NIS2: Where do European Countries Stand on Implementing Cybersecurity Strategies?

Country

Status

Legislation*

Commentary

Austria

Available here

Austria has submitted the “Network and Information Security Act” for Parliament’s consideration. It is anticipated that the “Network and Information Security Act” will take effect in June 2025.

Belgium

Available here

Belgium adopted the “Law establishing a framework for the cybersecurity of network and information systems of general interest for public security” on 18 October 2024, implementing NIS2.

Bulgaria

Available here

Bulgaria has submitted the “Cybersecurity Act” for consideration by Parliament at a national level.

Croatia

Available here

Croatia adopted the “Cyber Security Act” on 15 February 2024, implementing NIS2.

Cyprus

Available here

Cyprus intends to transpose NIS2 into local law under the amended “Security of Networks and Information Systems Act 2020.” A public consultation closed on 29 September 2023.

Czech Republic

Available here

The Czech Republic has submitted the “Cybersecurity Act” for consideration by Parliament at a national level.

Denmark

N/A

Denmark has held a public consultation on a proposed draft law. Parliament is expected to consider an updated version of the draft law in February 2025. If passed, the law is anticipated to be effective from 1July 2025.

Estonia

N/A

The implementation of NIS2 has been delayed. No legislation (draft or otherwise) has been made public.

Finland

Available here

The implementation of NIS2 has been delayed. Legislators have not approved legislation.

France

Available here

France has submitted “Resilience of Critical Infrastructures and the Strengthening of Cybersecurity” act for consideration by Parliament and the Senate at a national level. It may take legislators months to finalise this.

Germany

Available here

Germany has submitted the “NIS2 Implementation and Cybersecurity Enhancement Act” for consideration by Parliament at a national level. We expect the Act to go into effect in March 2025.

Greece

Available here

Greece intends to transpose NIS2 into local law. A public consultation on the draft legislation will close on 2November 2024.

Hungary

Available here

Hungary adopted the “Cybersecurity Certification and Cybersecurity Supervision Act,” implementing NIS2. Supporting rules and legislation are under consideration or waiting to be adopted.

Iceland

N/A

Iceland intends to transpose NIS2 into local law, but no draft legislation has been prepared, and there is no timeline for completion.

Ireland

Available here

Ireland has submitted the “National Cyber Security Bill” for Parliament to consider. It is listed in the autumn 2024 legislative programme. However, it is unclear when the bill will be approved.

Italy

Available here

Italy adopted a legislative decree implementing NIS2 on 1 October 2024.

Latvia

Available here

Latvia adopted the “National Cybersecurity Law” on 1 September 2024, implementing NIS2. Supporting rules and legislation are under consideration.

Lichtenstein

Available here

Lichtenstein has submitted the “Cybersecurity Law” for consideration by Parliament at a national level.

Lithuania

Available here

Lithuania adopted the “Law on Cyber Security” on 18 October 2024, implementing NIS2.

Luxembourg

Available here

Luxembourg has submitted a bill for consideration by Parliament at a national level.

Malta

Available here

Malta intends to transpose NIS2 into local law under the “Measures for a High Common Level of Cybersecurity Across the European Union (Malta) Order.” A public consultation closed on 7 October 2024.

Netherlands

Available here

The Netherlands intends to transpose NIS2 into local law under the “Cybersecurity Act.” It is anticipated that the “Cybersecurity Act” will be effective from Q3 2025.

Norway

N/A

Norway intends to transpose NIS2 into local law under the “Digital Security Act.” A public consultation will close on 11 December 2024. No draft legislation has been published.

Poland

Available here

Poland has submitted amendments to the “National Cyber Security System Act” (and certain other acts) for consideration by Parliament at a national level. If passed, the legislation should take effect in Q1 2025.

Portugal

N/A

Portugal intends to transpose NIS2 into local law. A public consultation on the draft legislation is ongoing, following which the legislation will be approved by the Portuguese Government and Parliament.

Romania

Available here

Romania intends to transpose NIS2 into local law under the “Law on the establishment of a framework for the cyber security of networks and information systems in the national civil cyberspace.” A public consultation is open.

Slovakia

Available here

Slovakia intends to transpose NIS2 into local law under the "Cybersecurity Act". The proposed date of effect is 1 January 2025, however the next step is for the legislation to be considered by Parliament.

Slovenia

Available here

Slovenia intends to transpose NIS2 into local law under the “Information Security Act.” Legislators are expected to adopt the implementing legislation in December 2024 or January 2025.

Spain

N/A

Spain has not yet circulated draft legislation, and it is not clear where Spain stands in the implementation process.

Sweden

N/A

Sweden intends to transpose NIS2 into local law through a new “Cyber Security Regulation.” It is anticipated that the “Cyber Security Regulation” will be transposed into local law by 1 January 2025.