Service status
EU framework · National implementation
Understand NIS2.
Find the relevant country guidance.
NIS2 creates a common cybersecurity framework across the EU. Your entity’s obligations depend on its activities, the competent state and that state’s implementation.
Find an introduction to the rules and suitable tools. Language, country context and technical measurement are separate choices.
01 · The common framework
An EU directive. National obligations.
NIS2 is Directive (EU) 2022/2555, not a single worldwide law. It covers specified entity types in the sectors of Annexes I and II. Size, cases covered irrespective of size, exemptions and specific EU sector rules all matter. A sector label or the number 50 alone does not determine scope.
The framework includes management responsibility, risk management and reporting significant incidents. Member States transpose it into national law and specify authorities and procedures. The EU transposition deadline is therefore not a common national start date for every obligation.
Which country has jurisdiction?
The starting point is generally where the covered entity is established. Article 26 sets out specific rules: public electronic communications are tied to where services are provided; certain digital providers to their main establishment in the EU. These include DNS, cloud, data centre and managed services, and online marketplaces.
A provider without an EU establishment can also be covered: the providers listed in Article 26(1)(b) offering services in the EU must designate a representative under paragraph 3. The representative’s state has jurisdiction; without a representative, states where services are provided may take action. Being outside the EU is therefore not a blanket exclusion.
A customer’s contractual security requirements for suppliers are a separate matter. A contract does not automatically make a supplier a NIS2 entity. Browser language, IP address, domain suffix and the location of our scanner do not determine this classification.
Legal basis: supply chains and jurisdiction (NIS2 Articles 21 and 26)
02 · National context
From the EU framework to the relevant country
Choose the legal context you need to examine. Each page is available in German and English; changing language preserves its country context. Switzerland and the United Kingdom have separate regimes and are not presented as national NIS2 implementations.
03 · What Wolf-Agents offers
Three tools with different outcomes
None of these tools determines complete legal scope, NIS2 compliance or freedom from liability. A scan does not inspect internal access, training, backups or the entire supply chain. Selecting a country source context in a report does not expand the technical measurement scope.
Build on a reasoned assessment
- Identify the entity, its services, establishments and relevant jurisdiction.
- Check national obligations, deadlines and authorities against official sources.
- Record risks, responsibilities and measures; add technical findings as individual pieces of evidence.
For Germany, the existing guides cover measures, incident reporting, management responsibility and ISO 27001. An ISO certificate and fulfilment of national obligations remain different forms of evidence.
General guidance · EU sources reviewed on . Each country section states its source date and scope.