NIS2 by Country in 2026: Germany, France, Italy, Spain, Netherlands, Poland and Sweden
The NIS2 Directive created a common European cybersecurity framework, but organizations do not comply with NIS2 only at an abstract EU level.
In practice, compliance depends heavily on national implementation.
Each Member State must transpose the Directive into domestic law, designate competent authorities, establish supervisory and registration processes, and define how covered organizations interact with regulators and national CSIRTs.
That is why a NIS2 by country view is essential for multinational organizations.
As of September 2026, the seven countries compared in this guide are not all in the same position.
Germany, Italy, the Netherlands, Poland, and Sweden have national NIS2 implementation laws in force. France and Spain remain incomplete in the latest official European Commission transposition status available at the time of writing.
The key lesson for businesses is:
build one European NIS2 baseline, then apply country-specific legal, registration, supervisory, and reporting requirements on top of it.
Table of Contents
NIS2 at a Glance
Directive (EU) 2022/2555—NIS2—replaced the original NIS Directive and significantly expanded the EU cybersecurity framework.
The European Commission says NIS2 creates a common legal framework across 18 critical sectors, expands coverage, strengthens cybersecurity risk-management requirements, increases board-level accountability, and introduces stronger supervision and enforcement.
Organizations in scope generally need to address areas including:
- cybersecurity risk analysis;
- incident handling;
- business continuity;
- disaster recovery;
- crisis management;
- supply-chain security;
- vulnerability management;
- cybersecurity hygiene;
- cryptography and encryption;
- access control;
- multifactor or continuous authentication.
Management bodies must approve and oversee the cybersecurity risk-management measures, and they may face accountability for failures.
NIS2 Incident Reporting: The EU Baseline
One of the most important common requirements is incident reporting.
Under Article 23 of NIS2, significant incidents generally follow a staged model:
| Reporting stage | EU baseline |
|---|---|
| Early warning | Within 24 hours of awareness |
| Incident notification | Within 72 hours of awareness |
| Final report | No later than 1 month after the incident notification |
The early warning should indicate, where applicable, whether malicious or unlawful activity is suspected and whether cross-border impact is possible. The 72-hour notification adds an initial assessment of severity and impact, along with indicators of compromise where available.
National implementation may add procedural detail, reporting channels, registration rules, or sector-specific expectations.
That is why companies must identify both:
the EU baseline
and
the national implementation that applies to them.
NIS2 Country Status Comparison
| Country | National status | Key authority / route |
|---|---|---|
| Germany | In force since 6 Dec 2025 | BSI |
| France | Full transposition incomplete in latest EU status | ANSSI / national legislative process |
| Italy | In force since 16 Oct 2024 | ACN |
| Spain | Full transposition incomplete in latest EU status | National legislative process |
| Netherlands | In force since 15 Aug 2026 | NCSC / sector supervisors |
| Poland | In force since 3 Apr 2026 | Ministry / competent sector authorities |
| Sweden | In force since 15 Jan 2026 | Sector supervisory authorities |
This table is a high-level operational summary, not legal advice.
Germany: NIS2 Is Fully Operational
Germany is now clearly in the implementation phase.
The German Federal Office for Information Security (BSI) confirms that the NIS-2 Implementation Act entered into force on 6 December 2025. Registration and reporting obligations under the law apply from that date.
Covered organizations use the BSI Portal for NIS2 registration and security incident reporting.
This means Germany should no longer be treated as a country where companies are merely waiting for legislation.
The practical priorities are now:
- confirming whether the organization falls within scope;
- registering where required;
- implementing risk-management measures;
- establishing incident-reporting processes;
- ensuring management oversight;
- maintaining evidence of compliance.
What German organizations should do
German entities should identify:
- whether they qualify as covered regulated entities;
- their registration obligations;
- the responsible internal NIS2 owner;
- their reporting workflow to BSI;
- evidence demonstrating cybersecurity controls.
For organizations strengthening vulnerability remediation governance, see the Patch Management SLA Template.
France: Transposition Remains Incomplete
France remains one of the most important unresolved jurisdictions.
On 8 July 2026, the European Commission referred France to the Court of Justice of the European Union for failure to notify complete NIS2 transposition.
French parliamentary materials also continued to discuss NIS2 transposition during 2026, indicating that national implementation remained an active legislative matter rather than a long-settled regime.
That does not mean French organizations should wait.
