{"meta":{"source":"https://ecs-org.eu/nis2-tracker/","source_last_updated":"2026-09-10","fetched":"2026-10-28","ecso_headline":"24 out of 27 EU Member States have transposed the NIS2 Directive into national law (per ECSO, counting primary laws).","updated":"2026-10-28"},"countries":[{"code":"AT","country":"Austria","eu_member":true,"status":"transposed","status_label":"Transposed","transposition_date":"2025-12-23","entry_into_force":"2026-10-01","date_raw":"23/12/2025 (Enters into force on 01/10/2026)","national_law":"Network and Information System Security Act 2026","official_texts":[{"title":"Final text","url":"https://www.ris.bka.gv.at/eli/bgbl/I/2025/94/20251223?ResultFunctionToken=51a365ea-d819-4ac2-8f0b-0827c83ec90c&Abfrage=Gesamtabfrage&SearchInAsylGH=&SearchInAvn=&SearchInAvsv=&SearchInBegut=&SearchInBgblAlt=&SearchInBgblAuth=&SearchInBgblPdf=&SearchInBks=&SearchInBundesnormen=&SearchInBvb=&SearchInBvwg=&SearchInDok=&SearchInDsk=&SearchInErlaesse=&SearchInGbk=&SearchInGemeinderecht=&SearchInGemeinderechtAuth=&SearchInJustiz=&SearchInKmGer=&SearchInLandesnormen=&SearchInLvwg=&SearchInLgbl=&SearchInLgblNO=&SearchInLgblAuth=&SearchInMrp=&SearchInNormenliste=&SearchInPruefGewO=&SearchInPvak=&SearchInRegV=&SearchInSpg=&SearchInUbas=&SearchInUmse=&SearchInUpts=&SearchInUvs=&SearchInVbl=&SearchInVerg=&SearchInVfgh=&SearchInVwgh=&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=&ResultPageSize=100&Suchworte=EU+2022%2f2555"}],"commission":{"reasoned_opinion_2025_05_07":true,"cjeu_referral_2026_07_08":false},"notes":[{"text":"Resolved 28 Oct 2026: Bundesamt für Cybersicherheit confirms registration via USP from 1 Oct 2026 to 31 Dec 2026 (the ECSO record contained conflicting dates).","source":"https://www.bundesamt-cybersicherheit.gv.at/faq/registrierung.html"}],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive","https://www.bundesamt-cybersicherheit.gv.at/faq/registrierung.html"],"last_verified":"2026-10-28","verification":"secondary-source","verification_notes":[]},{"code":"BE","country":"Belgium","eu_member":true,"status":"transposed","status_label":"Transposed","transposition_date":"2024-04-26","entry_into_force":"2024-10-18","date_raw":"26/04/2024 (Entered into force on 18/10/2024)","national_law":"Law of April 26, 2024 establishing a framework for the cybersecurity of networks and information systems of general interest for public security implemented by the Royal Decree of June 9, 2024.","official_texts":[{"title":"Final text","url":"https://www.ejustice.just.fgov.be/cgi/article.pl?language=fr&sum_date=2024-05-17&lg_txt=f&caller=sum&s_editie=1&2024202344=4&numac_search=2024202344&view_numac=2024202344f"},{"title":"Royal Decree","url":"https://www.ejustice.just.fgov.be/eli/arrete/2024/06/09/2024005260/justel"}],"commission":{"reasoned_opinion_2025_05_07":false,"cjeu_referral_2026_07_08":false},"notes":[{"text":"National framework CyFun (CyberFundamentals) is based on NIST CSF, ISO 27001/27002, CIS Controls and IEC 62443; conformity assessed by accredited bodies.","source":"https://ecs-org.eu/nis2-tracker/"}],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive"],"last_verified":"2026-10-28","verification":"secondary-source","verification_notes":[]},{"code":"BG","country":"Bulgaria","eu_member":true,"status":"transposed","status_label":"Transposed","transposition_date":"2026-02-05","entry_into_force":null,"date_raw":"05/02/2026","national_law":null,"official_texts":[{"title":"Final