We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

TrackerEU

NIS2 Country Implementation Matrix

Turn the -status check into an operational country matrix: applicable national source, competent authority, registration route, incident channel, local implementation delta, and evidence owner.

Use the separate national tracker for legal-status monitoring. Use this page after scope is established to make each relevant Member State route executable without copying assumptions from another country.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
4 sections6 primary sources
Overview

This implementation matrix starts after the EU-level scope decision. For every Member State that matters, record the national source and the operational route for registration, supervision, and incident reporting. Do not use a Commission status label, another country's process, or the Directive alone as a substitute for current national instructions.

Section 1

What the country implementation matrix should decide

The matrix should answer an operational question for each in-scope legal entity and service: which national source applies, which authority or CSIRT route is used, what must be registered or reported, which local details differ from the EU baseline, and who keeps the route current.

Do not turn a -status label into an implementation instruction. The Commission page is a useful index and state of play, but local law and official national authority guidance support the country-specific workflow.

Resolve the Article 26 jurisdiction path before adding a country row. The default is the Member State of establishment. Public electronic communications providers follow each Member State where they provide services; public administrations follow the Member State that established them; and the listed cross-border digital and ICT providers use their Union main establishment. For those providers, main establishment follows where cybersecurity risk-management decisions are predominantly taken, then where cybersecurity operations are carried out, then the Union establishment with the most employees. A provider in that group with no Union establishment must designate a representative where it offers services.

  • Start with the legal entity, covered service, establishment, and Article 26 jurisdiction analysis that makes the country relevant.
  • Record the national implementing source and the official authority or CSIRT instruction used for each operational step.
  • Keep registration, supervision, and incident reporting as separate routes even if one authority operates more than one portal.
  • Escalate unresolved local thresholds, deadlines, forms, language requirements, or sector assignments instead of importing another Member State's answer.
Section 2

Keep the EU baseline separate from the country overlay

The EU baseline belongs in the matrix so reviewers can see which rule comes from the Directive and which instruction comes from national implementation. Article 41 required national measures by 17 October 2024 and application from 18 October 2024, but those dates do not identify a portal, authority, form, or current national procedure.

Historical infringement steps are status evidence, not operating instructions or proof of a country's present position. The Commission sent reasoned opinions to 19 Member States on 7 May 2025, then announced on 8 July 2026 that it would refer Ireland, Spain, France, and the Netherlands to the Court of Justice for failure to notify measures. Keep those dated steps in the national tracker; this matrix needs the current national source and authority instruction.

  • EU baseline: covered-entity classification, Articles 20 and 21 duties, Article 23 reporting sequence, and the jurisdiction framework.
  • Country overlay: national scope choices, authority allocation, registration steps, reporting channel, language or form, procedure, supervision, and penalties.
  • Evidence rule: store the exact national source, what it proves, date checked, reviewer, and any unresolved question.
  • Change rule: reopen the row after a national amendment, authority update, portal change, new establishment, new covered service, or incident-route change.
Section 3

Minimum operational country-row fields

Keep one row per relevant legal entity, service, and country route; split rows when sectors or authorities differ. A status-only row cannot operate registration or incident reporting.

The row should let an incident responder or compliance owner reach the correct current channel without guessing, while preserving the legal reviewer and source trail behind that route.

  • Country, legal entity, establishment or representative, covered service, Annex row, tier, Article 26 jurisdiction basis, and the facts supporting the main-establishment decision where relevant.
  • National implementing law or official government source, exact provision or instruction used, URL, and date checked.
  • Competent authority, single point of contact, and CSIRT, with separate registration, supervision, and incident-reporting routes.
  • Portal URL, form or language requirement, account owner, access test date, backup channel, and submission-receipt location.
  • Country delta from the EU baseline, including local scope choices, registration and reporting timing, authority procedure, supervision, evidence, and penalty points requiring legal confirmation.
  • Business owner, legal reviewer, security or incident owner, next review date, and change triggers.
Section 4

Review cadence and change triggers

Country status can change outside a product release cycle. Assign one owner to keep the tracker current and one legal reviewer to approve any country-specific interpretation before it is reused in customer answers, contracts, incident playbooks, or product scoping.

A row should be reopened when an official source changes, the business enters a new Member State, a customer asks for local NIS2 evidence, or an incident-reporting workflow depends on a national authority contact.

  • Scheduled review: set a cadence based on the row's use and volatility; incident routes and filing access need more frequent checks than historical status notes.
  • Source-change trigger: Commission page last-update change, country page status change, or new linked national measure.
  • Business trigger: new legal entity, new customer country, new regulated service, new critical supplier, or new incident-reporting dependency.
  • Evidence trigger: missing source URL, missing checked date, broken country link, stale authority contact, or paraphrased status without original wording.
  • Approval trigger: any row used to decide scope, registration, incident notification routing, contract language, or management reporting.
Recommended next step

This matrix connects national sources to operational steps

Sorena can help connect each in-scope entity and service to the current national source, registration route, incident channel, local delta, owner, access evidence, and review trigger.

