How do national NIS2 laws differ between EU countries?

In names, authorities, procedures and some details, while the core is the same. Every national law must contain the directive's essentials: the sectors and size rules, the Article 21 measures, management-body duties, the staged reporting of Article 23 and fines of at least the Article 34 levels. Differences you will meet include: who the competent authority and CSIRTCSIRT: computer security incident response team. The national team to which serious incidents are reported. are and how you reach them; the registration portal and its deadlines; whether more entities are brought into scope, such as some public bodies or smaller firms; extra national requirements, such as Germany's systems for attack detection for critical installations (section 31(2) BSIG) or a named security officer; and the procedure and actual amounts of fines. If you operate in several countries, map each subsidiary to its national law and authority, and check each country's law, because local terms and deadlines decide.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 40 questions on NIS2 scope and dutiesAll topics