As of August 2026, NIS2 national laws are in force in Belgium (since October 2024), Denmark (July 2025), Germany (December 2025), Sweden (2026) and the Netherlands (15 August 2026), among other member states. Norway is not yet covered: NIS2 is still being incorporated via the EEA.
NIS2 is an EU directive, so each member state transposes it into national law on its own timeline — which is why obligations, registration portals and deadlines differ per country.
Status in the countries ITSECOPS serves
- Netherlands: the Cyberbeveiligingswet enters into force on 15 August 2026 with no transition period — NCSC registration, duty of care and 24-hour incident reporting apply immediately. Dutch guide.
- Germany: the NIS2UmsuCG has applied since 6 December 2025; the BSI registration grace period ended 31 July 2026. German guide.
- Belgium: first to transpose (law of 26 April 2024); enforcement via the CCB and the CyberFundamentals framework is underway. Belgian guide.
- Denmark: in force since 1 July 2025; CFCS registration closed 1 October 2025 and audits started in 2026. Danish guide.
- Sweden: cybersäkerhetslagen (2025:1506) implements NIS2. Swedish page.
- Norway: digitalsikkerhetsloven (NIS1) applies today; NIS2 is on the way via the EEA. Norwegian guide.
See the full country table on our NIS2 services hub, or book a free NIS2 gap review.