Text","url":"https://dv.parliament.bg/DVWeb/showMaterialDV.jsp;jsessionid=32EE822873F44A3C848F5091764CBE63?idMat=241234"}],"commission":{"reasoned_opinion_2025_05_07":true,"cjeu_referral_2026_07_08":false},"notes":[],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive"],"last_verified":"2026-10-28","verification":"secondary-source","verification_notes":[]},{"code":"HR","country":"Croatia","eu_member":true,"status":"transposed","status_label":"Transposed","transposition_date":"2024-02-15","entry_into_force":null,"date_raw":"15/02/2024","national_law":"Regulation on Cybersecurity","official_texts":[{"title":"Primary Law","url":"https://narodne-novine.nn.hr/clanci/sluzbeni/2024_02_14_254.html"},{"title":"Implementing Act","url":"https://narodne-novine.nn.hr/clanci/sluzbeni/2024_11_135_2217.html"}],"commission":{"reasoned_opinion_2025_05_07":false,"cjeu_referral_2026_07_08":false},"notes":[{"text":"Tiered risk assessment model must cover IT/OT systems; essential entities audited every two years.","source":"https://ecs-org.eu/nis2-tracker/"}],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive"],"last_verified":"2026-10-28","verification":"secondary-source","verification_notes":[]},{"code":"CY","country":"Cyprus","eu_member":true,"status":"transposed","status_label":"Transposed","transposition_date":"2025-04-25","entry_into_force":null,"date_raw":"25/04/2025","national_law":"The Security of Networks and Information Systems (Amendment) Law of 2025, (Law 60(I)/2025) amending The Security of Networks and Information Systems Law of 2020, (Law 89(I)/2020)","official_texts":[{"title":"Primary Law","url":"https://dsa.cy/images/pdf-upload/DSA-Law-60-I-2025.pdf"}],"commission":{"reasoned_opinion_2025_05_07":true,"cjeu_referral_2026_07_08":false},"notes":[{"text":"Early warning required within 6 hours (stricter than NIS2 24h).","source":"https://ecs-org.eu/nis2-tracker/"}],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive"],"last_verified":"2026-10-28","verification":"secondary-source","verification_notes":[]},{"code":"CZ","country":"Czechia","eu_member":true,"status":"transposed","status_label":"Transposed","transposition_date":"2025-08-04","entry_into_force":"2025-11-01","date_raw":"04/08/2025 (Enters into force on 01/11/2025)","national_law":"Cybersecurity Act / Act No. 264/2025","official_texts":[{"title":"Final Text","url":"https://www.e-sbirka.cz/sb/2025/264?zalozka=text"}],"commission":{"reasoned_opinion_2025_05_07":true,"cjeu_referral_2026_07_08":false},"notes":[{"text":"Incident reporting starts 1 year after receipt of registration confirmation; scope adds defence industry.","source":"https://ecs-org.eu/nis2-tracker/"}],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive"],"last_verified":"2026-10-28","verification":"secondary-source","verification_notes":[]},{"code":"EE","country":"Estonia","eu_member":true,"status":"transposed","status_label":"Transposed","transposition_date":"2025-12-30","entry_into_force":"2026-01-01","date_raw":"30/12/2025 (entered into force 01/01/2026)","national_law":"Amendment of the Cybersecurity Act","official_texts":[{"title":"Law","url":"https://www.riigiteataja.ee/akt/130122025015"}],"commission":{"reasoned_opinion_2025_05_07":true,"cjeu_referral_2026_07_08":false},"notes":[],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive"],"last_verified":"2026-10-28","verification":"secondary-source","verification_notes":[]},{"code":"FI","country":"Finland","eu_member":true,"status":"transposed","status_label":"Transposed","transposition_date":"2025-04-04","entry_into_force":"2025-04-08","date_raw":"Adopted on 04/04/2025; Entered into force on 08/04/2025","national_law":"Cybersecurity Law","official_texts":[{"title":"Final Text","url":"https://valtioneuvosto.fi/paatokset/paatos?decisionId=3531"}],"commission":{"reasoned_opinion_2025_05_07":true,"cjeu_referral_2026_07_08":false},"notes":[],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive"],"last_verified":"2026-10-28","verification":"secondary-source","verification_notes":[]},{"code":"FR","country":"France","eu_member":true,"status":"draft","status_label":"Draft