TrackerEU

NIS2 Country Transposition Tracker

Build a country-by-country NIS2 transposition register from the European Commission status page, national implementation pages, and the Directive's Article 41 deadline.

Use this workflow to avoid stale country assumptions: every status, source URL, last-check date, authority contact, and reasoned-opinion flag should be traceable to an official public source.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
May 27, 2026
Sections
4

Structured answer sets in this page tree.

Primary sources
7

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated May 27, 2026
Overview

This tracker workflow helps teams monitor NIS2 transposition across EU Member States without treating the EU Directive as a complete national-law answer. Start from the Commission's NIS2 transposition page, verify each relevant country page, and keep a dated evidence record for any country-specific compliance decision.

Section 1

What the tracker should and should not decide

The tracker should answer a narrow operational question: what official source did we rely on for each country's NIS2 transposition status, when did we check it, and what follow-up is needed before applying national obligations to a product, service, customer, or legal entity.

Do not use the tracker as a substitute for national legal analysis. The Commission page describes its content as a state of play based on information from Member States and says that it is without prejudice to formal compliance assessment of national transposition measures.

  • Use the Commission country page as the first public source for status and points of contact.
  • Record the national law or authority page only when the official country source links to it or the team has separately verified it.
  • Separate EU-level facts from country-specific duties; Article 41 sets the EU transposition and application dates, while national measures define local implementation.
  • Flag countries for legal review when the source says full transposition was not notified, the country page is stale, or the business operates in a regulated NIS2 sector there.
Sources for this answer
European Commission - NIS2 Directive transposition in EU countries
Commission state-of-play page for NIS2 transposition across EU countries and country implementation links.
Directive (EU) 2022/2555 (NIS2), Article 41
Binding NIS2 legal text for the Member State transposition and application dates.
Section 2

Baseline EU dates and escalation flags

The baseline dates belong in every country row so reviewers can distinguish EU-level deadlines from national implementation status. Article 41 required Member States to adopt and publish measures by 17 October 2024 and apply those measures from 18 October 2024.

The Commission transposition page also records an enforcement signal: on 7 May 2025, the Commission sent reasoned opinions to 19 Member States for failing to notify full transposition of the NIS2 Directive.

  • EU transposition deadline: 17 October 2024.
  • EU application date: 18 October 2024.
  • Reasoned-opinion date to track: 7 May 2025.
  • Member States named in the Commission's 7 May 2025 reasoned-opinion list: Bulgaria, Czechia, Denmark, Germany, Estonia, Ireland, Spain, France, Cyprus, Latvia, Luxembourg, Hungary, the Netherlands, Austria, Poland, Portugal, Slovenia, Finland, and Sweden.
  • Do not infer that every country outside that list is fully transposed; verify the relevant Commission country page before using a status.
Sources for this answer
Directive (EU) 2022/2555 (NIS2), Article 41
Legal source for the transposition deadline and application date.
European Commission - NIS2 Directive transposition in EU countries
Commission source for the 7 May 2025 reasoned-opinion list and country implementation links.
Section 3

Minimum country-row fields

Keep the row structure small enough to update during quarterly reviews and after Commission changes. A useful row stores the country, source, status wording, date checked, internal owner, and why that country matters to the business.

Use exact source wording for status labels. Avoid normalizing country status into simplified labels unless the row also keeps the original source phrase and citation.

  • Country and ISO code.
  • Commission country page URL, with the source checked date.
  • Source status wording, copied as a short phrase rather than paraphrased into a new legal conclusion.
  • Reasoned-opinion flag: yes, no, or not checked, with the 7 May 2025 source when applicable.
  • National authority or CSIRT contact source, only if verified from the country page or another official public source.
  • Business relevance: legal entity, customer market, regulated service, supplier, incident-reporting dependency, or no current exposure.
  • Next action: monitor, legal review, authority validation, local counsel review, customer response update, or no action.
Sources for this answer
European Commission - NIS2 Directive transposition in EU countries
Use this page to reach official country implementation pages and preserve the Commission's status caveat.
European Commission - NIS2 Directive implementation in Italy
Example country implementation page from the Commission source pack; use country pages as row-level evidence where relevant.
European Commission - NIS2 Directive implementation in Sweden
Example country page showing how the Commission records country-specific status and contact information.
Section 4

Review cadence and change triggers

Country status can change outside a product release cycle. Assign one owner to keep the tracker current and one legal reviewer to approve any country-specific interpretation before it is reused in customer answers, contracts, incident playbooks, or product scoping.

A row should be reopened when an official source changes, the business enters a new Member State, a customer asks for local NIS2 evidence, or an incident-reporting workflow depends on a national authority contact.

