over the delay.
Greece Transposed, in forceΝόμος 5160/2024 – Ενσωμάτωση της Οδηγίας (ΕΕ) 2022/2555 για μέτρα για υψηλό κοινό επίπεδο κυβερνοασφάλειας σε ολόκληρη την Ένωση
ΦΕΚ Α' 195/27.11.2024
Official source · Database entry		Competent authority, single point of contact and CSIRT: National Cybersecurity Authority, through its EL-CSIRT. The Defence GR-CSIRT and NCERT-GR are also members of the EU CSIRTs Network.27 November 20241 month late
9 milestones, 6 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 17 October 2024 · Transposition deadline for Member States EU
  3. 27 November 2024 · National law published National
  4. 27 November 2024 · National law enters into force National
  5. 17 April 2025 · Member States establish the list of essential and important entities EU
  6. 30 September 2025 · Extended deadline for entities to register on the National Cybersecurity Authority platform National
  7. 27 November 2026 · The law starts to apply to municipalities (first-level local authorities), after a one-year postponement National
  8. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  9. 17 October 2027 · First review of the directive by the Commission EU
Notes · In force from publication. The link points to the Gazette issue published by the National Cybersecurity Authority; the requirements framework is set by Decision 1689/2025. The registration deadline was extended to 30 September 2025 by Joint Decision 1990/2025 (Gazette B' 4241); Joint Decision 2267/2025 (Gazette B' 5472) postponed the application of the law to municipalities until 27 November 2026.
Hungary Transposed, in force2024. évi LXIX. törvény Magyarország kiberbiztonságáról
2024. évi LXIX. törvény
Official source · Database entry		Authorities: the Special Service for National Security (NBSZ), through its National Cyber Security Institute (NKI), as national authority; the Supervisory Authority for Regulated Activities (SZTFH) for the businesses listed in the Act; the Minister of Defence for defence. CSIRT: the NBSZ's national incident handling centre (NKI).1 January 20252 months late
9 milestones, 7 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 17 October 2024 · Transposition deadline for Member States EU
  3. 20 December 2024 · National law published National
  4. 1 January 2025 · National law enters into force National
  5. 17 April 2025 · Member States establish the list of essential and important entities EU
  6. 31 August 2025 · Deadline for entities operating before 2025 to sign a contract with a registered auditor National
  7. 30 June 2026 · Deadline for the first cybersecurity audit of entities operating before 2025 National
  8. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  9. 17 October 2027 · First review of the directive by the Commission EU
Notes · Replaces Act XXIII of 2023. Its personal scope was redrawn by later amendments in 2026.
Ireland Draft in preparationNational Cyber Security Bill (General Scheme, 2024)
Official source		Today, under the 2018 NIS 1 Regulations, sectoral competent authorities and the National Cyber Security Centre (NCSC); the General Scheme would put the NCSC on a statutory footing as national CSIRT and single point of contact. CSIRT: CSIRT-IE, within the NCSC.–24 months and still late
5 milestones, 3 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 17 October 2024 · Transposition deadline for Member States EU
  3. 17 April 2025 · Member States establish the list of essential and important entities EU
  4. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  5. 17 October 2027 · First review of the directive by the Commission EU
  6. National transposing law not yet in force
Notes · The General Scheme was published on 30 August 2024 and the Oireachtas Justice Committee completed pre-legislative scrutiny in February 2025. According to the National Cyber Security Strategy 2030 (October 2026), the Department of Justice is drafting the text with the Office of Parliamentary Counsel and the Attorney General; as of late October 2026 the bill has not yet been introduced in the Oireachtas. Referred to the Court of Justice on 8 July 2026. Meanwhile still in force: S.I. No. 360 of 2018.
Italy Transposed, in forceDecreto legislativo 4 settembre 2024, n. 138
D.Lgs. 138/2024
Official source · Database entry		National competent authority and single point of contact: National Cybersecurity Agency (ACN), with the sectoral authorities named in the decree. CSIRT: CSIRT Italia, within ACN.16 October 2024on time
10 milestones, 7 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 4 September 2024 · National law adopted National
  3. 16 October 2024 · National law enters into force National
  4. 17 October 2024 · Transposition deadline for Member States EU
  5. 28 February 2025 · Deadline for entities to register National
  6. 17 April 2025 · Member States establish the list of essential and important entities EU
  7. 15 January 2026 · Incident notification fully applicable National
  8. October 2026 · Deadline to implement security measures National
  9. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  10. 17 October 2027 · First review of the directive by the Commission EU
Notes · Transposed on time. The national competent authority is the National Cybersecurity Agency (ACN).