The direction of travel is already clear from NIS2 itself.
Organizations potentially in scope should prepare for:
- essential/important entity classification;
- cybersecurity risk-management requirements;
- supply-chain controls;
- incident reporting;
- management accountability;
- supervisory evidence.
Practical position for France
Treat France as:
prepare now + monitor legislation closely
rather than:
wait until final enactment before starting work.
A significant amount of the technical and governance work required by NIS2 will remain useful regardless of the final national procedural details.
Italy: NIS2 Has Been Transposed Since 2024
Italy was one of the earlier major Member States to complete national transposition.
Italy implemented NIS2 through Legislative Decree No. 138 of 4 September 2024, which entered into force on 16 October 2024.
The European Commission currently lists Italy’s NIS2 status as Transposed.
The Agenzia per la Cybersicurezza Nazionale (ACN) acts as Italy’s national competent NIS authority and single point of contact.
Italy’s legislation establishes processes for identifying and listing essential and important entities.
The national framework also requires annual registration/update activity through the ACN platform for relevant entities.
Practical priorities in Italy
Organizations should focus on:
- entity classification;
- ACN registration;
- governance;
- required cybersecurity measures;
- incident-reporting readiness;
- supply-chain visibility;
- management accountability.
Italy should be treated as an active compliance jurisdiction, not as a future implementation case.
Spain: NIS2 Transposition Is Still in Progress
Spain remains a key jurisdiction to monitor.
The European Commission’s 8 July 2026 enforcement action states that Spain had still failed to notify complete transposition and referred Spain to the Court of Justice.
Spanish official material in 2026 continued to refer to the proposed Law on Cybersecurity Coordination and Governance as the vehicle intended to transpose NIS2.
A Spanish government security report published in 2026 states that the Ministry of the Interior was still considering how to incorporate observations from the Council of State into the draft law.
Other BOE material continued to describe the legislation as in process.
What this means for businesses
Spain should currently be treated as:
active legislative monitoring + advance compliance preparation
Organizations should not wait for final enactment before addressing:
- cyber-risk management;
- supplier risk;
- incident escalation;
- board responsibility;
- security policies;
- evidence retention.
The EU-level requirements are already known.
The principal uncertainty concerns the final national implementation mechanics.
Netherlands: Cyberbeveiligingswet Is Now in Force
This is the most important correction to your current article.
The previous version says the Dutch Cyberbeveiligingswet was expected to enter into force around July 2026.
That is now outdated.
The Dutch NCSC confirms that the Cyberbeveiligingswet entered into force on 15 August 2026.
The law implements NIS2 in the Netherlands and introduces obligations involving:
- cybersecurity measures;
- incident reporting;
- registration;
- supervision.
The NCSC says more than 8,000 organizations providing essential or important services are affected.
Registration
Dutch organizations within scope must register in the entity register.
The NCSC says registration can be completed through MijnNCSC using eHerkenning or SSOnRijk.
A particularly useful point for multinational organizations is that the NIS2 framework does not generally create one universal registration covering every Member State. The Dutch NCSC notes that entities may need to register according to the national rules of countries where they are established and provide covered services, subject to specific exceptions.
That is exactly why country-by-country planning matters.
Poland: NIS2 Rules Are Live With Important 2026 Deadlines
Poland’s amended National Cybersecurity System Act entered into force on 3 April 2026.
The Polish Ministry of Digital Affairs says the legislation implements NIS2 and expands cybersecurity obligations to a much broader range of essential and important entities.
The Ministry estimates that the new framework may cover approximately 38,000 entities, including around 27,000 public-sector bodies.
There are also important implementation dates.
The Ministry states that entities satisfying the statutory criteria when the amendment entered into force must:
- register in the KSC list by 3 October 2026;
- connect to the S46 system by 3 April 2027.
That makes Poland especially important right now because September 2026 is not merely an abstract compliance period.
There is an immediate registration deadline approaching.
Practical priorities in Poland
Organizations should:
- perform self-identification;
- determine essential/important entity status;
- prepare registration;
- implement the information-security management framework;
- map incident-reporting responsibilities;
- prepare S46 integration.
The Polish Ministry explicitly tells organizations to assess their own activities against the statutory scope criteria.
Sweden: New Cybersecurity Act Is Fully in Force
Sweden’s new Cybersecurity Act and Cybersecurity Regulation entered into force on 15 January 2026.