  • Scheduled review: at least quarterly while transposition and enforcement signals are active.
  • Source-change trigger: Commission page last-update change, country page status change, or new linked national measure.
  • Business trigger: new legal entity, new customer country, new regulated service, new critical supplier, or new incident-reporting dependency.
  • Evidence trigger: missing source URL, missing checked date, broken country link, stale authority contact, or paraphrased status without original wording.
  • Approval trigger: any row used to decide scope, registration, incident notification routing, contract language, or management reporting.
Sources for this answer
European Commission - NIS2 Directive transposition in EU countries
Commission page states that content will be updated as Member State information becomes available.
Directive (EU) 2022/2555 (NIS2), Article 3
Legal source for Member State lists of essential and important entities and recurring review expectations.
Recommended next step

Use this tracker to keep country status decisions source-linked

Sorena can help convert country-by-country NIS2 source checks into a maintained register with source URLs, last-check dates, reviewer approvals, and escalation triggers for national-law follow-up.

Research workflow
Open Research Copilot for NIS2

Ask source-linked questions about NIS2 transposition status, country pages, Article 41 dates, and authority contacts using the cited sources on this page.

Explore next step
Talk to Sorena
Talk through country coverage

Review the Member States that matter to your entities, services, suppliers, and incident-reporting workflows.

Explore next step
Primary sources

References and citations

Directive (EU) 2022/2555 (NIS2)
eur-lex.europa.eu
Referenced sections
  • Binding NIS2 directive text, including Article 41 transposition and application dates and Article 3 entity-list obligations.
"measures necessary to comply"
Directive (EU) 2022/2555 (NIS2), Article 3
eur-lex.europa.eu
Referenced sections
  • Legal source for Member State lists of essential and important entities and recurring review expectations.
"review and, where appropriate, update"
Related guides

