NIS2 Enforcement Readiness Tracker
Transposition status, enforcement authorities, public enforcement activity, and practical risk ratings mapped by EU member states.
- Country-by-country enforcement map
- Detailed country profiles for 8 EU member states
- Multi-market risk assessment worksheet
- Practical next steps by risk rating
Enforcement maturity is not the same in every country
Four member states have confirmed fine activity, three are in early enforcement, and one is still completing transposition.
- Germany
- Netherlands
- France
- Belgium
- Poland
- Sweden
- Czech Republic
- Spain
Does your board know which countries you're actually at risk in?
What's inside the NIS2 Enforcement Readiness Tracker
What enforcement looks like in practice
The three factors that drive NIS2 enforcement risk: whether the transposition law is in force, whether the authority is operational, and what has triggered the first fines.
Country-by-country enforcement map
A summary table covering eight EU member states: transposition status, enforcement authority, public enforcement activity, fine ceiling, and practical risk rating.
Detailed country profiles
Individual profiles for Germany, the Netherlands, France, Belgium, Poland, Sweden, the Czech Republic, and Spain — authority, activity, risk rating, and what to expect.
Multi-market risk assessment worksheet
A three-step process for mapping your enforcement exposure: map your countries, identify your highest-risk jurisdictions, and review notification readiness.
Practical next steps by risk rating
Specific actions for active enforcement, early enforcement, and enforcement-pending jurisdictions — what to do first in each case.
Download the NIS2 Enforcement Readiness Tracker
A practical reference for security and compliance teams operating across multiple EU jurisdictions. Know where enforcement is active, where it is building, and where it is still pending.
Download the trackerWhy NIS2 enforcement risk varies by country
The NIS2 directive set a single transposition deadline across all member states: October 2024. Several missed it. Those that did transpose on time did so differently, with enforcement authorities carrying different mandates, resourcing levels, and supervisory histories. The result is that enforcement maturity is not uniform across the EU, and the risk profile in Germany is not the same as in Spain.
Financial penalties
National NIS2 requirements may set lower ceilings within these limits.
Binding instructions
Authorities can require organizations to take specific remediation actions within defined timeframes.
Public disclosure
Non-compliance can be made public. For regulated industries and publicly listed companies, reputational exposure is a material risk.
Management liability
Some member states have introduced provisions allowing temporary prohibition of management functions for senior executives where serious failures are found.
Frequently asked questions
What is the NIS2 enforcement status in 2026?
If you have been following NIS2 enforcement news, the shift is clear. Germany, the Netherlands, France, and Belgium have confirmed fine activity. Poland, Sweden, and the Czech Republic are in early enforcement. Spain is still completing its transposition. The risk level is different in every country.
Which countries have active NIS2 enforcement?
Germany, the Netherlands, France, and Belgium have the most mature supervisory and enforcement activity among the countries covered in this tracker. Poland, Sweden, and the Czech Republic remain in an earlier stage, while Spain is still completing transposition.
What triggers NIS2 enforcement action?
Three things have drawn enforcement attention consistently: late or missing incident notifications under Article 23, undocumented risk management measures under Article 21, and inability to demonstrate board-level governance. Documentation and notification readiness have been the issue, not detection capability.
What is the NIS2 fine ceiling?
NIS2 Article 34 sets the maximum at €10 million or 2% of global annual turnover for essential entities and €7 million or 1.4% for important entities. National transposition laws may set different structures within those limits. Financial penalties are also only part of what authorities can do.
How do I assess NIS2 enforcement risk across multiple countries?
Start with where you operate and the enforcement status of each jurisdiction. The NIS2 Enforcement Readiness Tracker maps transposition status, enforcement authority, public enforcement activity, and practical risk ratings for eight EU member states. The multi-market worksheet inside walks you through the assessment step by step.
Does NIS2 enforcement apply to non-EU companies?
Yes. The NIS2 directive applies to any organization providing services within the EU, regardless of where it is headquartered. If you are in scope in any member state, the national requirements and enforcement provisions of that jurisdiction apply to you. Where you are based does not determine where you are liable.
Need to understand your enforcement exposure across markets?
Q-Sec works with security and compliance teams operating across the EU. We can review your multi-market risk profile, identify the gaps most likely to attract supervisory attention, and help you build a prioritized readiness plan.