The Swedish government confirms that the law implements NIS2 and requires covered public and private organizations in designated sectors to:
- protect their network and information systems;
- implement cybersecurity measures;
- report significant incidents;
- comply with supervision.
The law also significantly expands the number of organizations subject to cybersecurity requirements compared with the previous regime.
What Swedish organizations should prioritize
Organizations should ensure:
- scope determination is complete;
- supervisory authority is identified;
- incident-reporting workflow is established;
- risk-management measures are documented;
- senior management understands its responsibilities;
- supplier dependencies are assessed.
Sweden should now be treated as a mature active implementation jurisdiction.
NIS2 Country Readiness Matrix
A multinational organization can use a simple operating model:
| Country | Status | Immediate action |
|---|---|---|
| Germany | Live | Register/report through BSI where required |
| France | Transposition incomplete | Prepare baseline and monitor final legislation |
| Italy | Live | Maintain ACN registration/compliance |
| Spain | Transposition incomplete | Prepare baseline and monitor legislation |
| Netherlands | Live | Register and implement Cbw requirements |
| Poland | Live | Complete KSC registration deadlines |
| Sweden | Live | Operate under new Cybersecurity Act |
This makes the differences much clearer than labeling every jurisdiction simply “NIS2 compliant” or “not compliant.”
One EU Baseline, Seven National Overlays
Organizations operating across Europe should avoid building seven entirely unrelated cybersecurity programs.
A better model is:
Layer 1 — Common NIS2 baseline
Implement controls covering:
- risk analysis;
- incident management;
- business continuity;
- disaster recovery;
- supply-chain security;
- vulnerability management;
- access control;
- authentication;
- cybersecurity training;
- governance.
Layer 2 — Country-specific scope
Determine:
- local entity classification;
- sector;
- size thresholds;
- establishment rules.
Layer 3 — Country-specific administration
Map:
- regulator;
- CSIRT;
- registration platform;
- registration deadline;
- reporting route.
Layer 4 — Local legal differences
Document:
- national sanctions;
- supervisory powers;
- special sector rules;
- transitional periods;
- local documentation requirements.
That structure reduces duplication while preserving the country differences that matter.
NIS2 Risk-Management Controls
Article 21 requires appropriate and proportionate technical, operational, and organizational measures.
The EU-level catalogue includes:
- risk-analysis and information-system security policies;
- incident handling;
- business continuity and backup management;
- disaster recovery and crisis management;
- supply-chain security;
- secure acquisition, development and maintenance;
- vulnerability handling and disclosure;
- cybersecurity-measure effectiveness assessments;
- basic cyber hygiene and training;
- cryptography/encryption policies;
- human-resources security and access control;
- MFA or continuous authentication where appropriate.
For supplier governance, see the Third-Party Risk Assessment Checklist.
Supply-Chain Security Is Becoming More Important in 2026
Supply-chain risk is one of the core NIS2 topics.
In February 2026, the NIS Cooperation Group adopted a new EU ICT Supply Chain Security Toolbox.
The toolbox encourages organizations and Member States to assess critical suppliers, adopt multi-vendor strategies where appropriate, and reduce dependency on high-risk suppliers.
That makes supplier governance especially relevant for NIS2 readiness.
Businesses should understand:
- which vendors support critical functions;
- concentration risk;
- subcontractors;
- security obligations;
- breach-notification clauses;
- exit strategies.
See the Supplier Cybersecurity Contract Template for practical contract controls.
Management Accountability Under NIS2
NIS2 is also a board-level governance issue.
The Directive requires management bodies of essential and important entities to approve cybersecurity risk-management measures and oversee implementation.
That means senior leadership should understand:
- major cybersecurity risks;
- critical suppliers;
- incident readiness;
- remediation gaps;
- security investment;
- compliance evidence.
NIS2 should therefore appear in management reporting rather than remaining only within technical security teams.
NIS2 Incident Reporting Checklist
A multinational organization should be able to answer:
Detection
- When did we become aware?
- Is this a significant incident?
Impact
- What services are affected?
- Could there be severe operational disruption?
- Could customers or third parties experience material harm?
Reporting
- Which national authority receives the report?
- Which CSIRT applies?
- Does the country use a national portal?
- Who is authorized to submit?
Timeline
- Can the 24-hour warning be sent?
- Can the 72-hour notification be completed?