Law","transposition_date":null,"entry_into_force":null,"date_raw":"N/A","national_law":null,"official_texts":[{"title":"Draft Law","url":"https://www.senat.fr/dossier-legislatif/pjl24-033.html"}],"commission":{"reasoned_opinion_2025_05_07":true,"cjeu_referral_2026_07_08":true},"notes":[{"text":"France is folding NIS2 into a Critical Infrastructure Resilience Bill; ANSSI developing its own measures framework.","source":"https://ecs-org.eu/nis2-tracker/"},{"text":"Referred to the CJEU on 8 Jul 2026 for failing to notify transposition measures.","source":"https://digital-strategy.ec.europa.eu/en/news/commission-refers-ireland-spain-france-and-netherlands-court-justice-failing-transpose-rules"}],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive","https://digital-strategy.ec.europa.eu/en/news/commission-refers-ireland-spain-france-and-netherlands-court-justice-failing-transpose-rules"],"last_verified":"2026-10-28","verification":"needs-verification","verification_notes":["Draft status as of ECSO update 10 Sep 2026; check national legislature for progress since."]},{"code":"DE","country":"Germany","eu_member":true,"status":"transposed","status_label":"Transposed","transposition_date":"2025-12-05","entry_into_force":"2025-12-06","date_raw":"05/12/2025","national_law":"Law implementing the NIS-2 Directive and regulating essential principles of information security management in the federal administration","official_texts":[{"title":"Final Text","url":"https://www.recht.bund.de/bgbl/1/2025/301/VO"}],"commission":{"reasoned_opinion_2025_05_07":true,"cjeu_referral_2026_07_08":false},"notes":[{"text":"BSI: law promulgated 5 Dec 2025, in force 6 Dec 2025.","source":"https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2025/251205_NIS-2-Umsetzungsgesetz_in_Kraft.html"}],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive"],"last_verified":"2026-10-28","verification":"secondary-source","verification_notes":[]},{"code":"GR","country":"Greece","eu_member":true,"status":"transposed","status_label":"Transposed","transposition_date":"2024-11-27","entry_into_force":null,"date_raw":"27/11/2024","national_law":"Law No. 5160","official_texts":[{"title":"Final Text","url":"https://search.et.gr/el/fek/?fekId=774154"},{"title":"Joint Ministerial decision","url":"https://cyber.gov.gr/wp-content/uploads/2025/05/20250202186.pdf"},{"title":"Joint Ministerial decision","url":"https://cyber.gov.gr/wp-content/uploads/2025/04/FEK_KYA_1645_2025_paratasi_ypvolis_stoixeiwn_ontotitwn.pdf"}],"commission":{"reasoned_opinion_2025_05_07":false,"cjeu_referral_2026_07_08":false},"notes":[],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive"],"last_verified":"2026-10-28","verification":"secondary-source","verification_notes":[]},{"code":"HU","country":"Hungary","eu_member":true,"status":"transposed","status_label":"Transposed","transposition_date":"2023-05-23","entry_into_force":"2024-10-19","date_raw":"23/05/2023; Entered into force on 19/10/2024","national_law":"Act LXIX of 2024 on cybersecurity in Hungary","official_texts":[{"title":"Primary Law","url":"https://njt.hu/jogszabaly/en/2023-23-00-00"},{"title":"Implementing Act","url":"https://njt.hu/jogszabaly/2024-69-00-00"}],"commission":{"reasoned_opinion_2025_05_07":true,"cjeu_referral_2026_07_08":false},"notes":[{"text":"Deadline for first NIS2 compliance audit moved from 31 Dec 2025 to 30 Jun 2026 (per ECSO).","source":"https://ecs-org.eu/nis2-tracker/"},{"text":"ECSO notes delays in implementing decrees; Commission counts transposition as complete only when secondary legislation is in place.","source":"https://ecs-org.eu/nis2-tracker/"}],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive"],"last_verified":"2026-10-28","verification":"needs-verification","verification_notes":["Conflicting or incomplete signals between ECSO and Commission / within record."]