NIS2 Directive Transposition Tracker
The tracker in brief
The NIS2 Directive Transposition Tracker is a collaborative project providing a streamlined and comprehensive overview of the Directive’s transposition across EU member states.
Organised into dedicated sections for each country, the tracker covers key aspects such as the sectoral scope, applicable standards, registration processes, sanctions, lists of competent authorities, and deadlines.
This initiative aims to identify similarities and differences in implementation while ensuring clarity for stakeholders navigating the evolving regulatory landscape.
Methodology
The information collected in the tracker is the outcome of a joint effort between the European Cyber Security Organisation (ECSO) and the ECSO CISO Community.
The data was gathered and cross-referenced through systematic research and analysis of primary and secondary sources, including Official Journals of Member States, EU databases, publicly available articles, and expert inputs.
As some sections are incomplete due to pending legislation, the tracker will be revised regularly to reflect the latest developments in NIS2 implementation.
Disclaimer: The information provided in this document is for general informational purposes only and is not to be used for legal ends. Please consult primary sources and national legislations for official business. All information is provided in good faith and to the best of our abilities. Any references to third parties are not to be intended as statements by the contributors involved. We take no responsibility for any errors or omissions in the content of this document. Law extracts have been simplified to facilitate readability. Any action you take upon the information in this document is strictly at your own risk.
National registration platforms
ECSO analysis of the current situation
Last update: 06 March 2025
NIS2 tracker overview
The NIS2 Directive aims to strengthen the cyber resilience of critical infrastructure and supply chains across the EU by enhancing requirements for public and private sector entities from a wide range of sectors. Amidst soaring vulnerabilities of network and information systems catalysed by emerging cyber threats, state-sponsored attacks, and growing digital dependencies, four countries met the transposition deadline of 17 October 2024. As a result, on 28 November 2024, the European Commission opened infringement procedures on 23 Member States.
Although the number of countries that transposed the Directive into national legislation increased from four to nine as of mid-February 2025, the implementation process was marked by a substantial divergence in adoption timelines and requirements, creating operational and compliance challenges for entities providing services in multiple jurisdictions. Measures vary in strictness, registration deadlines, sectoral coverage, incident reporting requirements, and enforcement timelines, posing risks of fragmentation.
Against this backdrop, this overview examines both draft and adopted national laws transposing the NIS2 Directive, using select country examples to illustrate broader trends without implying exhaustiveness.
Scope
Considerable variations emerged regarding the scope of implementation, with some countries opting to exclude certain sectors and others expanding coverage or reclassifying existing ones. Hungary, Finland, and Belgium omitted the banking and financial sectors (covered by DORA), whereas Bulgaria and Portugal did not include (local level) public administration in their draft legislation. Several countries introduced additional subsectors under the ‘essential’ industries category, including Hungary (adding public transport to transportation), Slovakia (incorporating thermal power engineering into energy), and Poland (classifying mineral extraction under energy and electronic communications under digital infrastructure).
In addition, Spain’s draft law brings the nuclear industry within scope. At the same time, Poland reclassified manufacturing – including chemical production, food processing, and distribution – from ‘important’ to ‘essential.’ In some cases, national laws merged sectors equivalent to ‘essential’ under NIS2, such as drinking water and wastewater, into a single sector. Whilst Germany proposed this approach (draft law as of February 2025), Hungary and Slovakia adopted it. The decision of Member States to include or exclude specific sectors could be based on national priorities, existing legislation and risk assessments necessitating stricter enforcement in critical areas.
Security standards
In countries like Greece, Hungary, Latvia, and Slovakia, national legislation refers to European and international security standards without specifying particular frameworks. In contrast, other laws or drafts specifically mention cybersecurity frameworks, such as ISO 27001/2 (e.g., Croatia, Finland, and Slovenia), NIST 800-53 (Cyprus), and NIST CSF 2.0 (Ireland). Notably, Belgium, Romania, and Lithuania adopted tailored national frameworks for standards in some measure based on international ones. Subsequently, dissimilar frameworks across the EU could complicate administrative procedures and compliance obligations for entities.
Incident reporting
The definitions of significant incidents, the timelines for reporting, thresholds, and reporting obligations differ across Member States. For instance, entities based in Cyprus must submit early warnings to the competent authority within six hours of detecting the incident. In comparison, NIS2 requires an early warning within 24 hours, an incident notification within 72 hours, a final report within one month, or a progress report if the incident is ongoing, with a final report due a month after the incident ends.
