Skip to main content
Shaping Europe’s digital future

NIS2 Directive transposition in EU countries

The Commission, together with European Union Agency for Network and Information Security, works closely with the Member States to ensure the transposition of the NIS2 Directive into national legislation.

The content represents a state-of-play based on information provided by Member States, and is without prejudice to the formal assessment of the compliance of transposition measures with the requirements of the NIS2 Directive.

On 7 May 2025 the European Commission sent a reasoned opinion to 19 Member States (Bulgaria, Czechia, Denmark, Germany, Estonia, Ireland, Spain, France, Cyprus, Latvia, Luxembourg, Hungary, the Netherlands, Austria, Poland, Portugal, Slovenia, Finland and Sweden) for failing to notify full transposition of the NIS2 Directive.  The 19 Member States have two months to respond and take the necessary measures. Otherwise, the Commission may decide to refer the cases to the Court of Justice of the European Union.

The EU Agency for Cybersecurity (ENISA) is supporting the EU Member States since 2012 to develop, implement and evaluate their National Cyber Security Strategies (NCSS). Since 2017, all EU Member States have published their own NCSS. This interactive map, published by ENISA, provides a comprehensive overview of all NCSS across the EU, including their strategic objectives, implementation measures, and good practices.

Latest News

BlueOLEx promotional visual, text "BlueOLEx, Assessing EU Crisis Management Skills, Cyprus, 4 November 2025" against white background.
  • Press release
  • 04 November 2025

On 4 November 2025, senior cybersecurity officials from EU Member States and the Commission took part in the 2025 edition of the 'Blueprint Operational Level Exercise' (BlueOLEx), marking the first exercise since the adoption of the new EU Cyber Blueprint that clarifies roles and responsibilities in a crisis.

Related Content

Big Picture

The NIS2 Directive establishes a unified legal framework to uphold cybersecurity in 18 critical sectors across the EU. It also calls on Member States to define national cybersecurity strategies and collaborate with the EU for cross-border reaction and enforcement.

Dig deeper