NIS2 Member State Tracker.

Law:

Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026)

Enacted:

—

In force:

2026-10-01

Authority:

Bundesministerium für Inneres (BMI) + Bundeskanzleramt

Registration:

Register by about 31 December 2026; check the national law for the exact deadline

Essential fines:

€10M or 2% worldwide turnover

Important fines:

€7M or 1.4% worldwide turnover

Management:

Explicit personal liability + mandatory training

Austria missed the October 2024 deadline. The NISG 2026 entered into force on 1 October 2026. Entities must register by about 31 December 2026.

Law:

Loi du 26 avril 2024 sur la cybersécurité / Wet van 26 april 2024 inzake cyberbeveiliging

Enacted:

2024-04-26

In force:

2024-10-18

Authority:

Centre pour la Cybersécurité Belgique (CCB) / Centrum voor Cybersecurity België

Registration:

Check the national law

Essential fines:

€10M or 2%

Important fines:

€7M or 1.4%

Management:

Personal liability + training obligation

The Belgian NIS2 law of 26 April 2024 entered into force on 18 October 2024. The CCB is the national authority.

Law:

Check the national law

Enacted:

—

In force:

—

Authority:

State Agency for Electronic Governance + National CSIRT

Registration:

Check the national law

Essential fines:

€10M or 2%

Important fines:

€7M or 1.4%

Management:

Personal liability clause

Matproof has not verified the transposition status as of November 2026. Check the national law and the national cybersecurity authority.

Law:

Check the national law

Enacted:

—

In force:

—

Authority:

Središnji državni ured za razvoj digitalnog društva (SDURDD)

Registration:

Check the national law

Essential fines:

€10M or 2%

Important fines:

€7M or 1.4%

Management:

Personal liability explicit

Matproof has not verified the transposition status as of November 2026. Check the national law and the national cybersecurity authority.

Law:

Check the national law

Enacted:

—

In force:

—

Authority:

Digital Security Authority (DSA) + Commissioner of Communications

Registration:

Check the national law

Essential fines:

€10M or 2% worldwide turnover

Important fines:

€7M or 1.4% worldwide turnover

Management:

Personal liability + training obligation

Matproof has not verified the transposition status as of November 2026. Check the national law and the national cybersecurity authority.

Law:

Check the national law

Enacted:

—

In force:

—

Authority:

Národní úřad pro kybernetickou a informační bezpečnost (NÚKIB)

Registration:

Check the national law

Essential fines:

€10M or 2%

Important fines:

€7M or 1.4%

Management:

Personal liability explicit

Matproof has not verified the transposition status as of November 2026. Check the national law and the national cybersecurity authority.

Law:

Check the national law

Enacted:

—

In force:

—

Authority:

Center for Cybersikkerhed (CFCS) under Danish Defence Intelligence Service

Registration:

Check the national law

Essential fines:

€10M or 2%

Important fines:

€7M or 1.4%

Management:

Personal liability + training

Matproof has not verified the transposition status as of November 2026. Check the national law and the national cybersecurity authority.

Law:

Check the national law

Enacted:

—

In force:

—

Authority:

Riigi Infosüsteemi Amet (RIA)

Registration:

Check the national law

Essential fines:

€10M or 2%

Important fines:

€7M or 1.4%

Management:

Personal liability clause

Matproof has not verified the transposition status as of November 2026. Check the national law and the national cybersecurity authority.

Law:

Kyberturvallisuuslaki (Cybersecurity Act)

Enacted:

—

In force:

2025-04-08

Authority:

Kyberturvallisuuskeskus (Traficom / NCSC-FI)

Registration:

Check the national law

Essential fines:

€10M or 2%

Important fines:

€7M or 1.4%

Management:

Personal liability

Finland missed the October 2024 deadline. The Cybersecurity Act entered into force on 8 April 2025. Traficom (NCSC-FI) is the national authority.

