NIS2 Transposition Tracker
NIS2 is an EU directive, not a regulation: it does not apply directly. Each of the 27 member states has to pass its own national law transposing it, on its own timeline, and the specifics (scope, penalties, enforcement body) can differ by country even though the directive sets a floor. The original deadline was October 17, 2024. As of the most recent verification, 23 of 27 member states have a transposition law in force.
Transposition law in force23
- Belgium
Among the earliest to complete transposition.
- Bulgaria
- Croatia
Among the earliest to complete transposition.
- Cyprus
- Czech Republic
- Denmark
- Estonia
- Finland
- Germany
- Greece
- Hungary
Among the earliest to complete transposition.
- Italy
Among the earliest to complete transposition.
- Latvia
- Lithuania
- Luxembourg
- Malta
- Netherlandsin force 2026-08-15
Entered into force just over five weeks after the European Commission announced its CJEU referral decision.
- Poland
- Portugal
- Romania
- Slovakia
- Slovenia
- Sweden
Law adopted, not yet in force1
- Austria
The only member state with an adopted transposition law not yet in force.
Referred to the CJEU for non-transposition3
- France
No adopted transposition law; referred to the CJEU by the European Commission for failing to notify transposition measures.
- Ireland
No adopted transposition law; referred to the CJEU by the European Commission for failing to notify transposition measures.
- Spain
No adopted transposition law; referred to the CJEU by the European Commission for failing to notify transposition measures.
What this means for a compliance career
A NIS2 & DORA Compliance Manager working across multiple EU markets can't treat the directive as one uniform rule. A company operating in Germany and France is subject to two different national laws with two different enforcement postures right now, one in force, one still working through the legislative process after a Court of Justice referral. Tracking which version of NIS2 applies where, and when that changes, is a real, ongoing part of the job.
Where to go next
Three next steps depending on where you are. The first two are free.
Free · 2 minutes
Start with the AI Risk Score
Two minutes. Tells you how exposed your current role is to AI automation and which defensive moves carry the best return.
Start the AI Risk Score →Paid program · $147-$597
Aligned course: GRC and Compliance Fundamentals
Capstone reviewed by the founder, published rubric, Ed25519-signed verifiable credential on completion.
View the course →Free account
Save your results and track progress
A free account stores your assessments, recommendations, and an exportable copy of your Career DNA. No card needed.
Create your account →Educational Information Only
This page provides general educational information about cybersecurity laws and regulations. It does not constitute legal advice, legal interpretation, or a substitute for professional legal counsel. Laws change frequently. Always consult a qualified attorney and verify current requirements directly from official government sources before making compliance decisions. DecipherU is not a law firm and does not provide legal services.
Sources
- European Commission: NIS2 Directive transposition tracking · Official EU transposition status and referral decisions