NIS2 Implementation Timeline: Where Every EU Member State Stands

24 of 27 EU member states have a NIS2 law in force today. Still legislating: 3; adopted but not yet applying: 0. On 8 July 2026 the Commission referred four states, Ireland, Spain, France and the Netherlands, to the Court of Justice of the EU. Status checked on September 28, 2026.

Sources: the national authorities linked per country below, European Commission press release IP/26/1499 and the directive text on EUR-Lex.

Key takeaways

• The deadline passed long ago. Member states had to transpose NIS2 by 17 October 2024. Most missed it.
• The Commission escalated in three steps: formal notices on 28 November 2024, reasoned opinions on 7 May 2025, and a referral to the Court of Justice on 8 July 2026.
• Your obligations follow the national law. Where it is in force, registration and security duties apply now. Where it is not, the old NIS1 rules may still apply to operators designated under them.
• Working across borders means several regimes. Registration deadlines and supervisors differ per country, even though the directive's baseline is the same.

The EU enforcement timeline

Date	What happened
17 October 2024	Deadline for member states to transpose NIS2 into national law
28 November 2024	The Commission sent letters of formal notice to 23 member states that had not notified full transposition
7 May 2025	Reasoned opinions to 19 member states, the last step before court
8 July 2026	Referral of Ireland, Spain, France and the Netherlands to the Court of Justice, with a request for a lump sum and daily penalties (IP/26/1499)

A referral does not change what companies must do in the meantime. It puts pressure on the member state to finish its law, and the Court can fine the state, not the companies in it.

Where each member state stands

The infographic shows a status only for member states whose row we have re-checked against the national authority. For any country listed there without a status, confirm with its national authority before relying on a date.

Countries in detail

Netherlands: in force since 15 August 2026

The Cyberbeveiligingswet (Cbw) has applied since 15 August 2026. Registration with the NCSC through MijnNCSC is mandatory from that date, with no transition period. The Netherlands was one of the four states referred to the Court of Justice on 8 July 2026, weeks before its law entered into force. More in our guide to the Dutch Cybersecurity Act.

Germany: in force since 6 December 2025

The NIS2 implementation act has been in force since 6 December 2025, supervised by the BSI. Entities had to register by 6 March 2026, three months after entry into force (§ 33 BSIG). Registration is now simply overdue for anyone in scope who has not done it.

Italy: in force since 16 October 2024

Italy's Legislative Decree 138/2024 has applied since 16 October 2024, with the ACN as the national authority. Entities added to the ACN list in 2025 must meet the basic security measures by October 2026, 18 months after ACN notified them of their listing.

Poland: in force since 3 April 2026

Poland amended its National Cybersecurity System Act, in force since 3 April 2026. Entities must register in the list kept by the Minister of Digital Affairs (Wykaz KSC) by 3 October 2026 and implement the security measures by 3 April 2027.

Belgium: in force since 18 October 2024

Belgium's NIS2 law has applied since 18 October 2024, with the Centre for Cybersecurity Belgium (CCB) as the national authority. Most entities had to register by 18 March 2025.

France: still legislating

France has no NIS2 law in force yet. The Senate adopted the transposition bill on 12 March 2025, and the ANSSI published its security framework on 17 March 2026. Pre-registration with the ANSSI is open. France was referred to the Court of Justice on 8 July 2026. What that means for suppliers is in our post on the France and Spain referral.

Spain: still legislating

The Spanish government approved a draft transposition law on 14 January 2025, but it has not been enacted. Until it is, the NIS1 rules still apply, supervised by the CCN and INCIBE. Spain was referred to the Court of Justice on 8 July 2026.

Ireland: still legislating

The National Cyber Security Bill that will transpose NIS2 has not been enacted, so NIS1 still applies to designated operators of essential services. The NCSC is the national authority. Ireland was referred to the Court of Justice on 8 July 2026. More in our Ireland NIS2 guide.

What if you operate in several member states?

Most obligations attach to each member state where you provide services, so a group can face several registration deadlines and supervisors at once. Some digital providers, such as DNS service providers, cloud and data centre providers, and online marketplaces, fall under the member state of their main establishment instead.

The security measures themselves come from Article 21 of the directive and are the same everywhere. Build one programme on the directive, then map each national law's registration and reporting details onto it.

What should you do now?

1. Check whether NIS2 applies to you. The directive covers 18 sectors and organisations with 50 or more employees, or fewer than 50 with both annual turnover and balance sheet total above €10 million, plus some providers at any size. See What is NIS2?.
2. List the member states you operate in and check each one's status in the infographic above.
3. Register where the law is in force and the deadline has passed or is close: Poland's registration deadline is 3 October 2026.
4. Do not wait where the law is still pending. The directive's measures will not change much in transposition, and customers in countries with a law in force already pass the requirements down their supply chains.

Not sure where you stand? Take the free NIS2 Quick Scan. It maps your current security posture against the ten Article 21 measures in about 10 minutes.