Law:

Projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité (not adopted)

Enacted:

—

In force:

—

Authority:

Agence nationale de la sécurité des systèmes d'information (ANSSI)

Registration:

No national law in force yet

Essential fines:

€10M or 2%

Important fines:

€7M or 1.4%

Management:

Personal liability explicit; ANSSI can sanction management individually

As of November 2026, France has no NIS2 law in force. The Senate adopted the Résilience bill in March 2025. The National Assembly has not adopted it. The Commission referred France to the CJEU on 8 July 2026.

Law:

NIS2-Umsetzungs- und Cybersicherheitsstärkungsgesetz (NIS2UmsuCG)

Enacted:

2025-11-20

In force:

2025-12-06

Authority:

Bundesamt für Sicherheit in der Informationstechnik (BSI) + sectoral authorities

Registration:

3 months after scope trigger; BSI registration window closed 2026-03-06

Essential fines:

€10M or 2% worldwide turnover

Important fines:

€7M or 1.4% worldwide turnover

Management:

§ 38 BSIG-neu: personal liability + training obligation

Germany missed the October 2024 transposition deadline. After the Ampel coalition collapse the draft fell to parliamentary discontinuity; the successor coalition re-introduced it and the Bundestag passed NIS2UmsuCG on 13 November 2025, the Bundesrat on 20 November 2025, and it was promulgated in the BGBl on 6 December 2025. In force since 6 December 2025; no transition period. BSI registration deadline 6 March 2026.

Law:

Check the national law

Enacted:

—

In force:

—

Authority:

National Cybersecurity Authority (formerly National Cybersecurity Directorate)

Registration:

Check the national law

Essential fines:

€10M or 2%

Important fines:

€7M or 1.4%

Management:

Personal liability

Matproof has not verified the transposition status as of November 2026. Check the national law and the national cybersecurity authority.

Law:

Check the national law

Enacted:

—

In force:

—

Authority:

Nemzeti Kiberbiztonsági Intézet (National Cybersecurity Institute)

Registration:

Check the national law

Essential fines:

€10M or 2%

Important fines:

€7M or 1.4%

Management:

Personal liability clause

Matproof has not verified the transposition status as of November 2026. Check the national law and the national cybersecurity authority.

Law:

National Cyber Security Bill (in progress)

Enacted:

—

In force:

—

Authority:

National Cyber Security Centre (NCSC) of Ireland

Registration:

No national law in force yet

Essential fines:

€10M or 2%

Important fines:

€7M or 1.4%

Management:

Personal liability + director-level training

As of November 2026, Ireland has no NIS2 law in force. The bill is still in progress. The Commission referred Ireland to the CJEU on 8 July 2026.

Law:

Decreto legislativo 4 settembre 2024, n. 138 (recepimento NIS2)

Enacted:

2024-09-04

In force:

2024-10-16

Authority:

Agenzia per la Cybersicurezza Nazionale (ACN)

Registration:

Check the national law

Essential fines:

€10M or 2%

Important fines:

€7M or 1.4%

Management:

Personal liability; training obligation documented

Italy transposed NIS2 with D.Lgs. 138/2024. It entered into force on 16 October 2024. ACN is the national authority.

Law:

Check the national law

Enacted:

—

In force:

—

Authority:

Latvijas Informācijas un komunikāciju tehnoloģiju asociācija (CERT.LV) + Cabinet

Registration:

Check the national law

Essential fines:

€10M or 2%

Important fines:

€7M or 1.4%

Management:

Personal liability

Matproof has not verified the transposition status as of November 2026. Check the national law and the national cybersecurity authority.

Law:

Check the national law

Enacted:

—

In force:

—

Authority:

Nacionalinis kibernetinio saugumo centras (NKSC)

Registration:

Check the national law

Essential fines:

€10M or 2%

Important fines:

€7M or 1.4%

Management:

Personal liability

Matproof has not verified the transposition status as of November 2026. Check the national law and the national cybersecurity authority.

Law:

Check the national law

Enacted:

—

In force:

—

Authority:

Haut-Commissariat à la Protection Nationale (HCPN) + ILR + CSSF for financial

Registration:

Check the national law

Essential fines:

€10M or 2%

Important fines:

€7M or 1.4%

Management:

Personal liability

Matproof has not verified the transposition status as of November 2026. Check the national law and the national cybersecurity authority.