},{"code":"IE","country":"Ireland","eu_member":true,"status":"draft","status_label":"Draft Law","transposition_date":null,"entry_into_force":null,"date_raw":"N/A","national_law":null,"official_texts":[{"title":"Draft Law","url":"https://www.gov.ie/pdf/?file=https://assets.gov.ie/303962/aa59bc78-e82d-4e74-9e95-b05c0c5a83a1.pdf#page=null"}],"commission":{"reasoned_opinion_2025_05_07":true,"cjeu_referral_2026_07_08":true},"notes":[{"text":"Referred to the CJEU on 8 Jul 2026 for failing to notify transposition measures.","source":"https://digital-strategy.ec.europa.eu/en/news/commission-refers-ireland-spain-france-and-netherlands-court-justice-failing-transpose-rules"}],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive","https://digital-strategy.ec.europa.eu/en/news/commission-refers-ireland-spain-france-and-netherlands-court-justice-failing-transpose-rules"],"last_verified":"2026-10-28","verification":"needs-verification","verification_notes":["Draft status as of ECSO update 10 Sep 2026; check national legislature for progress since."]},{"code":"IT","country":"Italy","eu_member":true,"status":"transposed","status_label":"Transposed","transposition_date":"2024-04-09","entry_into_force":"2024-10-16","date_raw":"9/04/2024","national_law":"Legislative Decree No. 138","official_texts":[{"title":"Final Text","url":"https://www.gazzettaufficiale.it/eli/id/2024/10/01/24G00155/SG"}],"commission":{"reasoned_opinion_2025_05_07":false,"cjeu_referral_2026_07_08":false},"notes":[{"text":"ACN technical annexes set minimum security requirements to be implemented by October 2026, based on the national framework (NIST CSF adaptation).","source":"https://ecs-org.eu/nis2-tracker/"},{"text":"Gazzetta Ufficiale: D.Lgs. 138/2024 published 1 Oct 2024 (GU n.230), in force 16 Oct 2024.","source":"https://www.gazzettaufficiale.it/eli/id/2024/10/01/24G00155/SG"}],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive"],"last_verified":"2026-10-28","verification":"secondary-source","verification_notes":[]},{"code":"LV","country":"Latvia","eu_member":true,"status":"transposed","status_label":"Transposed","transposition_date":"2024-06-20","entry_into_force":"2024-09-01","date_raw":"20/06/2024; Entered into force on 01/09/2024","national_law":"National Cyber Security Act","official_texts":[{"title":"Final Text","url":"https://www.vestnesis.lv/op/2024/128A.1"},{"title":"Regulation No. 397 on Minimum cybersecurity requirements; Entered into force on 02/07/2025","url":"https://likumi.lv/ta/id/361481-minimalas-kiberdrosibas-prasibas"}],"commission":{"reasoned_opinion_2025_05_07":true,"cjeu_referral_2026_07_08":false},"notes":[{"text":"ECSO flags delays in Cabinet regulations defining technical requirements; Regulation No. 397 (minimum requirements) in force 02/07/2025.","source":"https://ecs-org.eu/nis2-tracker/"}],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive"],"last_verified":"2026-10-28","verification":"needs-verification","verification_notes":["Conflicting or incomplete signals between ECSO and Commission / within record."]