NIS2 Transposition Status by Country (2026 Tracker)

Major Member State Themes (2026, qualitative)

• Germany / Netherlands / Belgium / Nordics — active supervisory messaging and sector registration themes frequently discussed by practitioners; expect detailed national guidance packages.
• France / Italy / Spain — national cybersecurity agencies and sector regulators coordinating NIS2 duties; digital-provider and critical-entity lists remain a practical focus.
• Central & Eastern Europe — transposition completed or advanced in many states, with varying register maturity and SME outreach.
• Ireland & smaller markets — lean competent-authority models; cross-border digital providers often watch where management decisions are taken.

What to Verify Locally

1. National transposition act and any amending instruments
2. Competent authority / CSIRT contacts and reporting portals
3. Entity registration or notification duties
4. Sector-specific guidance and implementing measures for digital providers

Update Cadence

Revisit this tracker when your footprint changes (new MS subsidiary, new MSP contract, merger). Treat ENISA and national authority publications as primary sources over vendor blogs — including this one.

How CyberSilo Helps

• Article 21 evidence map and gap tracking in CSA for NIS2
• Article 23 reporting clocks with ThreatHawk SIEM detection workflows
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Is this an official EU transposition scoreboard?

No. It is a qualitative 2026 editorial framing. Confirm national law and authority guidance for each Member State where you operate.

Did every Member State transpose on time?

Transposition pace varied; by 2026 most states have frameworks in force or substantially advanced, but details differ — verify locally.

Where should multi-country groups start?

Identify lead competent authorities per entity, align on Article 21 evidence once, and localise Article 23 reporting contacts.

Related NIS2 Resources

NIS2 hub · Non-EU companies · CSA