NIS2 in October 2026: where transposition stands

Published 19 October 2026 · By Dazr

Two years after the deadline, four Member States are before the EU Court of Justice, while Germany, the Netherlands and Austria now apply NIS2 laws.

Member States had until 17 October 2024 to turn the NIS2 Directive into national law. Two years on, most have done so, a few are still working on it, and the European Commission has taken four of them to court.

Four countries referred to the Court of Justice

On 8 July 2026 the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for failing to notify full transposition of NIS2. It asked the Court for financial sanctions: a lump sum, plus daily penalties until transposition is complete. The procedure began with letters of formal notice on 28 November 2024, followed by reasoned opinions on 7 May 2025.

Laws that now apply

Germany: the NIS2 Implementation Act was published in the Federal Law Gazette on 5 December 2025 (BGBl. 2025 I Nr. 301) and has applied since 6 December 2025. Entities had three months to register with the BSI. The BSI notes that this deadline has passed and asks anyone not yet registered to do so straight away.
Netherlands: the Cyberbeveiligingswet (Cbw) entered into force on 15 August 2026, after the referral, together with the Critical Entities Resilience Act (Wwke). It replaces the Wbni, and entities must register with the NCSC.
Austria: the NISG 2026 (BGBl. I Nr. 94/2025) has applied since 1 October 2026 and replaces the NISG 2018.
Italy: Legislative Decree 138/2024 has applied since 16 October 2024.

Still in progress

France: the bill on the resilience of critical infrastructure and cybersecurity, which transposes NIS2 together with the CER Directive and the DORA Directive, passed the Senate at first reading on 12 March 2025. The Assemblée nationale committee adopted its version on 10 September 2025, and the bill has not yet completed its passage.
Spain: the Council of Ministers approved the draft Law on Coordination and Governance of Cybersecurity on 14 January 2025. Until a new law is published in the BOE, Royal Decree-law 12/2018, which transposed the first NIS Directive, remains in force.
Ireland: the General Scheme of the National Cyber Security Bill was published in August 2024. The Bill has not yet been enacted.

Amendments proposed

On 20 January 2026 the Commission proposed targeted amendments to NIS2 as part of a cybersecurity package: simpler rules on which country is competent, streamlined collection of data on ransomware attacks and a new category of small mid-cap enterprises. The Commission estimates the changes would ease compliance for 28,700 companies. They are proposals; the current directive and the national laws apply until they are adopted.

What this means in practice

Check every country you operate in. Registration duties, authorities, deadlines and fines are set nationally and differ.
Register first. Where a law applies, registration with the national authority is usually the first deadline, and often a short one.
Do not wait for a late law. Your obligations come from national law, so they start when that law applies. Customers and public buyers already ask for the measures of Article 21 and for supplier assurance, and Implementing Regulation (EU) 2024/2690 sets out those measures in detail for digital service providers.

Sources

For information only, not legal advice. Last updated 19 October 2026.

Topics: NIS2, EU, Transposition

Also available in: Nederlands, Italiano, Deutsch, Français, Español, Polski, Português, Română, Čeština, Slovenčina, Dansk, Svenska, Norsk bokmål