},{"code":"LT","country":"Lithuania","eu_member":true,"status":"transposed","status_label":"Transposed","transposition_date":"2024-07-11","entry_into_force":"2024-10-18","date_raw":"Adopted 11/07/2024; has entered into force 18/10/2024. Subordinated act-Governmental decree adopted 11/6/2024; has entered into force 12/11/2024","national_law":"XII-1428 Law on Cybersecurity of the Republic of Lithuania; Governmental decree on the implementation of the Law of the Republic of Lithuania on Cyber Security","official_texts":[{"title":"Final Text","url":"https://e-seimas.lrs.lt/portal/legalAct/lt/TAD/22f960219fff11ef9db2c9aaf9c67042"}],"commission":{"reasoned_opinion_2025_05_07":false,"cjeu_referral_2026_07_08":false},"notes":[],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive"],"last_verified":"2026-10-28","verification":"secondary-source","verification_notes":[]},{"code":"LU","country":"Luxembourg","eu_member":true,"status":"transposed","status_label":"Transposed","transposition_date":"2026-05-06","entry_into_force":"2026-05-10","date_raw":"6/05/2026 (Entered into force 10/05/2026)","national_law":"Law of May 5, 2026 concerning measures aimed at ensuring a high level of cybersecurity","official_texts":[{"title":"Law","url":"https://legilux.public.lu/filestore/eli/etat/leg/loi/2026/05/05/a225/jo/fr/pdfa/eli-etat-leg-loi-2026-05-05-a225-jo-fr-pdfa.pdf"}],"commission":{"reasoned_opinion_2025_05_07":true,"cjeu_referral_2026_07_08":false},"notes":[],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive"],"last_verified":"2026-10-28","verification":"secondary-source","verification_notes":[]},{"code":"DK","country":"Denmark","eu_member":true,"status":"transposed","status_label":"Transposed","transposition_date":"2025-05-06","entry_into_force":"2025-07-01","date_raw":"Adopted on 06/05/2025; Enters into force on 01/07/2025","national_law":"Law No. 434, Act on measures to ensure a high level of cybersecurity (NIS 2 Act)","official_texts":[{"title":"Final Text","url":"https://www.retsinformation.dk/eli/lta/2025/434/pdf"}],"commission":{"reasoned_opinion_2025_05_07":true,"cjeu_referral_2026_07_08":false},"notes":[],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive"],"last_verified":"2026-10-28","verification":"secondary-source","verification_notes":[]},{"code":"MT","country":"Malta","eu_member":true,"status":"transposed","status_label":"Transposed","transposition_date":"2025-04-08","entry_into_force":null,"date_raw":"08/04/2025","national_law":"Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, 2025","official_texts":[{"title":"Final Text","url":"https://legislation.mt/eli/ln/2025/71/eng"}],"commission":{"reasoned_opinion_2025_05_07":false,"cjeu_referral_2026_07_08":false},"notes":[],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive"],"last_verified":"2026-10-28","verification":"secondary-source","verification_notes":[]},{"code":"NL","country":"Netherlands","eu_member":true,"status":"transposed","status_label":"Transposed","transposition_date":"2026-07-10","entry_into_force":"2026-08-15","date_raw":"10/07/2026 (Enters into force 15/08/2026)","national_law":"Cyberbeveiligingswet (Cbw) – Cybersecurity Act. It replaces the old Wbni (Network and Information Systems Security Act) and is backed up by a decree, the Cyberbeveiligingsbesluit (Cbb), which sets out more detailed rules. And the NCTV’s Doorverwijsboom Cyberbeveiligingswet (the Cybersecurity Act Referral Tree) is a visual reference chart published by the Dutch National Coordinator for Security and Counterterrorism","official_texts":[{"title":"Primary Law","url":"https://zoek.officielebekendmakingen.nl/stb-2026-187.html"},{"title":"Secondary Law","url":"https://zoek.officielebekendmakingen.nl/stb-2026-189.html"}],"commission":{"reasoned_opinion_2025_05_07":true,"cjeu_referral_2026_07_08":true},"notes":[{"text":"Commission referred NL to the CJEU on 8 Jul 2026 for failing to notify transposition; ECSO records the Cbw adopted 10/07/2026 and in force 15/08/2026.","source":"https://digital-strategy.ec.europa.eu/en/news/commission-refers-ireland-spain-france-and-netherlands-court-justice-failing-transpose-rules"},{"text":"NCSC confirms the Cbw