- Who owns the one-month final report?
Cross-border
- Which Member States are affected?
- Do several national obligations apply?
For incident chronology, see the Data Breach Timeline Template.
Cybersecurity Time NIS2 Country Checklist
For every EU jurisdiction where your organization operates, maintain a country record containing:
Scope
- legal entity;
- sector;
- size;
- essential/important classification.
Authority
- competent authority;
- sector regulator;
- national CSIRT.
Registration
- registration required?
- portal;
- deadline;
- owner.
Incident Reporting
- national reporting portal;
- contact;
- escalation path.
Governance
- management approval;
- reporting structure;
- risk register.
Third Parties
- critical suppliers;
- contractual incident notification;
- concentration risk.
Evidence
- policies;
- risk assessments;
- vulnerability remediation;
- training;
- audits;
- incident exercises.
This country file can sit underneath one common EU-level NIS2 compliance program.
What Businesses Should Do Now
1. Identify Every EU Legal Entity
Do not map NIS2 only at group level.
Record each company and establishment.
2. Perform Country-by-Country Scope Analysis
For each entity, determine:
- jurisdiction;
- sector;
- size;
- entity classification.
3. Build the Common Control Baseline
Use Article 21 as the core.
This prevents duplicating cybersecurity programs unnecessarily.
4. Map National Registration
Germany, Netherlands, Poland, Italy, and other live jurisdictions have operational registration or supervisory mechanisms.
Document the exact route.
5. Update Incident Response
The EU baseline requires:
24-hour warning → 72-hour notification → final report within one month
but national reporting processes must be mapped.
6. Review Suppliers
Prioritize suppliers supporting:
- critical infrastructure;
- cloud environments;
- managed services;
- networks;
- identity systems.
7. Put NIS2 on the Management Agenda
Boards and management bodies should receive reporting on:
- compliance status;
- open security risks;
- incidents;
- supplier exposure;
- remediation.
Frequently Asked Questions
Is NIS2 the same in every EU country?
The Directive creates a common EU framework, but Member States transpose it through national law.
National differences can involve:
- competent authorities;
- registration;
- procedural requirements;
- sanctions;
- supervisory practice;
- timing.
Which of these seven countries currently have NIS2 laws in force?
As of September 2026:
- Germany;
- Italy;
- Netherlands;
- Poland;
- Sweden.
France and Spain remain incomplete in the latest official Commission transposition status used for this review.
When did the Netherlands NIS2 law take effect?
The Dutch Cyberbeveiligingswet entered into force on 15 August 2026.
When did Germany’s NIS2 law start?
Germany’s NIS2 implementation law took effect on 6 December 2025.
When did Poland implement NIS2?
Poland’s amended National Cybersecurity System Act entered into force on 3 April 2026.
When did Sweden implement NIS2?
Sweden’s Cybersecurity Act entered into force on 15 January 2026.
When did Italy transpose NIS2?
Italy’s Legislative Decree No. 138 entered into force on 16 October 2024.
What are NIS2’s incident-reporting deadlines?
The EU baseline is:
- 24-hour early warning;
- 72-hour incident notification;
- final report within one month.
Final Takeaway
NIS2 is one European Directive, but operational compliance remains country-specific.
For the seven jurisdictions reviewed here, the current picture is:
Germany — live
France — transposition incomplete
Italy — live
Spain — transposition incomplete
Netherlands — live since August 2026
Poland — live
Sweden — live
This means the best multinational strategy is not seven completely separate cybersecurity programs.
Instead:
one NIS2 control baseline + country-specific legal overlays
For every country, map:
scope → regulator → registration → incident reporting → governance → evidence
The most important correction to your existing article is the Netherlands: it is no longer a future-readiness jurisdiction. The Cyberbeveiligingswet is already in force. Your old text therefore needs updating before AdSense review.
Primary External Sources
Use these authoritative links in the final WordPress article:
- European Commission — NIS2 Directive
- European Commission — NIS2 Transposition by Country
- EUR-Lex — Directive (EU) 2022/2555
- Germany — BSI NIS2 Information
- Italy — Legislative Decree 138/2024
- Netherlands — NCSC Cyberbeveiligingswet
- Poland — Ministry of Digital Affairs NIS2 Implementation
- Sweden — New Cybersecurity Act
- European Commission — July 2026 NIS2 Enforcement Update
