NIS2 obligations, country by country
The directive is one text. The obligations that reach you are set by your country's transposition: when you register, which security measures apply, when the first audit falls, and how often it recurs. Pick your country to see the chain that applies, grounded in national law.
Start the free self-checkDenmark
Denmark transposed NIS2 through NIS 2-loven, LOV nr 434, supervised by Styrelsen for Samfundssikkerhed together with a named sector authority for each sector. Energy, telecoms and the financial sector answer to separate Danish rules instead.
Hungary
Hungary transposed NIS2 as Act LXIX of 2024, and the SZTFH audit obligation is live.
Czechia
Czechia transposed NIS2 as Act 264/2025 Sb., supervised by NUKIB.
Slovakia
Slovakia transposed NIS2 through Act 366/2024, amending its Cybersecurity Act 69/2018, supervised by the NBU.
Poland
Poland transposed NIS2 by amending its National Cybersecurity System Act, the KSC.
Romania
Romania transposed NIS2 through OUG 155/2024, approved and amended by Law 124/2025, supervised by the DNSC.
There is no single NIS2 deadline
Every member state transposed NIS2 into its own law, with its own chain of obligations: register, put measures in place, pass a first audit, then repeat on a cycle. The dates below are what those chains look like across five markets.
DenmarkNo audit cycle
No recurring audit. Your authority can demand documentation of your security measures at any time, and require an independent audit.
Hungary30 June 2026
First audit deadline passed
Audits repeat every 2 years.
Poland
Registration deadline, 3 October 2026
Czechia1 year
Measures due 1 year from your registration decision, commonly 31 December 2026.
Slovakia
Transitional period ends, 31 December 2026
Romania150 days
Measures due in stages, 60 plus 60 plus 30 days from your registration.
Audit periodicity is set by DNSC order, still in draft.
Two of these five have no fixed national date at all, because the clock starts from your own registration. One regulator has not set the audit periodicity yet. In Hungary the first audit deadline passed on 30 June, and registered entities missed it.