Choose country and language separately
An English page about Germany remains a Germany page. Select the legal context by examining the entity, its activities and jurisdiction rules. Language, domain suffix and the location of an individual customer do not replace that assessment.
National publication, entry into force, specific transitional deadlines and individual authority notices are different events. An implementing act in force does not therefore give every entity the same deadline. Understand EU jurisdiction under Article 26.
Germany and Austria
Germany: BSIG and BSI
The implementation generally applies from 6 December 2025. The country page explains scope, jurisdiction, obligations and registration and links to the four German legal guides. The scope check contains a bounded BSIG rule path; the readiness check concerns Germany only.
Austria: NISG 2026 and BCS
The NISG 2026 has been in force since 1 October 2026. The country page separates jurisdiction, classification and deadlines, including the BCS guidance on initial registration. The Austrian scope check uses its own rules; the German readiness score is not applied to Austria.
France: separate the legislative process from current rules
On review on 8 October 2026, the consulted Assemblée nationale pages still present the critical infrastructure resilience and cybersecurity proposal as legislation in progress. The current committee page lists a further meeting on 14 October. An earlier announcement for 7 October establishes neither completed enactment nor entry into force.
ANSSI information is useful for preparation. Drafts and working materials must not be presented as a national NIS2 catalogue already in force. Existing sectoral security and data protection obligations need independent examination. A French source context in a technical report also does not determine French NIS2 scope.
Next step: Check the current legislative stage and actual promulgation; then examine commencement, implementing details and the entity separately. No French classification calculator is provided here.
Assemblée nationale: legislative dossier · Special committee and agenda · ANSSI: NIS2
Italy: the act, ACN rules and the individual notice
Legislative Decree No. 138 of 4 September 2024 was published on 1 October 2024 and entered into force on 16 October 2024. The Agenzia per la cybersicurezza nazionale (ACN) is the national competent NIS authority. Scope, registration and classification as essential or important have specific national rules.
Entry into force is not the start of every individual duty. ACN distinguishes implementation phases and connects baseline duties to the notice of inclusion in the NIS list. Its current legislation page includes baseline specifications 379907/2025 and determination 127434/2026 on deadlines for entities listed in 2026. Older general timelines cannot therefore simply be applied to a new case.
Next step: Examine the entity type, registration, received ACN notice and relevant current implementing measures together. A DE/AT result provides no Italian classification or deadline.
Official Gazette: D.Lgs. 138/2024 · ACN: legislation and current implementing measures · ACN: registration
The Netherlands: Cyberbeveiligingswet and implementing rules
The Cyberbeveiligingswet was published as Staatsblad 2026, 187. Article 35 of the Cyberbeveiligingsbesluit (Staatsblad 2026, 189) brings both the act and decree into force on 15 August 2026. An older statement that transposition is still pending would be outdated for this source position.
Entity type, size and special inclusion rules determine scope. Statutory security and reporting duties are specified through the decree and, where applicable, sectoral rules. Certain digital services also need to consider directly applicable EU implementing rules.
Next step: Use the NCSC information to identify the registration channel and competent sector supervisor, then check the applicable measures and reporting requirements. Our country guidance does not replace that national assessment.
Cyberbeveiligingswet · Cyberbeveiligingsbesluit, Art. 35 · NCSC: registration
Belgium: national supervision and conformity assessment
Belgium’s NIS2 Act of 26 April 2024 has been in force since 18 October 2024 (Article 98). It governs matters including scope, security measures and incident reporting. The Centre for Cybersecurity Belgium (CCB) is the national cybersecurity authority; sectoral authorities may also be involved.
An important national distinction: Article 39 provides for periodic conformity assessment of essential entities; important entities may use the route in Article 41 voluntarily. Article 42 associates the specified assessment with a rebuttable presumption regarding the obligations in Article 30. The Royal Decree of 9 June 2024 governs permitted frameworks, assessors and procedures, including an ISO/IEC 27001 route.
This is not a blanket exemption based on any ISO certificate. Scope, recognised assessor and the national procedure must match; registration and reporting duties do not disappear. The German ISO guide therefore cannot be applied unchanged to Belgium.
Next step: Determine the national classification, registration and, where relevant, the appropriate assessment route and current CCB deadlines. An external technical check is not such a conformity assessment.
Justel: NIS2 Act, particularly Articles 30 and 39–43 · Royal Decree, Articles 4–13 · CCB
Switzerland: ISG and reporting duties, not NIS2 transposition
Switzerland has its own law. Critical infrastructures covered by Article 74b of the Information Security Act (ISG) have been required since 1 April 2025 to report cyberattacks meeting the statutory criteria. Initial reports to the NCSC (BACS) are due within 24 hours of discovery. Covered entities, reportable attacks and exemptions under the ISG and Cybersecurity Ordinance (CSV) require separate examination.
Separately, EU services offered by a Swiss entity may create a connection to Article 26 NIS2 and the relevant national implementation. This is distinct from Swiss obligations and a customer’s contractual security requirements.
Next step: First check the ISG/CSV scope and incident criteria with the NCSC; examine any EU connection separately. The Swiss branch of our scope check provides source guidance only.
ISG, Art. 74b–74e · CSV · NCSC: who must report? · NCSC: reporting FAQ
United Kingdom: NIS Regulations and the reform process
In the United Kingdom, the Network and Information Systems Regulations 2018 apply as amended. They are UK law and are not a national transposition of the NIS2 Directive. Covered essential and digital services, competent authorities and specific duties are determined under that regime.
The consulted Parliament page presents the Cyber Security and Resilience (Network and Information Systems) Bill as legislation in progress. Proposals in it are not presented here as duties already in force. The NCSC Cyber Assessment Framework supports assessment of cyber risks; it is neither itself legislation nor an automatic confirmation of compliance.
Next step: Check the current NIS Regulations and competent sector authority. For EU services, also examine the cross-border connections in Article 26 NIS2. We do not provide a UK classification calculator.
NIS Regulations 2018 · UK Parliament: reform bill · NCSC: Cyber Assessment Framework
What the tools cover
Scope check: bounded national rules for Germany and Austria; source guidance for other contexts. Missing answers are not replaced by assumptions.
Readiness check: Germany, seven self-reported answers. The percentage is not a security or compliance rating.
Technical checks: selected external HTTP, DNS and transport findings independent of reading language. A country source context in a report expands neither the measurement nor its legal significance. For additional countries, first establish the official authority and national sources.