Law:

Check the national law

Enacted:

—

In force:

—

Authority:

Malta Communications Authority (MCA) + Malta Digital Innovation Authority (MDIA)

Registration:

Check the national law

Essential fines:

€10M or 2%

Important fines:

€7M or 1.4%

Management:

Personal liability

Matproof has not verified the transposition status as of November 2026. Check the national law and the national cybersecurity authority.

Law:

Cyberbeveiligingswet (Cbw)

Enacted:

—

In force:

2026-08-15

Authority:

Nationaal Cyber Security Centrum (NCSC-NL) + sectoral supervisors

Registration:

Register via MijnNCSC

Essential fines:

€10M or 2%

Important fines:

€7M or 1.4%

Management:

Personal liability + mandatory training

The Netherlands missed the October 2024 deadline. The Cyberbeveiligingswet replaced the Wbni and entered into force on 15 August 2026. The Commission referred the Netherlands to the CJEU on 8 July 2026, before the law entered into force.

Law:

Ustawa z dnia 23 stycznia 2026 r. o zmianie ustawy o krajowym systemie cyberbezpieczeństwa (UKSC2)

Enacted:

2026-02-19

In force:

2026-04-03

Authority:

Ministerstwo Cyfryzacji + CSIRT NASK + sectoral CSIRTs

Registration:

12 months after meeting threshold criteria; first audit at 24 months for key entities

Essential fines:

€10M or 2% worldwide turnover

Important fines:

€7M or 1.4% worldwide turnover

Management:

Personal liability; mandatory training

Poland missed the October 2024 deadline. Parliament adopted the amendment to the national cybersecurity system act (UKSC) as the law of 23 January 2026. It entered into force on 3 April 2026.

Law:

Check the national law

Enacted:

—

In force:

—

Authority:

Centro Nacional de Cibersegurança (CNCS)

Registration:

Check the national law

Essential fines:

€10M or 2%

Important fines:

€7M or 1.4%

Management:

Personal liability

Matproof has not verified the transposition status as of November 2026. Check the national law and the national cybersecurity authority.

Law:

Check the national law

Enacted:

—

In force:

—

Authority:

Direcția Națională de Securitate Cibernetică (DNSC)

Registration:

Check the national law

Essential fines:

€10M or 2%

Important fines:

€7M or 1.4%

Management:

Personal liability

Matproof has not verified the transposition status as of November 2026. Check the national law and the national cybersecurity authority.

Law:

Check the national law

Enacted:

—

In force:

—

Authority:

Národný bezpečnostný úrad (NBÚ)

Registration:

Check the national law

Essential fines:

€10M or 2%

Important fines:

€7M or 1.4%

Management:

Personal liability

Matproof has not verified the transposition status as of November 2026. Check the national law and the national cybersecurity authority.

Law:

Check the national law

Enacted:

—

In force:

—

Authority:

Uprava Republike Slovenije za informacijsko varnost (URSIV)

Registration:

Check the national law

Essential fines:

€10M or 2%

Important fines:

€7M or 1.4%

Management:

Personal liability

Matproof has not verified the transposition status as of November 2026. Check the national law and the national cybersecurity authority.

Law:

Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad (draft)

Enacted:

—

In force:

—

Authority:

Centro Criptológico Nacional (CCN-CERT) + sectoral

Registration:

No national law in force yet

Essential fines:

€10M or 2%

Important fines:

€7M or 1.4%

Management:

Personal liability; INCIBE coordinates for private sector

As of November 2026, Spain has no NIS2 law in force. The government approved the draft law on 14 January 2025. The Commission referred Spain to the CJEU on 8 July 2026.

Law:

Cybersäkerhetslag (Cybersecurity Act)

Enacted:

—

In force:

2026-01-15

Authority:

Myndigheten för samhällsskydd och beredskap (MSB) + sectoral

Registration:

Check the national law

Essential fines:

€10M or 2%

Important fines:

€7M or 1.4%

Management:

Personal liability explicit

Sweden missed the October 2024 deadline. The Cybersecurity Act entered into force on 15 January 2026.