Research workflow
Open Research Copilot for NIS2

Ask questions tied to cited sources about NIS2 transposition status, country pages, Article 41 dates, and authority contacts using the cited sources on this page.

Explore next step
Talk to Sorena
Talk through country coverage

Review the Member States that matter to your entities, services, suppliers, and incident-reporting workflows.

Explore next step
Primary sources

References and citations

European Commission - NIS2 Directive transposition in EU countries
digital-strategy.ec.europa.eu5 citations
Referenced sections
  • Commission state-of-play page for NIS2 transposition, country implementation links, and the 7 May 2025 reasoned-opinion list; the page expressly reserves the formal compliance assessment.
  • Commission state-of-play page for NIS2 transposition across EU countries and country implementation links.
  • Commission source for the 7 May 2025 reasoned-opinion list, its state-of-play caveat, and country implementation links.
Show 2 more
  • Commission index for official country implementation pages and the status caveat that applies to them.
  • Commission page provides a qualified state of play based on information supplied by Member States and links to country implementation pages.
"NIS2 Directive transposition in EU countries"
More quoted passages
"state-of-play based on information provided by Member States"
"failing to notify full transposition"
"without prejudice to the formal assessment"
Directive (EU) 2022/2555 (NIS2), Article 41
eur-lex.europa.eu2 citations
Referenced sections
  • Binding NIS2 legal text for the Member State transposition and application dates.
  • Legal source for the transposition deadline and application date.
"By 17 October 2024"
More quoted passages
"apply those measures from 18 October 2024"
European Commission - Court referrals for failure to transpose NIS2
digital-strategy.ec.europa.eu2 citations
Referenced sections
  • Official 8 July 2026 enforcement update recording referrals concerning Ireland, Spain, France, and the Netherlands; it does not establish the current operational route for any country.
  • Official 8 July 2026 enforcement update for Ireland, Spain, France, and the Netherlands; it is an enforcement event, not a substitute for current national law or authority instructions.
European Commission - NIS2 Directive implementation in Italy
digital-strategy.ec.europa.eu2 citations
Referenced sections
  • Country implementation page example with Commission status wording and points of contact.
  • Example country implementation page linked by the Commission; use official country pages as row-level evidence where relevant.
"Transposed"
More quoted passages
"Status of transposition"
Directive (EU) 2022/2555 (NIS2)
eur-lex.europa.eu
Referenced sections
  • Binding NIS2 directive text, including Article 41 transposition and application dates and Article 3 entity-list obligations.
"measures necessary to comply"
Directive (EU) 2022/2555 (NIS2), Article 3
eur-lex.europa.eu
Referenced sections
  • Legal source for Member State lists of essential and important entities and recurring review expectations.
"review and, where appropriate, update"

Related guides

EU NIS2 Directive applicability test for entity scope

Stepwise NIS2 applicability test for Annex I and Annex II sectors, medium and large entities, size-independent cases, essential or important classification, jurisdiction, and evidence.

EU NIS2 Directive deadlines and compliance calendar | Article 23 clocks

NIS2 compliance calendar for EU transposition, Article 3 and 27 registration updates, Article 23 incident reports, technical measures, and the 2027 review.

NIS2 Annex I and Annex II Sector Scoping Guide

Map NIS2 Annex I and Annex II sectors, entity types, size-cap rules, and essential versus important entity classification with official EU sources.

NIS2 Article 21 control baseline and evidence checklist

Build a NIS2 Article 21 control baseline from the Directive's minimum cybersecurity risk-management measures, proportionality test, supplier duties, and evidence expectations.

NIS2 Article 21 control-by-control evidence checklist

Map NIS2 Article 21 risk-management measures to evidence records for governance, incident handling, continuity, supply chain, testing, cyber hygiene, cryptography, access, assets, and authentication.

NIS2 Article 21 Gap Assessment Workflow: controls, evidence, and owners

Assess NIS2 Article 21 cybersecurity risk-management gaps by mapping current controls to Article 21(2), ownership, evidence, supplier risk, and management review.

Show all related guides (34)

NIS2 Article 23 incident notification workflow

Map NIS2 Article 23 reporting duties for significant incidents: 24-hour early warning, 72-hour notification, intermediate reports, final report, recipients, and evidence.

NIS2 Compliance Checklist: scope, controls, reporting

This NIS2 compliance checklist helps confirm scope, entity classification, management-body duties, Article 21 controls, Article 23 reporting, and evidence.

NIS2 Compliance Guide: scope, controls, reporting, and evidence

A practical NIS2 compliance guide for mapping entity scope, Article 21 risk measures, Article 23 incident reporting, management accountability, and evidence records.

NIS2 Entity Classifier Workflow: essential vs important entity scoping

Classify whether an EU service is out of scope, an important entity, an essential entity, or needs national-authority review under the NIS2 Directive.