Latvia Transposed, in forceNacionālās kiberdrošības likums
Latvijas Vēstnesis, 128A, 04.07.2024
Official source · Database entry		Competent authority and single point of contact: National Cyber Security Centre, within the Ministry of Defence. CSIRT: CERT.LV.1 September 2024on time
9 milestones, 7 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 20 June 2024 · National law adopted National
  3. 1 September 2024 · National law enters into force National
  4. 17 October 2024 · Transposition deadline for Member States EU
  5. 1 April 2025 · Deadline for entities to register National
  6. 17 April 2025 · Member States establish the list of essential and important entities EU
  7. 1 October 2025 · Deadline for self-assessment and appointing a security manager National
  8. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  9. 17 October 2027 · First review of the directive by the Commission EU
Notes · It replaced the Information Technology Security Law and set up the National Cybersecurity Centre.
Lithuania Transposed, in forceKibernetinio saugumo įstatymo Nr. XII-1428 pakeitimo įstatymas
Nr. XIV-2902
Official source · Database entry		Competent authority, single point of contact and CSIRT: National Cyber Security Centre (NKSC), under the Ministry of National Defence, which runs CERT-LT.18 October 2024on time
7 milestones, 5 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 11 July 2024 · National law adopted National
  3. 17 October 2024 · Transposition deadline for Member States EU
  4. 18 October 2024 · National law enters into force National
  5. 17 April 2025 · Member States establish the list of essential and important entities EU
  6. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  7. 17 October 2027 · First review of the directive by the Commission EU
Notes · Transposed on time through a new version of the Cybersecurity Law; the link points to the consolidated text, last amended in 2026.
Luxembourg Transposed, in forceLoi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité
Mémorial A n° 225 de 2026
Official source · Database entry		Competent authority and single point of contact: Institut Luxembourgeois de Régulation (ILR); the CSSF for banking and financial market infrastructures. CSIRT: GOVCERT.LU for the public sector and CIRCL for the private sector.10 May 202618 months late
8 milestones, 6 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 17 October 2024 · Transposition deadline for Member States EU
  3. 17 April 2025 · Member States establish the list of essential and important entities EU
  4. 5 May 2026 · National law adopted National
  5. 10 May 2026 · National law enters into force National
  6. 10 July 2026 · Deadline for entities to register National
  7. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  8. 17 October 2027 · First review of the directive by the Commission EU
Notes · The authority is the Institut Luxembourgeois de Régulation (ILR), with the CSSF for the financial sector. The law transposing the CER Directive was adopted on the same day.
Malta Transposed, in forceMeasures for a High Common Level of Cybersecurity across the European Union (Malta) Order, 2025 (S.L. 460.41)
L.N. 71 of 2025
Official source · Database entry		Competent authorities: Critical Infrastructure Protection (CIP) Department and, for digital infrastructure and postal services, the Malta Communications Authority (MCA). CSIRT: CSIRTMalta, within MITA (designation updated by L.N. 89 of 2026).23 January 202615 months late
7 milestones, 5 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 17 October 2024 · Transposition deadline for Member States EU
  3. 8 April 2025 · National law published National
  4. 17 April 2025 · Member States establish the list of essential and important entities EU
  5. 23 January 2026 · National law enters into force National
  6. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  7. 17 October 2027 · First review of the directive by the Commission EU
Notes · Published on 8 April 2025, it came into force on 23 January 2026 by Legal Notice 22 of 2026; amended by Legal Notice 89 of 2026.
Netherlands Transposed, in forceCyberbeveiligingswet (Cbw)
Stb. 2026, 187
Official source · Database entry		Competent authorities: sectoral supervisors, including the Dutch Authority for Digital Infrastructure (RDI), the Human Environment and Transport Inspectorate (ILT), the Health and Youth Care Inspectorate (IGJ) and the central bank (DNB). Single point of contact: the Minister of Justice and Security. CSIRT: the National Cyber Security Centre (NCSC), also for municipalities, and sectoral CSIRTs such as Z-CERT for healthcare.15 August 202621 months late
9 milestones, 6 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 17 October 2024 · Transposition deadline for Member States EU
  3. 17 April 2025 · Member States establish the list of essential and important entities EU
  4. 8 July 2026 · National law adopted National
  5. 15 August 2026 · National law enters into force National
  6. 15 September 2026 · Deadline for setting up the national register of entities (one month after entry into force) National
  7. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  8. 17 October 2027 · First review of the directive by the Commission EU
  9. 15 August 2028 · Deadline for members of management bodies to have cybersecurity knowledge and skills National
Notes · It replaces the Wbni and entered into force together with the Critical Entities Resilience Act (Wwke). On 8 July 2026, before its adoption, the Commission had referred the Netherlands to the Court of Justice. The implementing decree (Cyberbeveiligingsbesluit, Stb. 2026, 189) set the entry into force at 15 August 2026 and specifies the risk-management measures, management training and the information for the register; it repeals the decree on the security of network and information systems (Bbni).
