TranspositionEU

EU NIS2 Directive (EU) 2022/2555 National Transposition Tracker

Track Member State implementation, authorities, and reporting routes.

Output: a repeatable country overlay tracker with legal status, authority routes, and portal details.

Author
Sorena AI
Published
Feb 23, 2026
Updated
Feb 23, 2026
Sections
3

Structured answer sets in this page tree.

Primary sources
3

Cited legal and guidance references.

Publication metadata
Sorena AI
Published Feb 23, 2026
Updated Feb 23, 2026
Overview

NIS2 is implemented through national law and supervision. Even a strong EU baseline is not enough on its own. You need a country overlay that tracks local law, authority routes, incident portals, and any registration or listing mechanics that affect your entity.

Section 1

What the Commission tracker tells you and what it does not

The Commission tracker is the right starting point for transposition monitoring, but the page itself says it is based on information provided by Member States and is without prejudice to the formal assessment of compliance.

  • 7 May 2025: the Commission sent reasoned opinions to 19 Member States for failing to notify full transposition.
  • Those 19 Member States were Bulgaria, Czechia, Denmark, Germany, Estonia, Ireland, Spain, France, Cyprus, Latvia, Luxembourg, Hungary, the Netherlands, Austria, Poland, Portugal, Slovenia, Finland, and Sweden.
  • 1 July 2025: the transposition tracker page showed its latest update date.
  • Use the tracker as the EU-level state-of-play page, then confirm the operational details on national authority and CSIRT pages.
Section 2

What to track per Member State

A good country overlay is short, explicit, and operational. It should tell engineers, counsel, and incident responders exactly what changes in that country.

  • Competent authority, CSIRT, and single point of contact names, URLs, contacts, and submission channels.
  • Scope and identification mechanics: registration duty, entity-list logic, authority notices, or sector-specific designation model.
  • Reporting route: where early warnings, notifications, and final reports go, including language, format, and portal constraints.
  • Local penalties and enforcement approach, including whether national law adds periodic penalty payments or officer-level measures.
  • Any sector overlays or Article 4 equivalence issues that affect how NIS2 applies.
Section 3

How to maintain the tracker

Tracking must have an owner and a review cycle. Otherwise, your runbooks drift away from the law and from the actual reporting channels.

  • Assign one accountable owner per country overlay and one backup owner.
  • Review high-risk countries monthly and all active countries at least quarterly.
  • When an overlay changes, update the scope memo, incident reporting runbook, and authority contact list immediately.
  • Store a last-verified date and source links for each overlay so the evidence survives scrutiny.
Recommended next step

Use EU NIS2 Directive (EU) 2022/2555 National Transposition Tracker as a cited research workflow

Research Copilot can take EU NIS2 Directive (EU) 2022/2555 National Transposition Tracker from getting cited answers and faster research on this topic to a reusable workflow inside Sorena. Teams working on EU NIS2 Directive (EU) 2022/2555 can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

Primary sources

References and citations

Related guides

Explore more topics

Applicability Test | EU NIS2 Directive (EU) 2022/2555 | In Scope? Essential vs Important?
A grounded NIS2 applicability test: map each legal entity to Annex I or Annex II, apply the NIS2 size-cap rule and regardless-of-size triggers.
Article 21 Control Baseline | EU NIS2 Directive (EU) 2022/2555 | Cybersecurity Risk Management Measures
A practical Article 21 control baseline for NIS2: translate Article 21(2)(a) to (j) into owned controls, KPIs, tests, and evidence.
Checklist | EU NIS2 Directive (EU) 2022/2555 | Audit-Ready Owners, Evidence, Acceptance Criteria
An audit-ready EU NIS2 compliance checklist: scope (Annex I/II + size-cap rules), essential vs important classification, Article 21 control baseline.
Compliance Guide | EU NIS2 Directive (EU) 2022/2555 | Build an Audit-Ready Program
A practical EU NIS2 compliance guide: how to run scope and classification, build Article 21 controls, implement Article 23 reporting workflows.
Deadlines and Compliance Calendar | EU NIS2 Directive (EU) 2022/2555 | 16 January 2023, 17 October 2024, 17 April 2025
A practical EU NIS2 deadlines and compliance calendar with the legal anchor dates that matter: entry into force on 16 January 2023.
FAQ | EU NIS2 Directive (EU) 2022/2555 | Scope, Essential vs Important, Article 21, Article 23 (24h/72h)
High-intent EU NIS2 FAQ: who is in scope, how essential vs important works, what Article 21 requires.
Incident Reporting Workflow | EU NIS2 Directive (EU) 2022/2555 | 24h Early Warning, 72h Notification, Final Report (1 Month)
A practical NIS2 incident reporting workflow grounded in Article 23 and Commission Implementing Regulation (EU) 2024/2690: define significant incidents.
Management Body Accountability | EU NIS2 Directive (EU) 2022/2555 | Article 20 Governance, Training, Liability
A practical Article 20 governance guide for EU NIS2: what the management body must approve and oversee, how liability and training work.
NIS2 vs ISO/IEC 27001 | How to Reuse Your ISMS for EU NIS2 Directive (EU) 2022/2555
A practical NIS2 vs ISO/IEC 27001 mapping: how to reuse an ISMS (risk assessment, policies, internal audits, management review.
NIS2 vs ISO/IEC 27017 | Cloud Security Mapping for EU NIS2 Directive (EU) 2022/2555
A practical mapping for cloud teams: how NIS2 Article 21 controls and Article 23 reporting apply to cloud service providers and cloud-dependent organisations.
NIS2 vs NIS1 | Directive (EU) 2022/2555 vs Directive (EU) 2016/1148 | Scope, Supervision, Reporting
A practical comparison of NIS2 vs NIS1: what changed in scope and sectors, how essential vs important works.
Penalties and Fines | EU NIS2 Directive (EU) 2022/2555 | Article 32-34 Enforcement + Fine Thresholds
A practical NIS2 enforcement guide: how supervision works for essential vs important entities (Articles 32-33), what enforcement measures authorities can use.
Requirements | EU NIS2 Directive (EU) 2022/2555 | Article 20 Governance, Article 21 Controls, Article 23 Reporting
A practical EU NIS2 requirements breakdown grounded in Articles 20 to 23, the Article 3 and Article 4 guidelines, and Implementing Regulation (EU) 2024/2690.
Scope: Essential vs Important | EU NIS2 Directive (EU) 2022/2555 | Article 3 Classification + What Changes
A practical guide to NIS2 scope classification: how essential vs important entities work (Article 3).
Supply Chain Security Program | EU NIS2 Directive (EU) 2022/2555 | Article 21(d) Supplier Risk + Evidence
A practical NIS2 supply chain security program (Article 21(d)): vendor tiering, security requirements, onboarding/offboarding controls, continuous assurance.