NIS2 entity supervision guide

Compare NIS2 essential and important entities by scope, Article 21 and 23 duties, Article 32 and 33 supervision, evidence, jurisdiction, and penalties.

NIS2 essential vs important entities: Article 3 scope and supervision guide

Classify NIS2 essential and important entities using Article 3, Annex I and II sector scope, size-cap rules, registration evidence, and the Article 32/33 supervision split.

NIS2 FAQ: scope, Article 21 controls, incident reporting, and penalties

NIS2 FAQ on entity scope, essential and important classification, Article 21 measures, Article 23 reporting, national implementation, and evidence.

NIS2 incident clock triage workflow

Triage a possible NIS2 significant incident by recording awareness time, severity, impact, authority route, recipient communications, and Article 23 reporting clocks.

NIS2 Incident Reporting Workflow: 24-hour, 72-hour, and final report steps

Build a NIS2 Article 23 incident reporting workflow with significance triage, CSIRT or authority notification steps, recipient communication, cross-border checks, and evidence records.

NIS2 Management Body Accountability: board duties, training, and evidence

A guide to NIS2 Article 20 management body accountability: approval of Article 21 measures, oversight, national liability rules, training, reporting lines, and evidence.

NIS2 National Transposition Tracker: EU Member State Evidence Register

Track NIS2 national transposition with Commission country pages, Article 41 dates, reasoned-opinion flags, source wording, authority contacts, and legal review triggers.

NIS2 penalties and fines: Article 34 maximum levels and factors

NIS2 Article 34 fine levels, calculation factors, enforcement measures, GDPR overlap, and national-law checks for essential and important entities.

NIS2 Registration and Authority Notification Guide

Map NIS2 Article 3 entity lists, Article 27 registry submissions, competent authorities, national filing routes, required data, and change-notification deadlines.

NIS2 Requirements: scope, Article 21 controls, reporting, and evidence

Map NIS2 requirements for essential and important entities: scope classification, management-body duties, Article 21 cybersecurity measures, Article 23 incident reporting, and evidence records.

NIS2 Size Cap Rule and Special Scope Cases

Apply the NIS2 medium-size test, group-data rules, regardless-of-size cases, exclusions, and essential-versus-important classification.

NIS2 Supply Chain Security Program: Article 21 Guide

Apply NIS2 Article 21 to direct suppliers and service providers, and distinguish its general duty from Regulation 2024/2690's digital-entity controls.

NIS2 vs CER Directive comparison: cyber obligations and critical-entity resilience

Compare NIS2 and the CER Directive using cited rows for scope, triggers, evidence, incident handling, supervision, and shared critical-entity work.

NIS2 vs DORA: scope, overlap, and evidence for EU cyber compliance

Compare NIS2 and DORA for EU cyber compliance: covered entities, when DORA replaces NIS2 duties for financial entities, incident reporting, evidence, and supervisory handoffs.

NIS2 vs GDPR breach reporting: EU deadlines and overlap

Compare NIS2 significant-incident reporting with GDPR personal-data-breach reporting, including scope, 24-hour and 72-hour clocks, evidence, and overlap.

NIS2 vs ISO/IEC 27001: legal duties, ISMS evidence, and reuse limits

Compare NIS2 legal obligations with ISO/IEC 27001 ISMS requirements: scope, Article 21 controls, incident clocks, SoA evidence, audits, and certification reuse.

NIS2 vs ISO/IEC 27017: legal duties, cloud controls, and reuse limits

Compare NIS2 legal obligations with ISO/IEC 27017 cloud-service controls: entity scope, Article 21 measures, incident clocks, shared responsibility, evidence, and assurance limits.

NIS2 vs NIS1: what changed in EU cybersecurity compliance

Compare NIS2 with the repealed NIS1 Directive: expanded sectors, essential and important entities, management-body duties, Article 21 controls, Article 23 reporting, and supervision.

Are managed service providers in scope of NIS2?

NIS2 scope answer for managed service providers and managed security service providers, including service definition, size-cap checks, entity status, and jurisdiction evidence.

NIS2 24-hour early warning: what to send and when

Under NIS2 Article 23, covered essential and important entities submit an early warning within 24 hours of becoming aware of a significant incident.

NIS2 72-hour incident notification FAQ

NIS2 incident-notification deadline, required initial assessment, evidence, follow-up, and the 24-hour trust-service-provider exception.

NIS2 entity classification FAQ

Plain-English FAQ comparing NIS2 essential entities and important entities, with Article 3 classification rules, shared Article 21 and 23 duties, supervision differences, and evidence to keep.

NIS2 Member State Transposition: What Teams Must Check

How to handle NIS2 Member State transposition: use Article 41 as the EU baseline, then verify national law, authority routing, registration, and incident-reporting details.

NIS2 size-cap rule: when medium and large entities are in scope

Plain-language FAQ on the NIS2 size-cap rule: medium and large Annex I or II entities, SME thresholds, regardless-of-size exceptions, and evidence to keep.