In terms of timelines, per draft texts, entities are obliged to start reporting incidents nine months after classification in Malta and one year after registration in Czechia. The draft law in Czechia also suggests an increased scope of incident reporting beyond significant incidents. In Slovakia, the adopted law requires entities to report significant cyber threats in addition to incidents where the entity prevented a threat that could have caused a significant incident or identified a vulnerability in publicly accessible networks or systems it operates and could not mitigate the risk in time. The diverse reporting requirements could lead to supplementary compliance costs for cross-border entities.
Registration and classification
In most Member States, entities are required to self-register, except in certain cases, namely Croatia, where competent authorities lead the registration process. Registration timeframes span from one month after the law enters into force in Romania to three months in Austria. Examples of countries that introduced expected deadlines for registration in the first half of 2025 are Ireland and Sweden (January), Italy (February), and Denmark (April). In cases where NIS2 has not yet been fully transposed, the applicability of these deadlines may depend on national implementation progress.
In parallel, Greece introduced different registration periods (March and April 2025) depending on the type of entity. Precisely, domain name systems, online marketplaces, search engines, social networks, data centres, network providers, and security services must register earlier than all other entities operating in Greece.
Significant differences can also be observed in the classification of entities. Although the majority of countries introduced a classification of essential and important entities comparable to the provisions of NIS2, a three-tier one (e.g., Germany and Portugal) was proposed in several draft laws with security requirements varying based on the tier to which an entity belongs. Additionally, Finland introduced the same security obligations for both essential and important entities, with differences regarding the ex-ante (essential) and ex-post (important) supervision, as well as maximum sanctions (in alignment with NIS2).
Enforcement
Concerning enforcement, several countries introduced sector-specific authorities (e.g., Croatia, Finland, Ireland, and Sweden) and sectoral CSIRTs (e.g., Austria, Poland, and Spain). Going a step beyond, a number of Member States introduced stricter measures than those enshrined in the Directive. In Hungary, service providers and organisations operating in high-risk and risk sectors must sign an agreement with a certified external auditor company before the end of 2024 to undergo bi-annual audits thereafter. Moreover, entities operating in Romania must conduct an annual self-assessment of their cybersecurity risk management maturity and submit a corrective action plan within 30 days to address deficiencies.
Sanctions generally correspond to NIS2. However, certain countries have incorporated additional measures for multiple levels of offences (e.g., Belgium, Croatia, Greece, Italy, Lithuania, Poland, Slovenia, Portugal, and Spain). For example, the Luxembourg draft considers establishing fines for budgetary bodies under GDPR practices. GDPR is also used to determine the amount and type of penalties based on the severity of the infringement.
The nuances in implementation measures present both challenges and opportunities. Moving forward, regulatory harmonisation can be prioritised through complementary legislative initiatives to NIS2, developing additional guidelines, mutual recognition of security frameworks, and strengthened cooperation between national competent authorities.
Community-sourced information
The information in this section has been crowdsourced from the community. While we strive to ensure its accuracy and relevance, please note that it is subject to review and updates. Once the official sources are published, we will review and finalise the information accordingly.
Saw something wrong? If you have any suggestions or notice any discrepancies, please let us know so we can address them promptly.
Contributors
The NIS2 Directive Transposition Tracker is an initiative powered by the ECSO Policy Analysis & Outreach Stream.
We would like to extend our sincere gratitude to our partners and contributors for their invaluable insights and efforts in compiling this tracker. In particular, the ECSO CISO Community has been instrumental in verifying and creating a comprehensive resource to shed more light on the status of the NIS2 transposition across the EU.
ECSO White Paper
NIS2 Implementation: Challenges and Priorities
This comprehensive publication provides actionable recommendations for institutional stakeholders to enhance the implementation process, as well as a comprehensive analysis of:
- The varying approaches to implementation across EU countries in key cybersecurity areas.
- Results from our Europe-wide survey of cybersecurity practitioners on organizational preparedness.
- Detailed case studies of sectoral implementation.
About the ECSO Policy Analysis & Outreach Stream
The ECSO Policy Analysis and Outreach Stream delivers in-depth policy analysis to ECSO Members, helping them decode and act upon key European cybersecurity developments. The initiative involves close collaboration with EU policymakers and the integration of insights from both public and private sectors. By engaging with European and international stakeholders, it promotes meaningful dialogue for a structured, dynamic European cybersecurity landscape.
Initiative administration
Cristian Michael Tracci
Senior Manager for Policy Analysis and Outreach
cristian.tracci[at]ecs-org.eu
Sebastijan Čutura
Senior Manager, Industry Cybersecurity
sebastijan.cutura[at]ecs-org.eu
Simona Kaneva
Manager for Policy Analysis and Outreach
simona.kaneva[at]ecs-org.eu
Tomasz Michałowski
Junior Manager for European Cyber Security Community
tomasz.michalowski[at]ecs-org.eu