Explore more topics

Are managed service providers in scope of NIS2?
NIS2 scope answer for managed service providers and managed security service providers, including service definition, size-cap checks, entity status, and jurisdiction evidence.
EU NIS2 Directive applicability test for entity scope
Stepwise NIS2 applicability test for Annex I and Annex II sectors, medium and large entities, size-independent cases, essential or important classification, jurisdiction, and evidence.
EU NIS2 Directive deadlines and compliance calendar | Article 23 clocks
source-linked NIS2 compliance calendar covering 17 October 2024 transposition, 18 October 2024 application, Article 27 registry data, Article 3 entity lists, Article 23 incident-reporting clocks, and Member State transposition watch items.
FAQ: NIS2 essential vs important entity classification and registration obligations
Plain-English FAQ comparing NIS2 essential entities and important entities, with Article 3 classification rules, shared Article 21 and 23 duties, supervision differences, and evidence to keep.
NIS2 24-hour early warning: what to send and when
Under NIS2 Article 23, covered essential and important entities submit an early warning within 24 hours of becoming aware of a significant incident.
NIS2 72-hour incident notification FAQ
Direct answer on the NIS2 72-hour incident notification: when it is due, what it updates, what it must include, and how to preserve evidence.
NIS2 Annex I and Annex II Sector Scoping Guide
Map NIS2 Annex I and Annex II sectors, entity types, size-cap rules, and essential versus important entity classification with official EU sources.
NIS2 Article 21 control baseline and evidence checklist
Build a NIS2 Article 21 control baseline from the Directive's minimum cybersecurity risk-management measures, proportionality test, supplier duties, and evidence expectations.
NIS2 Article 21 control-by-control evidence checklist
Map NIS2 Article 21 risk-management measures to evidence records for governance, incident handling, continuity, supply chain, testing, cyber hygiene, cryptography, access, assets, and authentication.
NIS2 Article 21 Gap Assessment Workflow: controls, evidence, and owners
Assess NIS2 Article 21 cybersecurity risk-management gaps by mapping current controls to Article 21(2), ownership, evidence, supplier risk, and management review.
NIS2 Article 23 incident notification workflow
Map NIS2 Article 23 reporting duties for significant incidents: 24-hour early warning, 72-hour notification, intermediate reports, final report, recipients, and evidence.
NIS2 Compliance Checklist: scope, controls, reporting
Use this NIS2 compliance checklist to confirm scope, entity classification, management-body duties, Article 21 controls, Article 23 reporting, and evidence.
NIS2 Compliance Guide: scope, controls, reporting, and evidence
A practical NIS2 compliance guide for mapping entity scope, Article 21 risk measures, Article 23 incident reporting, management accountability, and evidence records.
NIS2 Entity Classifier Workflow: essential vs important entity scoping
Classify whether an EU service is out of scope, an important entity, an essential entity, or needs national-authority review under the NIS2 Directive.
NIS2 essential vs important entities: Article 3 scope and supervision guide
Classify NIS2 essential and important entities using Article 3, Annex I and II sector scope, size-cap rules, registration evidence, and the Article 32/33 supervision split.
NIS2 essential vs important entities: supervision regime and audit evidence requirements
Compare NIS2 essential and important entities by scope, Article 21 and 23 duties, Article 32 and 33 supervision, evidence, jurisdiction, and penalties.
NIS2 FAQ: scope, Article 21 controls, incident reporting, and penalties
source-linked NIS2 FAQ for teams deciding whether they are in scope, whether they are essential or important entities, which Article 21 cybersecurity measures apply, how Article 23 incident reporting works, and what penalties and evidence records to plan for.
NIS2 incident clock triage workflow
Triage a possible NIS2 significant incident by recording awareness time, severity, impact, authority route, recipient communications, and Article 23 reporting clocks.
NIS2 Incident Reporting Workflow: 24-hour, 72-hour, and final report steps
Build a NIS2 Article 23 incident reporting workflow with significance triage, CSIRT or authority notification steps, recipient communication, cross-border checks, and evidence records.
NIS2 Management Body Accountability: board duties, training, and evidence
source-linked guide to NIS2 Article 20 management body accountability: approval of Article 21 measures, oversight, liability, training, reporting lines, and evidence.
NIS2 Member State Transposition: What Teams Must Check
How to handle NIS2 Member State transposition: use Article 41 as the EU baseline, then verify national law, authority routing, registration, and incident-reporting details.
NIS2 National Transposition Tracker: EU Member State Evidence Register
Track NIS2 national transposition with Commission country pages, Article 41 dates, reasoned-opinion flags, source wording, authority contacts, and legal review triggers.
NIS2 penalties and fines: Article 34 caps for essential and important entities
NIS2 penalties and fines explained for EU essential and important entities, including Article 34 fine ceilings, Article 21 and 23 triggers, national transposition, and evidence to keep.
NIS2 Registration and Authority Notification Guide
Map NIS2 Article 3 entity-list duties, Article 27 registry submissions, competent-authority contacts, and national registration portal evidence without inventing country deadlines.
NIS2 Requirements: scope, Article 21 controls, reporting, and evidence
Map NIS2 requirements for essential and important entities: scope classification, management-body duties, Article 21 cybersecurity measures, Article 23 incident reporting, and evidence records.
NIS2 Size Cap Rule and Special Scope Cases
Determine whether NIS2 applies under the medium-size rule, regardless-of-size special cases, critical entity rule, and Member State registration lists.
NIS2 size-cap rule: when medium and large entities are in scope
Plain-language FAQ on the NIS2 size-cap rule: medium and large Annex I or II entities, SME thresholds, regardless-of-size exceptions, and evidence to keep.
NIS2 supply chain security program: Article 21 controls, contracts, and evidence
Build a NIS2 Article 21 supply chain security program for direct suppliers and service providers: policy, supplier criteria, contract clauses, monitoring, registry evidence, and source-linked checks.
NIS2 vs CER Directive comparison: cyber obligations and critical-entity resilience
Compare NIS2 and the CER Directive using grounded rows for scope, triggers, evidence, incident handling, supervision, and shared critical-entity work.
NIS2 vs DORA: scope, overlap, and evidence for EU cyber compliance
Compare NIS2 and DORA for EU cyber compliance: covered entities, when DORA replaces NIS2 duties for financial entities, incident reporting, evidence, and supervisory handoffs.
NIS2 vs GDPR breach reporting: EU deadlines and overlap
Compare NIS2 significant-incident reporting with GDPR personal-data-breach reporting, including scope, 24-hour and 72-hour clocks, evidence, and overlap.
NIS2 vs ISO/IEC 27001: legal duties, ISMS evidence, and reuse limits
Compare NIS2 legal obligations with ISO/IEC 27001 ISMS requirements: scope, Article 21 controls, incident clocks, SoA evidence, audits, and certification reuse.
NIS2 vs ISO/IEC 27017: legal duties, cloud controls, and reuse limits
Compare NIS2 legal obligations with ISO/IEC 27017 cloud-service controls: entity scope, Article 21 measures, incident clocks, shared responsibility, evidence, and assurance limits.
NIS2 vs NIS1: what changed in EU cybersecurity compliance
Compare NIS2 with the repealed NIS1 Directive: expanded sectors, essential and important entities, management-body duties, Article 21 controls, Article 23 reporting, and supervision.