entered into force on 15 Aug 2026 (after the Commission's 8 Jul 2026 referral).","source":"https://www.ncsc.nl/cyberbeveiligingswet-nis2/registreren"}],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive","https://digital-strategy.ec.europa.eu/en/news/commission-refers-ireland-spain-france-and-netherlands-court-justice-failing-transpose-rules","https://www.ncsc.nl/cyberbeveiligingswet-nis2/registreren"],"last_verified":"2026-10-28","verification":"secondary-source","verification_notes":[]},{"code":"PL","country":"Poland","eu_member":true,"status":"transposed","status_label":"Transposed","transposition_date":"2026-03-02","entry_into_force":"2026-04-03","date_raw":"02/03/2026 (Enters into force on 02/04/2026)","national_law":"Law Amending the Act on the National Cybersecurity System","official_texts":[{"title":"Final Text","url":"https://api.sejm.gov.pl/eli/acts/DU/2026/252/text.pdf"}],"commission":{"reasoned_opinion_2025_05_07":true,"cjeu_referral_2026_07_08":false},"notes":[{"text":"Adds mining and nuclear energy subsectors to energy as high-criticality sectors.","source":"https://ecs-org.eu/nis2-tracker/"},{"text":"gov.pl gives entry into force as 3 Apr 2026; ECSO lists 2 Apr 2026. gov.pl date used.","source":"https://www.gov.pl/web/baza-wiedzy/ostatnie-dni-na-samorejestracje-w-wykazie-ksc-termin-mija-3-pazdziernika"}],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive","https://www.gov.pl/web/cyfryzacja/nowelizacja-ustawy-o-krajowym-systemie-cyberbezpieczenstwa-ksc--najwazniejsze-terminy"],"last_verified":"2026-10-28","verification":"secondary-source","verification_notes":[]},{"code":"PT","country":"Portugal","eu_member":true,"status":"transposed","status_label":"Transposed","transposition_date":"2025-12-04","entry_into_force":null,"date_raw":"04/12/2025","national_law":"Decree-Law No. 125/2025","official_texts":[{"title":"Final Text","url":"https://diariodarepublica.pt/dr/detalhe/decreto-lei/125-2025-962603401"}],"commission":{"reasoned_opinion_2025_05_07":true,"cjeu_referral_2026_07_08":false},"notes":[],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive"],"last_verified":"2026-10-28","verification":"secondary-source","verification_notes":[]},{"code":"RO","country":"Romania","eu_member":true,"status":"transposed","status_label":"Transposed","transposition_date":"2025-01-01","entry_into_force":null,"date_raw":"1/1/2025","national_law":"Emergency Ordinance on the establishment of a framework for the cybersecurity of networks and information systems in civil national cyberspace","official_texts":[{"title":"Final Text","url":"https://dnsc.ro/vezi/document/oug-privind-transpunerea-directivei-nis-2"},{"title":"Draft Implementing Laws","url":"https://www.dnsc.ro/pagini/transparenta-decizionala"}],"commission":{"reasoned_opinion_2025_05_07":false,"cjeu_referral_2026_07_08":false},"notes":[],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive"],"last_verified":"2026-10-28","verification":"secondary-source","verification_notes":[]},{"code":"SK","country":"Slovakia","eu_member":true,"status":"transposed","status_label":"Transposed","transposition_date":"2025-01-01","entry_into_force":"2025-01-22","date_raw":"01/01/2025; Entered into force on 22/01/2025","national_law":"Law on cyber security","official_texts":[{"title":"Final Text","url":"https://static.slov-lex.sk/pdf/SK/ZZ/2024/366/ZZ_2024_366_20250101.pdf"}],"commission":{"reasoned_opinion_2025_05_07":false,"cjeu_referral_2026_07_08":false},"notes":[],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive"],"last_verified":"2026-10-28","verification":"secondary-source","verification_notes":[]},{"code":"SI","country":"Slovenia","eu_member":true,"status":"transposed","status_label":"Transposed","transposition_date":"2025-05-23","entry_into_force":"2025-06-19","date_raw":"23/05/2025; Entered