Has my country transposed NIS2 into national law yet?
Check your national government's or cybersecurity authority's website, because the answer differs by country and changes over time. NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. is a directive, so it applies to companies through national laws; Article 41 set the date by which Member States had to adopt them, and several were late. Germany's law, the NIS2UmsuCG, rewrote the BSI Act (BSIG); other countries have passed or are still passing their own acts, often with different names, authorities, registration portals and details. Until your national law is in force, its duties, deadlines and fines do not bind you in the same way, but customers and insurers may already ask for NIS2-level measures, and earlier national cybersecurity rules may still apply. Plan with the directive as the baseline and adjust when your law is final.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.