NIS2 in the 27 Member States
Where the law is in force, the checker applies it. Where only a bill exists, the checker applies the Directive.
- Law in force
- Bill, not law yet
- 24 Law in force
- 3 Bill, not law yet
Choose a country on the map or in the table. Cloud, data centre, managed service and online platform providers answer to the country of their main EU establishment.
Bills, not law yet
Every country, side by side
| Country | Law | In force | Registration | ISO 27001 |
|---|---|---|---|---|
| Austria | NISG 2026 | 2026-10-01 | 2026-12-31 for entities in scope at the start; 3 months after you come into scope | Accepted as proof |
| Belgium | NIS2 Law | 2024-10-18 | By 2025-03-18 | Presumption of conformity |
| Bulgaria | Cybersecurity Act | 2026-02-16 | The authority names you | Not named in the law |
| Croatia | Cybersecurity Act | 2024-02-15 | The authority names you | Not named in the law |
| Cyprus | NIS Law 89(I)/2020 | 2025-04-25 | As soon as you are in scope | Not named in the law |
| Czechia | Cybersecurity Act | 2025-11-01 | By 2025-12-31 | Helps, not enough alone |
| Denmark | NIS 2 Act | 2025-07-01 | 2025-10-01 for entities in scope at the start; 14 days after you come into scope | Helps, not enough alone |
| Estonia | KüTS | 2026-01-01 | 2026-04-01 for entities in scope at the start; 3 months after you come into scope | Presumption of conformity |
| Finland | Kyberturvallisuuslaki | 2025-04-08 | 2025-05-08 for entities in scope at the start; 1 month after you come into scope | Not named in the law |
| France | Résilience bill | Bill, not law yet | No legal deadline yet | Helps, not enough alone |
| Germany | BSIG | 2025-12-06 | 2026-03-06 for entities in scope at the start; 3 months after you come into scope | Helps, not enough alone |
| Greece | Law 5160/2024 | 2024-11-27 | By 2025-09-30 | Not named in the law |
| Hungary | Kiberbiztonsági tv. | 2025-01-01 | 30 days after you come into scope | Helps, not enough alone |
| Ireland | National Cyber Security Bill | Bill, not law yet | No date set yet | Helps, not enough alone |
| Italy | D.Lgs. 138/2024 | 2024-10-16 | Every year, 01/01 to 02/28 (month/day) | Helps, not enough alone |
| Latvia | NKDL | 2024-09-01 | 2025-04-01 for entities in scope at the start; 1 month after you come into scope | Not named in the law |
| Lithuania | KSĮ | 2024-10-18 | By 2025-04-17 | Helps, not enough alone |
| Luxembourg | NIS 2 Act | 2026-05-10 | By 2026-07-10 | Not named in the law |
| Malta | L.N. 71/2025 (S.L. 460.41) | 2026-01-23 | As soon as you are in scope | Not named in the law |
| Netherlands | Cbw | 2026-08-15 | By 2026-08-15 | Helps, not enough alone |
| Poland | KSC Act | 2026-04-03 | 2026-10-03 for entities in scope at the start; 6 months after you come into scope | Not named in the law |
| Portugal | DL 125/2025 (RJC) | 2026-04-03 | 30 days after you come into scope | Presumption of conformity |
| Romania | OUG 155/2024 | 2024-12-31 | 30 days after you come into scope | Not named in the law |
| Slovakia | Act 69/2018 | 2025-01-01 | 60 days after you come into scope | Not named in the law |
| Slovenia | ZInfV-1 | 2025-06-19 | 2025-12-19 for entities in scope at the start; 30 days after you come into scope | Helps, not enough alone |
| Spain | Cybersecurity Coordination Law (draft) | Bill, not law yet | 3 months after you come into scope | Helps, not enough alone |
| Sweden | Cybersäkerhetslagen | 2026-01-15 | As soon as you are in scope | Not named in the law |