The Directive (EU) 2022/2555, commonly known as NIS2 (Network and Information Security) is a directive of the European Union aimed at protecting digital infrastructure, in particular critical infrastructure.
It broadened the sectors covered by EU network and information security rules and updated incident reporting and oversight compared to the NIS1. Member States were required to transpose NIS2 by 17 October 2024, and the earlier NIS Directive was repealed on 18 October 2024.
Only 23 Member States have fully implemented the measures contained with the NIS Directive. Infringement proceedings against them to enforce the Directive have not taken place, and they are not expected to take place in the near future. This failed implementation has led to the fragmentation of cybersecurity capabilities across the EU, with differing standards, incident reporting requirements and enforcement requirements being implemented in different Member States.
From the EFTA countries (to April 2026) only Liechtenstein has fully transposed the NIS2 Directive. While the EFTA commission is conducting preparations to transpose the directive into its legislation.
National implementations
Czech Republic It is implemented through the Act No. 264/2025 Coll. also called Zákon o kybernetické bezpečnosti (Cybersecurity law) and through another five implementing regulations. The transposing legislation came into force on November 1st, 2025.
Poland It is implemented through the Act of 23 January 2026 amending the Act on the National Cybersecurity System (ustawa o zmianie ustawy o krajowym systemie cyberbezpieczeństwa oraz niektórych innych ustaw), published in the Journal of Laws on 2 March 2026 (Dz.U. 2026 item 252). It came into force on 3 April 2026, after the EU transposition deadline of 17 October 2024. Entities that qualify as essential or important had to apply for entry in the national register by 3 October 2026 and have until 3 April 2027 to implement the required security measures. Administrative fines reach €10 million or 2% of total worldwide annual turnover for essential entities, and €7 million or 1.4% for important entities.
Germany It is implemented through the Gesetz zur Umsetzung der NIS-2-Richtlinie und zur Regelung wesentlicher Grundzüge des Informationssicherheitsmanagements in der Bundesverwaltung.
Ireland It is implemented through the National Cyber Security Bill.
The Netherlands It is implemented through the Cyberbeveiligingswet (Cbw).
Slovakia It is implemented through via an amendment of the Act No. 69/2018 Coll. also called Zákon o kybernetickej bezpečnosti a o zmene a doplnení niektorých zákonov (Law on Cybersecurity and change and amendment of certain laws). It came into force on November 1st, 2025.
Spain Its not implemented in Spain yet.
Sweden It is implemented through Cybersäkerhetslag (2025:1506).
Further reading
References
External links