into force on 19/06/2025","national_law":"Law on information security (ZInfV-1)","official_texts":[{"title":"Link to Law","url":"https://www.uradni-list.si/glasilo-uradni-list-rs/vsebina/2025-01-1571"}],"commission":{"reasoned_opinion_2025_05_07":true,"cjeu_referral_2026_07_08":false},"notes":[],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive"],"last_verified":"2026-10-28","verification":"secondary-source","verification_notes":[]},{"code":"ES","country":"Spain","eu_member":true,"status":"draft","status_label":"Draft Law","transposition_date":null,"entry_into_force":null,"date_raw":"N/A","national_law":null,"official_texts":[{"title":"Draft Law","url":"https://www.interior.gob.es/opencms/va/servicios-al-ciudadano/participacion-ciudadana/participacion-publica-en-proyectos-normativos/audiencia-e-informacion-publica/"}],"commission":{"reasoned_opinion_2025_05_07":true,"cjeu_referral_2026_07_08":true},"notes":[{"text":"Draft adds nuclear industry as high-criticality sector. Referred to the CJEU on 8 Jul 2026.","source":"https://ecs-org.eu/nis2-tracker/"}],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive","https://digital-strategy.ec.europa.eu/en/news/commission-refers-ireland-spain-france-and-netherlands-court-justice-failing-transpose-rules"],"last_verified":"2026-10-28","verification":"needs-verification","verification_notes":["Draft status as of ECSO update 10 Sep 2026; check national legislature for progress since."]},{"code":"SE","country":"Sweden","eu_member":true,"status":"transposed","status_label":"Transposed","transposition_date":"2025-12-17","entry_into_force":"2026-01-15","date_raw":"17/12/2025 (Enters into force on 15/01/2026)","national_law":"Cybersecurity Act","official_texts":[{"title":"Final text","url":"https://www.svenskforfattningssamling.se/doc/20251506.html"}],"commission":{"reasoned_opinion_2025_05_07":true,"cjeu_referral_2026_07_08":false},"notes":[{"text":"Registration now handled by NCSC (FRA) since 1 Jul 2026.","source":"https://www.ncsc.se/sv/radgivning-och-stod/cybersakerhetslagen-nis2/att-anmala-en-verksamhet/"}],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":["https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive"],"last_verified":"2026-10-28","verification":"secondary-source","verification_notes":[]},{"code":"UA","country":"Ukraine","eu_member":false,"status":"partial","status_label":"Transposed, except for Articles 28, 34, 35 NIS2 Directive","transposition_date":"2025-03-27","entry_into_force":"2025-04-20","date_raw":"Adopted 27/03/2025. Has entered into force 20/04/2025.","national_law":"The Law of Ukraine 4336-IX “On Amendments to Certain Laws of Ukraine Concerning the Information Protection and Cyberprotection of State Information Resources and Critical Information Infrastructure Objects”; The Law of Ukraine 2163-VIII “On the Basic Principles of Ensuring Cyber Security of Ukraine”","official_texts":[{"title":"The Law of Ukraine 4336-IX","url":"https://zakon.rada.gov.ua/laws/show/en/4336-IX?lang=en#Text"},{"title":"The Law of Ukraine 2163-VIII","url":"https://zakon.rada.gov.ua/laws/show/2163-viii#Text"}],"commission":null,"notes":[],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":[],"last_verified":"2026-10-28","verification":"needs-verification","verification_notes":["Non-EU alignment status is self-reported/secondary; verify with national source."]