NIS2 in Denmark

The law

The NIS 2 Act took effect on 2025-07-01. Lov nr. 434 is dated 2025-05-06. Energy, telecom and finance entities fall under separate laws. Several sector authorities supervise the Act.

Name

Lov om foranstaltninger til sikring af et højt cybersikkerhedsniveau (NIS 2-loven), lov nr. 434 af 6. maj 2025Act on measures to ensure a high level of cybersecurity (NIS 2 Act)

Published

2025-05-06

In force

2025-07-01

Text

Read the NIS 2 Act

Who is in scope

Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.

Where Denmark differs

• Explanatory notes to § 4-5 NIS 2 Act The ministry says an entity can fall outside the Act when its partner and linked companies would lift it over the medium-size ceilings but the entity is independent. The test uses the independence of its systems and services. The authority decides case by case.
• § 1(2) NIS 2 Act The Act does not apply to energy entities and telecom entities that fall under their own laws. It also does not apply to entities that the finance act designates under § 333(1).
• § 5(2) NIS 2 Act The competent authority can decide that an entity of any size, which an Article 3 criterion would make essential, counts as important.

Also note

• Each sector has its own authority. The Agency for Digital Government covers digital infrastructure, managed service providers, online platforms and trust services. The Danish Agency for Resilience covers several other sectors.
• Each sector has its own authority. A company in several sectors registers once and selects all sectors. The form goes to each authority.
• The self-check tool does not cover telecom, energy and finance entities, because separate laws apply to them.
• Managed service and managed security service providers report to the Agency for Digital Government.

Registration

Entities in scope on 2025-07-01 had to register by 2025-10-01. An entity that comes into scope later has 2 weeks from that day. The providers that § 9 names have 3 months. § 9 lists 11 types, such as DNS, cloud, data centre and managed service providers. All filings go through the digital form on Virk.dk.

Portal

Virk.dk NIS 2 registration form

Rule

Deadline counts from the day you come into scope

Deadline

2025-10-01

Later entrants

14 days after the rules first apply to you

You need

MitID Erhverv for the person who files. A foreign entity that cannot get a Danish digital signature can ask the authority for an exemption.

Changes

Report changes to your data within 14 days

Incident reporting

1. 24 hEarly warning
2. 72 hIncident notification
3. 1 monthFinal reportafter the notification

Send the reports to the competent authority and the CSIRT.

Trust service providers send the 72-hour notification within 24 hours. The report goes through the same Virk.dk channel as the registration.

Measures and proof

Essential

The authority supervises essential entities in advance. It can run regular and targeted security audits. It can also require a qualified independent body to audit and to send the results to the authority.

Important

The authority supervises important entities after the fact. It acts only on indications that the entity breaks the Act. It can then run targeted security audits or require an independent audit.

The dates, in order

1. 2025-07-01 The NIS 2 Act takes effect
2. 2025-10-01 First registration deadline

Duties of management

The management body approves the security measures and supervises their implementation. Members of the management body must attend courses on cybersecurity risk. For essential entities, the authority can ban a chief executive or legal representative from managerial functions for a time. It can do so when other measures fail.

Fines

The ceiling is the higher of a fixed amount and a share of the annual turnover of the entity itself.

The Act sets no ceiling: the figures come from the explanatory notes to the bill, which expect the Directive minimum of EUR 10 million or 2% and EUR 7 million or 1.4%. The Act says only "bøde", and courts impose fines in the criminal system. The notes name the entity's total global turnover. The Act sets no ceiling for other breaches.