"When does NIS2 apply to us?" sounds like a question with one answer. If your company — or your customers, or your suppliers — sit across Slovakia, Czechia, Germany, and Austria, it has four. NIS2 is a directive: it binds member states to legislate, and what you actually comply with is the national law each one passed. Four countries, four acts, four regulators, four calendars.
This post is the buyer's version of that map — what is in force where, which authority supervises it, and which dates are still ahead. Country facts re-verified on 18 October 2026 against the national authorities' and legislatures' own publications; the Austria section was re-verified on 15 October 2026, after NISG 2026 took effect.
Why "is NIS2 in force?" is the wrong question
The directive itself — Directive (EU) 2022/2555 — entered into force in January 2023, and member states were obliged to transpose it into national law by 17 October 2024. Most missed that deadline, some by more than a year. So the honest picture in autumn 2026 is uneven: some countries have had their national act live for well over a year, one large neighbour switched overnight with no general transition period, and one only switched on this October. The right question is country-specific: which national act applies to this entity, since when, and what has it been asked to do by which date?
Slovakia — in force since 1 January 2025
Slovakia transposed early, and quietly: Act No. 366/2024 Coll. amends the existing Cybersecurity Act (Act No. 69/2018) rather than replacing it, so organisations already regulated under the NIS1-era framework kept their footing. The competent authority is the NBÚ — the National Security Authority — with SK-CERT as the national CSIRT. Entities newly in scope on day one had to notify the NBÚ within 60 days — early March 2025 — after which the NBÚ enters them in its register, and the clocks run from that entry: security measures within twelve months, a first audit within two years. If you are Slovak and in scope, the notification window is long gone — the live question is whether your risk-management measures, supplier obligations included, would hold up to an NBÚ inquiry. The NBÚ's own 2025 inspections point at exactly that: its most common finding was an inadequate arrangement of the relationship with a third party, above all a missing risk analysis of the supplier relationship. The details are on our Slovakia page.
Czechia — in force since 1 November 2025, on a staircase
Czechia passed a new act rather than an amendment: Act No. 264/2025 Coll., the new Cybersecurity Act, supervised by NÚKIB. Two things make the Czech transposition distinctive. First, the calendar is a staircase: an entity has 60 days from meeting the conditions to notify its regulated services to NÚKIB; NÚKIB then registers each service by decision, and security measures and incident reporting must start within one year of that decision being delivered. NÚKIB began sending decisions to the first wave in early 2026, so for most of them that year runs out in early 2027 at the earliest — each entity's date is its own, and it is a start-by date, not a finish line. Second, the act creates a power to restrict or ban a supplier: NÚKIB can set conditions on, or prohibit, a supplier's security-relevant deliveries into the critical part of a strategically significant service, where the government resolves that the security of the Czech Republic or its internal order requires it. That goes beyond what the directive itself requires, and it applies once the government designates those services — the regulation doing so was still being finalised in October 2026, covering roughly 150 providers. Where it applies, it moves supplier decisions from "best practice" territory into something the state can override. More on our Czechia page.
Germany — in force since 6 December 2025, with no transition period
Germany's transposition rewrote the BSI Act (BSIG) and took effect the day after promulgation — 6 December 2025, with no general transition period beyond three months to register. The BSI supervises two classes: besonders wichtige Einrichtungen (the directive's "essential") and wichtige Einrichtungen ("important"), with KRITIS operators counted among the former and carrying extra duties — an estimated 29,500 entities in scope, up from about 4,500 under the old KRITIS-only regime. When the registration deadline passed on 6 March 2026, fewer than two in five of the expected entities had registered; by the end of September 2026 about two-thirds had, which tells you two things at once: a large share of the German mid-market spent the year catching up, and the BSI has a very long list to work through. German law also makes management accountability explicit — under Section 38 of the new BSI Act, management bodies must implement the risk-management measures and oversee them, attend training regularly, and are liable to their own entity for damage they culpably cause. Details on our Germany page.
Austria — in force since 1 October 2026
Austria is the newest of the four, and the one where vendor copy most often ran ahead of the law — NIS2 was often described as live there while it was not yet the operative regime. The first transposition attempt failed in parliament in 2024; the successor — NISG 2026, promulgated in the Federal Law Gazette on 23 December 2025 — entered into force on 1 October 2026, replacing the old NISG 2018 and its population of around a hundred designated operators. The regulated population now expands to roughly 4,000 entities, each of which must register with the new Bundesamt für Cybersicherheit within three months — by 1 January 2027, through the NIS2-Services application in the Unternehmensserviceportal (USP). For an Austrian mid-market company that has never been regulated before, the practical runway between "the law applies to us" and "we are registered and expected to have measures under way" is one quarter — and that quarter is already running. It is not much time to build a supplier inventory from nothing. See our Austria page for the specifics.
The rest of the EU, honestly
Beyond these four: NIS2 is transposed unevenly across the EU, with real national variation in scope, registration timelines, and supervisory powers. Hungary and Poland — both covered on our NIS2 hub — have their acts in force. In July 2026 the European Commission referred four member states to the Court of Justice of the EU for still not having notified full transposition. We deliberately don't publish a "X of 27 transposed" figure, because it changes month to month and stale numbers are worse than none. For any country not named here, work from the directive and verify the national status the week you need it.
What stays the same in every country
Here is the useful part. The dates, regulators, and registration portals differ; the supply-chain obligation does not. Article 21(2)(d) — supply chain security, covering the relationships between each entity and its direct suppliers or service providers — survives transposition intact in every national act above. So does the operational work it implies: a maintained supplier inventory, a documented risk classification, per-supplier assessment evidence, a decision trail, and a reaction plan for material change. We've written up the five artefacts that answer most supply-chain inquiries separately — and none of them is country-specific.
That has a practical consequence for cross-border operators: build the supplier assurance layer once, to the obligation, not to a single country's act. A Czech staircase deadline, a German inquiry, and an Austrian registration wave all land on the same underlying records. If those records exist, the country calendar is an administrative detail. If they don't, every one of those dates is a separate emergency.
Where to start
If you want to know where you stand today, the NIS2 readiness check is self-serve and takes about five minutes. If your exposure spans more than one of the countries above, start with the country page for wherever your regulator sits — and remember that your suppliers' countries matter less than yours: the obligation follows the buyer.