Poland Transposed, in forceUstawa z dnia 23 stycznia 2026 r. o zmianie ustawy o krajowym systemie cyberbezpieczeństwa oraz niektórych innych ustaw
Dz.U. 2026 poz. 252
Official source · Database entry		Competent authorities: sectoral ministers and, for finance, the Financial Supervision Authority (KNF). Single point of contact: the minister for digital affairs. National CSIRTs: CSIRT NASK (CERT Polska), CSIRT GOV (Internal Security Agency) and CSIRT MON (Defence), plus sectoral CSIRTs.3 April 202617 months late
10 milestones, 6 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 17 October 2024 · Transposition deadline for Member States EU
  3. 17 April 2025 · Member States establish the list of essential and important entities EU
  4. 23 January 2026 · National law adopted National
  5. 3 April 2026 · National law enters into force National
  6. 3 October 2026 · Deadline for entities to register National
  7. 3 April 2027 · Deadline to implement security measures National
  8. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  9. 17 October 2027 · First review of the directive by the Commission EU
  10. 3 April 2028 · Deadline for the first audit of essential entities; from this date fines can be imposed National
Notes · Transposed by amending the 2018 National Cybersecurity System Act (KSC). The President referred the provisions on high-risk suppliers to the Constitutional Tribunal. Entities already in scope must apply the security and incident-handling measures within 12 months of entry into force; essential entities must carry out their first audit within 24 months, and fines can only be imposed from then on.
Portugal Transposed, in forceDecreto-Lei n.º 125/2025 – Regime jurídico da cibersegurança
Decreto-Lei n.º 125/2025
Official source · Database entry		National authority, single point of contact and CSIRT: National Cybersecurity Centre (CNCS), which runs CERT.PT, with sectoral authorities for some areas.3 April 202617 months late
8 milestones, 5 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 17 October 2024 · Transposition deadline for Member States EU
  3. 17 April 2025 · Member States establish the list of essential and important entities EU
  4. 5 November 2025 · National law adopted National
  5. 3 April 2026 · National law enters into force National
  6. 3 April 2027 · End of the grace period on fines National
  7. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  8. 17 October 2027 · First review of the directive by the Commission EU
Notes · In force 120 days after publication; it replaces Decree-Law 65/2021. The CNCS set out its implementation in Regulation 756/2026. The obligations on cybersecurity measures (Articles 27(1) and (2), 28 to 30 and 33 of the regime) and the related penalties take effect 24 months after the CNCS rules are published (Article 10(2) of the decree-law).
Romania Transposed, in forceOrdonanța de urgență a Guvernului nr. 155/2024 privind instituirea unui cadru pentru securitatea cibernetică a rețelelor și sistemelor informatice din spațiul cibernetic național civil
OUG 155/2024 (Monitorul Oficial nr. 1332 din 31.12.2024)
Official source · Database entry		Competent authority, single point of contact and national CSIRT: National Cyber Security Directorate (DNSC), with sectoral authorities for some areas.31 December 20242 months late
8 milestones, 6 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 17 October 2024 · Transposition deadline for Member States EU
  3. 30 December 2024 · National law adopted National
  4. 31 December 2024 · National law enters into force National
  5. 17 April 2025 · Member States establish the list of essential and important entities EU
  6. 22 September 2025 · Deadline for entities to register National
  7. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  8. 17 October 2027 · First review of the directive by the Commission EU
Notes · The ordinance was approved with amendments by Law 124/2025, in force since 10 July 2025; the authority is DNSC. The consolidated text is on the Ministry of Justice legislation portal.
Slovakia Transposed, in forceZákon, ktorým sa mení a dopĺňa zákon č. 69/2018 Z. z. o kybernetickej bezpečnosti
366/2024 Z. z.
Official source · Database entry		Competent authority and single point of contact: National Security Authority (NBÚ). CSIRT: SK-CERT, NBÚ's national CSIRT, and CSIRT.SK for public administration.1 January 20252 months late
8 milestones, 5 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 17 October 2024 · Transposition deadline for Member States EU
  3. 28 November 2024 · National law adopted National
  4. 1 January 2025 · National law enters into force National
  5. 17 April 2025 · Member States establish the list of essential and important entities EU
  6. 31 December 2026 · End of the transitional period for previously designated operators (security measures and audits under the previous rules) National
  7. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  8. 17 October 2027 · First review of the directive by the Commission EU
Notes · Transposed by amending Act 69/2018 on cybersecurity; the authority is the National Security Authority (NBÚ).
