Belgium
LiveLaw active since Oct 2024. CCB is supervisory authority. Registration deadline passed.
Croatia
LiveTransposed. ZSIS competent authority. Registration obligations active.
Germany
LiveNIS2UmsuCG in force 6 Dec 2025. Statutory deadline 6 Mar 2026 passed with ~11,500 of ~29,500 registered, ~18,500 by end May. BSI grace period closed 31 Jul 2026; portal access via ELSTER only since 15 Jul. Sector inspections signalled from Aug 2026. Fines up to €10M or 2% turnover.
Hungary
LiveTransposed. SZTFH supervisory authority.
Italy
LiveLegislative decree adopted 2024. ACN competent authority. Registration deadline 28 Feb 2025.
Netherlands
In force 15 Aug 2026Cyberbeveiligingswet adopted: Eerste Kamer 7 Jul 2026, in force 15 Aug 2026, no transition period. NCSC registration (mijn.ncsc.nl) obligatory from that date. 8,000+ entities in scope across 18 sectors. The CER law (Wwke) takes effect the same day.
France
Slipped to autumn 2026Loi Résilience NOT on the July 2026 extraordinary session agenda; AN debate expected September 2026 at the earliest. Blocked over Art 16 bis (encryption). ANSSI supervisory authority; ReCyF referential (20 security objectives) published spring 2026. No parliamentary movement confirmed as at 10 Aug 2026.
Poland
Expected 2026Draft KSC amendment in parliament. CERT Polska / UODO coordination. Date unconfirmed.
Spain
PendingDraft under consultation. CCN-CERT competent authority. No adoption date confirmed.
Austria
Adopted, in force 1 Oct 2026NISG 2026 published BGBl 23 Dec 2025 (NISG 2024 failed in parliament). In force 1 Oct 2026; registration with the new Bundesamt für Cybersicherheit by 31 Dec 2026. ~5,000 entities in scope.
Sweden
LiveCybersäkerhetslagen (SFS 2025:1506) in force since 15 Jan 2026. Coordination with NCSC-SE; sectoral supervisory authorities apply.
Other 16 states
VariesBulgaria, Czech Republic, Denmark, Estonia, Finland, Greece, Ireland, Latvia, Lithuania, Luxembourg, Malta, Portugal, Romania, Slovakia, Slovenia. Status varies, check ENISA transposition tracker.