StandardOS

The member states, from the registers

The member states: what applies where, from the registers

One line per state, every cell a row of a register with the day it was read: 24 of the 27 states have communicated an act naming NIS2, 7 have registered a CRA market surveillance authority. Open a state for the full picture and the two scope tools with the state filled in.

EU member states with their NIS2 act, CSIRT, CRA coordinator, CRA enforcer and accreditation body
Member stateNIS2 act, as communicatedNational CSIRTCRA coordinatorCRA enforcerGDPR authorityAccreditation body
Austriadated 23 December 2025CERT.atCERT.atnone registeredwww.dsb.gv.atAA
Belgiumin force 18 October 2024CCBCCBregisteredwww.autoriteprotectiondonnees.beBELAC
Bulgariain force 17 February 2026CERT BulgariaCERT Bulgarianone registeredwww.cpdp.bgBAS
Croatiadated 7 February 2024CERT.hrNCSC-HRnone registeredwww.azop.hrHAA
Cyprusin force 25 April 2025CSIRT-CYCSIRT-CYregisteredwww.dataprotection.gov.cyCYS-CYSAB
Czechiadated 11 June 2025CSIRT.CZNÚKIBnone registereduoou.gov.czCAI
Denmarkin force 1 July 2025FE DDISFE DDISnone registeredwww.datatilsynet.dkDANAK
Estoniain force 1 January 2026CERT-EECERT-EEnone registeredwww.aki.eeEAK
Finlanddated 9 July 2025NCSC-FINCSC-FIregisteredwww.tietosuoja.fi/enFINAS
Franceno act naming the DirectiveCERT-FRCERT-FRregisteredwww.cnil.frCOFRAC
Germanyin force 6 December 2025CERT-BundCERT-Bundregisteredwww.bfdi.bund.deDAkkS
Greecein force 27 November 2024EL-CSIRTEL-CSIRTnone registeredwww.dpa.grESYD
Hungarydated 27 January 2025NCSC HungaryNCSC Hungarynone registeredwww.naih.huNAH
Irelandnothing communicatedCSIRT-IECSIRT-IEnone registeredwww.dataprotection.ieINAB
Italydated 11 October 2024CSIRT ItaliaCSIRT Italianone registeredwww.garanteprivacy.itACCREDIA
Latviain force 1 September 2024CERT.LVCERT.LVregisteredwww.dvi.gov.lvLATAK
Lithuaniain force 18 October 2024CERT-LTCERT-LTnone registeredvdai.lrv.ltLA
Luxembourgin force 10 May 2026CIRCL, GOVCERT.LUCIRCLnone registeredwww.cnpd.luOLAS
Maltain force 8 April 2025MT-CSIRTMT-CSIRTnone registeredwww.idpc.org.mtNAB-Malta
Netherlandsin force 15 August 2026NCSC-NLNCSC-NLnone registeredautoriteitpersoonsgegevens.nlRvA
Polandin force 3 April 2026CERT Polska, CSIRT-GOVCERT Polskanone registereduodo.gov.plPCA
Portugaldated 4 December 2025CERT.PTCERT.PTnone registeredwww.cnpd.ptIPAC
Romaniain force 31 December 2024DNSCDNSCnone registeredwww.dataprotection.roRENAR
Slovakiain force 1 January 2025SK-CERTSK-CERTregisteredwww.dataprotection.gov.skSNAS
Sloveniain force 19 June 2025SI-CERTSI-CERTnone registeredwww.ip-rs.siSA
Spainnothing communicatedINCIBE-CERTINCIBE-CERTnone registeredwww.aepd.esENAC
Swedenin force 15 January 2026CERT-SECERT-SEnone registeredwww.imy.seSWEDAC

The NIS2 register was read on 12 September 2026, ENISA's coordinator list is dated 10 September 2026, the Commission's register of CRA authorities was read on 11 September 2026.

One workspace for what the state asks and what the buyer asks

StandardOS keeps the ISO 27001 records that answer most of NIS2's Article 21 measures, the incident record the Article 23 and Article 14 clocks run from, and the evidence a supervisor, a coordinator or an auditor asks for, in six languages.

Start 14-day free trialNIS2 for a software company