NIS2 Directive (EU) 2022/2555
NIS2 deadlines by country
The key NIS2 dates for 34 countries in one table: when each national law was adopted and took effect, registration and compliance deadlines, and Commission infringement steps. Every date links to its source.
Add all NIS2 dates to your calendar (.ics) or pick one country's calendar in the last column. Dates are all-day events; the file updates when our data does.
The EU-wide transposition deadline was 17 Oct 2024 (Art. 41). Draft-law countries have no national dates yet; their rows show the Commission's infringement steps. Want this on your site? Embed the NIS2 status widget.
| Country | Date | Type | What | Source | Calendar |
|---|---|---|---|---|---|
| Albania AL | National law | National law adopted (Law 25/2024 on Cybersecurity) | qbz.gov.al source-checked | AL .ics | |
| Albania AL | National law | National law enters into force | qbz.gov.al source-checked | AL .ics | |
| Armenia AM | National law | National law adopted (Cybersecurity Law) | arlis.am needs verification | AM .ics | |
| Austria AT | Infringement | European Commission reasoned opinion for incomplete transposition | digital-strategy.ec.europa.eu source-checked | AT .ics | |
| Austria AT | National law | National law adopted (NISG 2026) | ris.bka.gv.at secondary source | AT .ics | |
| Austria AT | National law | National law enters into force | ris.bka.gv.at secondary source | AT .ics | |
| Austria AT | in 62 days |
Deadline | Registration deadline (USP) for entities in scope from 1 Oct 2026 | bundesamt-cybersicherheit.gv.at source-checked | AT .ics |
| Austria AT | in 335 days |
Deadline | Self-declaration due under § 33(1) NISG 2026 (12 months after the registration duty arises; entities in scope from 1 Oct 2026) | ris.bka.gv.at source-checked | AT .ics |
| Belgium BE | National law | National law adopted (NIS2 Law of 26 April 2024) | ejustice.just.fgov.be secondary source | BE .ics | |
| Belgium BE | National law | National law enters into force | ejustice.just.fgov.be secondary source | BE .ics | |
| Belgium BE | Deadline | Essential entities – first CyFun verification / ISO 27001 evidence / inspection request | atwork.safeonweb.be source-checked | BE .ics | |
| Belgium BE | in 170 days |
Deadline | Essential entities – final CyFun level certified / ISO 27001 certification complete | atwork.safeonweb.be source-checked | BE .ics |
| Bulgaria BG | Infringement | European Commission reasoned opinion for incomplete transposition | digital-strategy.ec.europa.eu source-checked | BG .ics | |
| Bulgaria BG | National law | National law adopted (national NIS2 law) | dv.parliament.bg secondary source | BG .ics | |
| Croatia HR | National law | National law adopted (Regulation on Cybersecurity) | narodne-novine.nn.hr secondary source | HR .ics | |
| Cyprus CY | National law | National law adopted (The Security of Networks and Information Systems (Amendment) Law of 2025, (Law 60(I)/202…) | dsa.cy secondary source | CY .ics | |
| Cyprus CY | Infringement | European Commission reasoned opinion for incomplete transposition | digital-strategy.ec.europa.eu source-checked | CY .ics | |
| Czechia CZ | Infringement | European Commission reasoned opinion for incomplete transposition | digital-strategy.ec.europa.eu source-checked | CZ .ics | |
| Czechia CZ | National law | National law adopted (Cybersecurity Act / Act No. 264/2025) | e-sbirka.cz secondary source | CZ .ics | |
| Czechia CZ | National law | National law enters into force | e-sbirka.cz secondary source | CZ .ics | |
| Denmark DK | National law | National law adopted (Law No. 434, Act on measures to ensure a high level of cybersecurity (NIS 2 Act)) | retsinformation.dk secondary source | DK .ics | |
| Denmark DK | Infringement | European Commission reasoned opinion for incomplete transposition | digital-strategy.ec.europa.eu source-checked | DK .ics | |
| Denmark DK | National law | National law enters into force | retsinformation.dk secondary source | DK .ics | |
| Estonia EE | Infringement | European Commission reasoned opinion for incomplete transposition | digital-strategy.ec.europa.eu source-checked | EE .ics | |
| Estonia EE | National law | National law adopted (Amendment of the Cybersecurity Act) | riigiteataja.ee secondary source | EE .ics | |
| Estonia EE | National law | National law enters into force | riigiteataja.ee secondary source | EE .ics | |
| Finland FI | National law | National law adopted (Cybersecurity Law) | valtioneuvosto.fi secondary source | FI .ics | |