},{"code":"MD","country":"Moldova","eu_member":false,"status":"partial","status_label":"Approved Law/ NIS2 Partially transposed","transposition_date":"2025-01-01","entry_into_force":null,"date_raw":"01/01/2025","national_law":"Law No. 48/2023 on Cybersecurity","official_texts":[{"title":"Final text","url":"https://www.legis.md/cautare/getResults?doc_id=147961&lang=ro"},{"title":"Government Decision on how to fulfil cybersecurity obligations by service providers in critical sectors; Adopted on 05-09-2025","url":"https://www.legis.md/cautare/getResults?doc_id=150574&lang=ro"}],"commission":null,"notes":[],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":[],"last_verified":"2026-10-28","verification":"needs-verification","verification_notes":["Non-EU alignment status is self-reported/secondary; verify with national source."]},{"code":"AL","country":"Albania","eu_member":false,"status":"transposed","status_label":"Transposed","transposition_date":"2024-04-18","entry_into_force":null,"date_raw":"18/04/2024","national_law":"Law 25/2024 on Cybersecurity","official_texts":[{"title":"Document view – Center for Official Publications","url":"https://qbz.gov.al/eli/ligj/2024/03/21/25/8eec2e4f-c9bb-42a9-ac23-fefffc86318e;q=P%C3%ABr%20Sigurin%C3%AB%20Kibernetike"}],"commission":null,"notes":[],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":[],"last_verified":"2026-10-28","verification":"needs-verification","verification_notes":["Non-EU alignment status is self-reported/secondary; verify with national source."]},{"code":"RS","country":"Serbia","eu_member":false,"status":"transposed","status_label":"Transposed","transposition_date":"2025-10-22","entry_into_force":"2025-10-30","date_raw":"22/10/2025 (Entered into force on 30/10/2025)","national_law":"Law on Information Security","official_texts":[{"title":"Final Text","url":"http://www.parlament.gov.rs/upload/archive/files/lat/pdf/zakoni/14_saziv/1223-25%20-%20Lat..pdf"}],"commission":null,"notes":[],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":[],"last_verified":"2026-10-28","verification":"needs-verification","verification_notes":["Non-EU alignment status is self-reported/secondary; verify with national source."]},{"code":"MK","country":"North Macedonia","eu_member":false,"status":"transposed","status_label":"Transposed","transposition_date":"2025-06-27","entry_into_force":null,"date_raw":"27/06/2025","national_law":"Law on Security of Network and Information Systems","official_texts":[{"title":"Law","url":"https://mdt.gov.mk/en-GB/regulativa/zakoni"}],"commission":null,"notes":[],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":[],"last_verified":"2026-10-28","verification":"needs-verification","verification_notes":["Non-EU alignment status is self-reported/secondary; verify with national source."]},{"code":"ME","country":"Montenegro","eu_member":false,"status":"transposed","status_label":"Transposed","transposition_date":"2024-12-11","entry_into_force":null,"date_raw":"11/12/2024","national_law":"Law on Information Security","official_texts":[{"title":"Zakon o informacionoj bezbjednosti","url":"https://www.gov.me/en/documents/23936380-482a-4784-bd94-be69413d7334"}],"commission":null,"notes":[],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":[],"last_verified":"2026-10-28","verification":"needs-verification","verification_notes":["Non-EU alignment status is self-reported/secondary; verify with national source."]},{"code":"AM","country":"Armenia","eu_member":false,"status":"transposed","status_label":"Transposed","transposition_date":"2025-12-04","entry_into_force":null,"date_raw":"04/12/2025","national_law":"Cybersecurity Law","official_texts":[{"title":"Law","url":"https://www.arlis.am/hy/acts/218672"}],"commission":null,"notes":[],"source_url":"https://ecs-org.eu/nis2-tracker/","secondary_sources":[],"last_verified":"2026-10-28","verification":"needs-verification","verification_notes":["Non-EU alignment status is self-reported/secondary; verify with national source."]}]}