November 1, 2024

NIS2: Where do European Countries Stand on Implementing Cybersecurity Strategies?

Julia Apostle, Odey Hardan, Adele Harrison, Hanna Hewitt, Rami Kawkabani

+ Follow Contact

Send

Embed

Orrick, Herrington & Sutcliffe LLP

The Network and Information Security 2 Directive (“NIS2”) was implemented into law in the EU on 17 October 2024 (implementing legislation available here). NIS2 expands the scope of the original NIS legislation to include new sectors that the EU deems critical (Annexes I and II of NIS2 Directive set out a list of services covered by the legislation). For more information about the scope of NIS2, read our “5 Things You Need to Know About NIS2” here.

EU Member States had until 17 October 2024 to implement NIS2 into national law. So where do countries stand on implementing NIS2? Here’s a country-by-country look at the status of implementation, current as of this article’s publication date but subject to change.

Country	Status	Legislation*	Commentary
Austria		Available here	Austria has submitted the “Network and Information Security Act” for Parliament’s consideration. It is anticipated that the “Network and Information Security Act” will take effect in June 2025.
Belgium		Available here	Belgium adopted the “Law establishing a framework for the cybersecurity of network and information systems of general interest for public security” on 18 October 2024, implementing NIS2.
Bulgaria		Available here	Bulgaria has submitted the “Cybersecurity Act” for consideration by Parliament at a national level.
Croatia		Available here	Croatia adopted the “Cyber Security Act” on 15 February 2024, implementing NIS2.
Cyprus		Available here	Cyprus intends to transpose NIS2 into local law under the amended “Security of Networks and Information Systems Act 2020.” A public consultation closed on 29 September 2023.
Czech Republic		Available here	The Czech Republic has submitted the “Cybersecurity Act” for consideration by Parliament at a national level.
Denmark		N/A	Denmark has held a public consultation on a proposed draft law. Parliament is expected to consider an updated version of the draft law in February 2025. If passed, the law is anticipated to be effective from 1July 2025.
Estonia		N/A	The implementation of NIS2 has been delayed. No legislation (draft or otherwise) has been made public.
Finland		Available here	The implementation of NIS2 has been delayed. Legislators have not approved legislation.
France		Available here	France has submitted “Resilience of Critical Infrastructures and the Strengthening of Cybersecurity” act for consideration by Parliament and the Senate at a national level. It may take legislators months to finalise this.
Germany		Available here	Germany has submitted the “NIS2 Implementation and Cybersecurity Enhancement Act” for consideration by Parliament at a national level. We expect the Act to go into effect in March 2025.
Greece		Available here	Greece intends to transpose NIS2 into local law. A public consultation on the draft legislation will close on 2November 2024.
Hungary		Available here	Hungary adopted the “Cybersecurity Certification and Cybersecurity Supervision Act,” implementing NIS2. Supporting rules and legislation are under consideration or waiting to be adopted.
Iceland		N/A	Iceland intends to transpose NIS2 into local law, but no draft legislation has been prepared, and there is no timeline for completion.
Ireland		Available here	Ireland has submitted the “National Cyber Security Bill” for Parliament to consider. It is listed in the autumn 2024 legislative programme. However, it is unclear when the bill will be approved.
Italy		Available here	Italy adopted a legislative decree implementing NIS2 on 1 October 2024.
Latvia		Available here	Latvia adopted the “National Cybersecurity Law” on 1 September 2024, implementing NIS2. Supporting rules and legislation are under consideration.
Lichtenstein		Available here	Lichtenstein has submitted the “Cybersecurity Law” for consideration by Parliament at a national level.
Lithuania		Available here	Lithuania adopted the “Law on Cyber Security” on 18 October 2024, implementing NIS2.
Luxembourg		Available here	Luxembourg has submitted a bill for consideration by Parliament at a national level.
Malta		Available here	Malta intends to transpose NIS2 into local law under the “Measures for a High Common Level of Cybersecurity Across the European Union (Malta) Order.” A public consultation closed on 7 October 2024.
Netherlands		Available here	The Netherlands intends to transpose NIS2 into local law under the “Cybersecurity Act.” It is anticipated that the “Cybersecurity Act” will be effective from Q3 2025.
Norway		N/A	Norway intends to transpose NIS2 into local law under the “Digital Security Act.” A public consultation will close on 11 December 2024. No draft legislation has been published.
Poland		Available here	Poland has submitted amendments to the “National Cyber Security System Act” (and certain other acts) for consideration by Parliament at a national level. If passed, the legislation should take effect in Q1 2025.
Portugal		N/A	Portugal has not yet circulated draft legislation, and it is not clear where Portugal stands in the implementation process.
Romania		Available here	Romania intends to transpose NIS2 into local law under the “Law on the establishment of a framework for the cyber security of networks and information systems in the national civil cyberspace.” A public consultation is open.
Slovakia		Available here	Slovakia adopted an amended “Cybersecurity Act” on 2 October 2024, implementing NIS2. This legislation will be effective as of 1 January 2025.
Slovenia		Available here	Slovenia intends to transpose NIS2 into local law under the “Information Security Act.” Legislators are expected to adopt the implementing legislation in December 2024 or January 2025.
Spain		N/A	Spain has not yet circulated draft legislation, and it is not clear where Spain stands in the implementation process.
Sweden		N/A	Sweden intends to transpose NIS2 into local law through a new “Cyber Security Regulation.” It is anticipated that the “Cyber Security Regulation” will be transposed into local law by 1 January 2025.

* Please note that in some instances, legislation (or draft legislation) is only available in local language.

green check icon

NIS2 implementing legislation has been approved and adopted.

yellow watch icon

NIS2 implementing legislation is progressing. Legislation has been proposed, but legislation has not yet been approved, and a final copy of the legislation is not available.

red warning icon

NIS2 implementing legislation has not been published, and timelines for implementation of NIS2 are not clear.

Send Print Report

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations. Attorney Advertising.