| Finland FI | National law | National law enters into force | valtioneuvosto.fi secondary source | FI .ics | |
| Finland FI | Infringement | European Commission reasoned opinion for incomplete transposition | digital-strategy.ec.europa.eu source-checked | FI .ics | |
| France FR | Infringement | European Commission reasoned opinion for incomplete transposition | digital-strategy.ec.europa.eu source-checked | FR .ics | |
| France FR | Infringement | Referred to the EU Court of Justice for failing to notify transposition | digital-strategy.ec.europa.eu source-checked | FR .ics | |
| Germany DE | Infringement | European Commission reasoned opinion for incomplete transposition | digital-strategy.ec.europa.eu source-checked | DE .ics | |
| Germany DE | National law | National law adopted (NIS2UmsuCG) | recht.bund.de secondary source | DE .ics | |
| Germany DE | National law | National law enters into force | recht.bund.de secondary source | DE .ics | |
| Germany DE | Deadline | Registration deadline for entities in scope at entry into force (§ 33(1) BSIG, three months from 6 Dec 2025; BSI: deadline has passed) | bsi.bund.de source-checked | DE .ics | |
| Greece GR | National law | National law adopted (Law No. 5160) | search.et.gr secondary source | GR .ics | |
| Hungary HU | National law | National law adopted (Act LXIX of 2024 on the cybersecurity of Hungary (replaced Act XXIII of 2023)) | njt.jog.gov.hu source-checked | HU .ics | |
| Hungary HU | National law | National law enters into force | njt.jog.gov.hu source-checked | HU .ics | |
| Hungary HU | Infringement | European Commission reasoned opinion for incomplete transposition | digital-strategy.ec.europa.eu source-checked | HU .ics | |
| Ireland IE | Infringement | European Commission reasoned opinion for incomplete transposition | digital-strategy.ec.europa.eu source-checked | IE .ics | |
| Ireland IE | Infringement | Referred to the EU Court of Justice for failing to notify transposition | digital-strategy.ec.europa.eu source-checked | IE .ics | |
| Italy IT | National law | National law adopted (D.Lgs. 138/2024) | gazzettaufficiale.it secondary source | IT .ics | |
| Italy IT | National law | National law enters into force | gazzettaufficiale.it secondary source | IT .ics | |
| Italy IT | Deadline | Basic security measures due around 12–13 Oct 2026 for entities notified of NIS listing on 12–13 Apr 2025 (18 months from each entity's own listing notice; later 2025 notices fall later) | acn.gov.it source-checked | IT .ics | |
| Italy IT | in 1 days |
Deadline | ACN platform stops accepting late 2026 NIS registration declarations | acn.gov.it source-checked | IT .ics |
| Italy IT | in 63 days |
Deadline | Incident notification obligation starts for entities first listed in 2026 | acn.gov.it source-checked | IT .ics |
| Italy IT | in 274 days |
Deadline | Basic security measures deadline for entities first listed in 2026 | acn.gov.it source-checked | IT .ics |
| Latvia LV | National law | National law adopted (National Cyber Security Act) | vestnesis.lv source-checked | LV .ics | |
| Latvia LV | National law | National law enters into force | vestnesis.lv source-checked | LV .ics | |
| Latvia LV | Infringement | European Commission reasoned opinion for incomplete transposition | digital-strategy.ec.europa.eu source-checked | LV .ics | |
| Lithuania LT | National law | National law adopted (XII-1428 Law on Cybersecurity of the Republic of Lithuania; Governmental decree on the i…) | e-seimas.lrs.lt secondary source | LT .ics | |
| Lithuania LT | National law | National law enters into force | e-seimas.lrs.lt secondary source | LT .ics | |
| Luxembourg LU | Infringement | European Commission reasoned opinion for incomplete transposition | digital-strategy.ec.europa.eu source-checked | LU .ics | |
| Luxembourg LU | National law | National law adopted (Law of May 5, 2026 concerning measures aimed at ensuring a high level of cybersecurity) | legilux.public.lu secondary source | LU .ics | |
| Luxembourg LU | National law | National law enters into force | legilux.public.lu secondary source | LU .ics | |
| Malta MT | National law | National law adopted (Measures for a High Common Level of Cybersecurity across the European Union (Malta) Orde…) | legislation.mt secondary source | MT .ics | |
| Moldova MD | National law | National law adopted (Law No. 48/2023 on Cybersecurity) | gov.md source-checked | MD .ics | |
| Moldova MD | National law | National law enters into force | gov.md source-checked | MD .ics | |
