The CRA's 24-hour reporting duty has applied since 11 September 2026. Check whether it reaches you
Start the system

The member states, from the registers

The member states: what applies where, from the registers

One line per state, every cell a row of a register with the day it was read: 24 of the 27 states have communicated an act naming NIS2, 7 have registered a CRA market surveillance authority. Open a state for the full picture and the two scope tools with the state filled in.

member states
27
with a NIS2 act on the register
24
with a CRA market surveillance authority registered
7
EU member states with their NIS2 act, CSIRT, CRA coordinator, CRA enforcer and accreditation body
Member stateNIS2 act, as communicatedNational CSIRTCRA coordinatorCRA enforcerGDPR authorityAccreditation body
Austria dated 23 December 2025CERT.atCERT.atnone registereddsb.gv.atAA
Belgium in force 18 October 2024CCBCCBregisteredwww.autoriteprotectiondonnees.beBELAC
Bulgaria in force 17 February 2026CERT BulgariaCERT Bulgarianone registeredwww.cpdp.bgBAS
Croatia dated 7 February 2024CERT.hrNCSC-HRnone registeredazop.hrHAA
Cyprus in force 25 April 2025CSIRT-CYCSIRT-CYregisteredwww.gov.cy/dataprotectionCYS-CYSAB
Czechia dated 11 June 2025CSIRT.CZNÚKIBnone registereduoou.gov.czCAI
Denmark in force 1 July 2025FE DDISFE DDISnone registeredwww.datatilsynet.dkDANAK
Estonia in force 1 January 2026CERT-EECERT-EEnone registeredwww.aki.eeEAK
Finland dated 9 July 2025NCSC-FINCSC-FIregisteredwww.tietosuoja.fi/enFINAS
France no act naming the DirectiveCERT-FRCERT-FRregisteredwww.cnil.frCOFRAC
Germany in force 6 December 2025CERT-BundCERT-Bundregisteredwww.bfdi.bund.deDAkkS
Greece in force 27 November 2024EL-CSIRTEL-CSIRTnone registeredwww.dpa.grESYD
Hungary dated 27 January 2025NCSC HungaryNCSC Hungarynone registeredwww.naih.huNAH
Ireland nothing communicatedCSIRT-IECSIRT-IEnone registeredwww.dataprotection.ieINAB
Italy dated 11 October 2024CSIRT ItaliaCSIRT Italianone registeredwww.garanteprivacy.itACCREDIA
Latvia in force 1 September 2024CERT.LVCERT.LVregisteredwww.dvi.gov.lvLATAK
Lithuania in force 18 October 2024CERT-LTCERT-LTnone registeredvdai.lrv.ltLA
Luxembourg in force 10 May 2026CIRCL, GOVCERT.LUCIRCLnone registeredcnpd.public.luOLAS
Malta in force 8 April 2025MT-CSIRTMT-CSIRTnone registeredidpc.org.mtNAB-Malta
Netherlands in force 15 August 2026NCSC-NLNCSC-NLnone registeredautoriteitpersoonsgegevens.nlRvA
Poland in force 3 April 2026CERT Polska, CSIRT-GOVCERT Polskanone registereduodo.gov.plPCA
Portugal dated 4 December 2025CERT.PTCERT.PTnone registeredwww.cnpd.ptIPAC
Romania in force 31 December 2024DNSCDNSCnone registeredwww.dataprotection.roRENAR
Slovakia in force 1 January 2025SK-CERTSK-CERTregistereddataprotection.gov.skSNAS
Slovenia in force 19 June 2025SI-CERTSI-CERTnone registeredwww.ip-rs.siSA
Spain nothing communicatedINCIBE-CERTINCIBE-CERTnone registeredwww.aepd.esENAC
Sweden in force 15 January 2026CERT-SECERT-SEnone registeredwww.imy.seSWEDAC

The NIS2 register was read on 23 October 2026, ENISA's coordinator list is dated 10 September 2026, the Commission's register of CRA authorities was read on 13 October 2026.

One workspace for what the state asks and what the buyer asks

StandardOS keeps the ISO 27001 records that answer most of NIS2's Article 21 measures, the incident record the Article 23 and Article 14 clocks run from, and the evidence a supervisor, a coordinator or an auditor asks for, in six languages.

This page in:DeutschFrançaisNederlandsEspañolDansk