# NIS2: the national measures each member state has communicated to the Commission

Every national measure the 27 member states have communicated to the European Commission as transposing Directive (EU) 2022/2555 (NIS2) under its Article 41(1), read on **2026-09-21**: **304 measures**. Spain and Ireland had communicated none.

## Files

- `measures.csv`: one row per communicated measure: the state, the identifier EUR-Lex gives the measure, its title as notified (in the state's own language), its type, the date of the act, the date the state notified it, the entry into force, the national journal and the national link where the register has them.
- `measures.json`: the same, grouped by state, with the read date, the source and the Directive's two dates.

## What the register is, and is not

It holds what a state communicated and nothing else. A state whose parliament has passed a law it has not yet notified shows nothing new; a state that notified its framework under the first NIS Directive as partial transposition shows that framework. The dates here are the register's own fields, verbatim.

`principal` marks, per state, the one communicated measure a reader would call its NIS2 law. It is StandardOS's reading, not the register's: the measure of highest rank whose title names the Directive, cybersecurity or network and information security and which was adopted or amended after the Directive, the newest where there are several. France had no such measure on the read date.

## Source

The national implementing measures linked to CELEX 32022L2555 in CELLAR, the Publications Office store behind the EUR-Lex national transposition tab (https://eur-lex.europa.eu/legal-content/EN/NIM/?uri=CELEX:32022L2555), read over SPARQL on 2026-09-21 and regenerated with `scripts/fetch-nis2-transposition.mjs`. The Directive required the measures to be adopted and published by 2024-10-17 and applied from 2024-10-18.

Last verified: 2026-09-21. States communicate measures continuously, so re-read the register before acting on a row.