| Montenegro ME | National law | National law adopted (Law on Information Security) | wapi.gov.me source-checked | ME .ics | |
| Montenegro ME | National law | National law enters into force | wapi.gov.me source-checked | ME .ics | |
| Netherlands NL | Infringement | European Commission reasoned opinion for incomplete transposition | digital-strategy.ec.europa.eu source-checked | NL .ics | |
| Netherlands NL | Infringement | Referred to the EU Court of Justice for failing to notify transposition | digital-strategy.ec.europa.eu source-checked | NL .ics | |
| Netherlands NL | National law | National law adopted (Cyberbeveiligingswet (Cbw)) | zoek.officielebekendmakingen.nl secondary source | NL .ics | |
| Netherlands NL | National law | National law enters into force | zoek.officielebekendmakingen.nl secondary source | NL .ics | |
| Netherlands NL | in 655 days |
Deadline | Executive board members must meet Cbw knowledge/training requirements (two years after entry into force; RDI says "mid-2028") | wetten.overheid.nl source-checked | NL .ics |
| North Macedonia MK | National law | National law adopted (Law on Security of Network and Information Systems) | portal.mdt.gov.mk source-checked | MK .ics | |
| Poland PL | Infringement | European Commission reasoned opinion for incomplete transposition | digital-strategy.ec.europa.eu source-checked | PL .ics | |
| Poland PL | National law | National law adopted (KSC amendment (UKSC)) | api.sejm.gov.pl secondary source | PL .ics | |
| Poland PL | National law | National law enters into force | api.sejm.gov.pl secondary source | PL .ics | |
| Poland PL | in 155 days |
Deadline | End of adjustment period – implement KSC obligations and start using System S46 | gov.pl source-checked | PL .ics |
| Poland PL | in 521 days |
Deadline | First ISMS audit for key entities that were not operators of essential services; fines provisions start | gov.pl source-checked | PL .ics |
| Portugal PT | Infringement | European Commission reasoned opinion for incomplete transposition | digital-strategy.ec.europa.eu source-checked | PT .ics | |
| Portugal PT | National law | National law adopted (Decree-Law No. 125/2025) | diariodarepublica.pt secondary source | PT .ics | |
| Romania RO | National law | National law adopted (Emergency Ordinance on the establishment of a framework for the cybersecurity of network…) | dnsc.ro secondary source | RO .ics | |
| Serbia RS | National law | National law adopted (Law on Information Security) | parlament.gov.rs needs verification | RS .ics | |
| Serbia RS | National law | National law enters into force | parlament.gov.rs needs verification | RS .ics | |
| Slovakia SK | National law | National law adopted (Law on cyber security) | static.slov-lex.sk secondary source | SK .ics | |
| Slovakia SK | National law | National law enters into force | static.slov-lex.sk secondary source | SK .ics | |
| Slovenia SI | Infringement | European Commission reasoned opinion for incomplete transposition | digital-strategy.ec.europa.eu source-checked | SI .ics | |
| Slovenia SI | National law | National law adopted (Law on information security (ZInfV-1)) | uradni-list.si secondary source | SI .ics | |
| Slovenia SI | National law | National law enters into force | uradni-list.si secondary source | SI .ics | |
| Spain ES | Infringement | European Commission reasoned opinion for incomplete transposition | digital-strategy.ec.europa.eu source-checked | ES .ics | |
| Spain ES | Infringement | Referred to the EU Court of Justice for failing to notify transposition | digital-strategy.ec.europa.eu source-checked | ES .ics | |
| Sweden SE | Infringement | European Commission reasoned opinion for incomplete transposition | digital-strategy.ec.europa.eu source-checked | SE .ics | |
| Sweden SE | National law | National law adopted (Cybersäkerhetslag (2025:1506)) | svenskforfattningssamling.se secondary source | SE .ics | |
| Sweden SE | National law | National law enters into force | svenskforfattningssamling.se secondary source | SE .ics | |
| Ukraine UA | National law | National law adopted (The Law of Ukraine 4336-IX “On Amendments to Certain Laws of Ukraine Concerning the Info…) | zakon.rada.gov.ua needs verification | UA .ics | |
| Ukraine UA | National law | National law enters into force | zakon.rada.gov.ua needs verification | UA .ics |
88 dates. National-law dates come from the ECSO NIS2 tracker unless marked source-checked against the official text; deadlines come from regulators' own pages. Not legal advice: check the linked source before relying on a date. Data also as JSON and CSV.