NIS 2 transposition tracker: where all 27 EU Member States stand

17 October 2024. Article 41 of Directive (EU) 2022/2555 required Member States to adopt and publish their transposition measures by that date and to apply them from 18 October 2024. Most Member States missed it, which is why the Commission has since escalated through letters of formal notice (November 2024), reasoned opinions (May 2025) and, for Ireland, Spain, France and the Netherlands, referral to the Court of Justice (July 2026).

At our verification of 29 July 2026, 22 of the 27 Member States had a national transposition law adopted and in force. Austria had adopted its law (the NISG 2026) with entry into force set for 1 October 2026, the Netherlands had adopted the Cyberbeveiligingswet with entry into force on 15 August 2026, and Ireland, Spain and France were still legislating. The table on this page is re-verified on a schedule, so check the per-row dates.

For most private organisations no sanction can bite under a national NIS 2 law that does not exist yet (EU law recognises narrow direct-effect exceptions, mainly against public bodies after a missed deadline), but ignoring the directive is still the wrong read. The scope categories, the Article 21 risk-management measures and the Article 23 reporting architecture are set by the directive as a minimum, so the floor of what your national law will demand is already known, and because NIS 2 is minimum harmonisation a Member State can add to it. Once a law lands, the clocks are short: Germany, Luxembourg, Czechia and Slovakia all gave in-scope entities roughly two to three months to register. Preparing against the directive now is how you avoid scrambling later.

A transposition law can be adopted by parliament but not yet applicable: Austria's NISG 2026 was published in December 2025 but its main obligations apply from 1 October 2026, and the Dutch Cyberbeveiligingswet was adopted on 7 July 2026 but enters into force on 15 August 2026. This tracker's status column therefore turns on in force, not adopted, because obligations only bite from entry into force. The note on each row spells out which stage the country is at.

On 8 July 2026 the European Commission decided to refer Ireland, Spain, France and the Netherlands to the Court of Justice of the European Union for failing to notify measures fully transposing NIS 2, and asked the Court to impose financial sanctions (a lump sum plus daily penalties until complete transposition is notified). That is press release IP/26/1499. No other Member State was referred.

The European Commission's per-country tracker pages are the canonical EU-level source, but at our July 2026 verification several had not been updated since mid-2025 and still showed pre-transposition status for countries whose laws had since entered into force, including Bulgaria, Malta, Slovenia and Sweden. Where that happens we cite the national authority or official gazette instead and say so in the row note. If a row and the EU tracker disagree, follow the national source.

The directive's sector annexes and size thresholds set the EU baseline for applicability, independent of transposition status; national laws can extend that scope, so check the national act too. Our free NIS 2 applicability checker at /resources/nis-2-applicability-checker runs the sector, size and activity tests and returns a structured assessment, including this same transposition note for your Member State. It is a starting point, not a binding determination: confirm with your competent national authority.