Slovenia Transposed, in forceZakon o informacijski varnosti (ZInfV-1)
Uradni list RS, št. 40/2025
Official source · Database entry		Competent authority and single point of contact: Government Information Security Office (URSIV). CSIRT: SI-CERT, within the academic network Arnes, and SIGOV-CERT for government bodies.19 June 20258 months late
10 milestones, 7 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 17 October 2024 · Transposition deadline for Member States EU
  3. 17 April 2025 · Member States establish the list of essential and important entities EU
  4. 23 May 2025 · National law adopted National
  5. 19 June 2025 · National law enters into force National
  6. 19 December 2025 · Deadline for entities to register National
  7. 19 June 2026 · Deadline for risk-management measures of former operators of essential services, state bodies and electronic communications operators National
  8. 19 December 2026 · Deadline to implement security measures National
  9. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  10. 17 October 2027 · First review of the directive by the Commission EU
Notes · The Official Gazette describes it as a partial transposition; the authority is the Government Information Security Office (URSIV).
Spain Draft in preparationAnteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad
Preliminary draft Law on Cybersecurity Coordination and Governance
Official source		Today, under Royal Decree-Law 12/2018: sectoral competent authorities, with the Department of National Security as single point of contact; reference CSIRTs INCIBE-CERT, CCN-CERT and ESPDEF-CERT. The draft bill would create a National Cybersecurity Centre.–24 months and still late
6 milestones, 4 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 17 October 2024 · Transposition deadline for Member States EU
  3. 14 January 2025 · National law adopted National
  4. 17 April 2025 · Member States establish the list of essential and important entities EU
  5. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  6. 17 October 2027 · First review of the directive by the Commission EU
  7. National transposing law not yet in force
Notes · The draft was approved at first reading by the Council of Ministers on 14 January 2025 but was never sent to the Cortes. On 6 October 2026 the Cortes were dissolved (Royal Decree 806/2026) with elections on 29 November 2026, so the bill can only be tabled in the new legislature; meanwhile Royal Decree-Law 12/2018 remains in force. Referred to the Court of Justice on 8 July 2026. Meanwhile still in force: Real Decreto-ley 12/2018.
Sweden Transposed, in forceCybersäkerhetslag
SFS 2025:1506
Official source · Database entry		Supervisory authorities: sectoral, including the Energy Agency, the Transport Agency, Finansinspektionen, the Post and Telecom Authority (PTS) and some county administrative boards. Single point of contact and CSIRT: the National Defence Radio Establishment (FRA), through the National Cyber Security Centre, which includes CERT-SE.15 January 202614 months late
10 milestones, 8 already passed
  1. 16 January 2023 · Directive enters into force EU
  2. 17 October 2024 · Transposition deadline for Member States EU
  3. 17 April 2025 · Member States establish the list of essential and important entities EU
  4. 11 December 2025 · National law adopted National
  5. 15 January 2026 · National law enters into force National
  6. 2 February 2026 · Rules on the notification and identification of essential and important entities take effect (MCFFS 2026:1) National
  7. 1 July 2026 · Rules on incident reporting and information duties take effect (MCFFS 2026:8) National
  8. 1 October 2026 · Rules on security measures and management training (MCFFS 2026:11) and on security audits (MCFFS 2026:12) take effect National
  9. 17 April 2027 · First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission EU
  10. 17 October 2027 · First review of the directive by the Commission EU
Notes · It repeals Act 2018:1174 on information security for essential and digital services; accompanied by Ordinance 2025:1507.

Authorities and CSIRTs checked on 29 October 2026 against national laws and the list of EU CSIRTs Network members.

European Commission infringement proceedings

  1. 28 November 2024 · Letters of formal notice: 23 Member States (Bulgaria, Czechia, Denmark, Germany, Estonia, Ireland, Greece, Spain, France, Cyprus, Latvia, Luxembourg, Hungary, Malta, Netherlands, Austria, Poland, Portugal, Romania, Slovenia, Slovakia, Finland, Sweden)
  2. 7 May 2025 · Reasoned opinions: 19 Member States (Bulgaria, Czechia, Denmark, Germany, Estonia, Ireland, Spain, France, Cyprus, Latvia, Luxembourg, Hungary, Netherlands, Austria, Poland, Portugal, Slovenia, Finland, Sweden)
  3. 8 July 2026 · Referral to the EU Court of Justice: 4 Member States (Ireland, Spain, France, Netherlands)

Data checked against official sources on 29 October 2026. The text published in each Member State’s official journal always prevails.

Open data: JSON · CSV · CC BY 4.0