NIS2 Enforcement Tracker 2026: National Status and Evidence

NIS2 enforcement in 2026 cannot be described by a single EU start date or an unqualified list of “first fines”. National legislation, registration, supervision and published decisions are different events. This tracker records official evidence checked on 28 September 2026, with a focused comparison of Belgium, Germany, Italy, the Netherlands, France and Spain. It does not claim to be a complete census of all twenty-seven Member States or of confidential enforcement activity.

The clearest recent change in this selection is Dutch commencement on 15 August 2026. France’s parliamentary process and Spain’s preparatory legislation remain separate from enacted national obligations. An earlier European Commission infringement announcement therefore needs to be read alongside later national developments. The entries below identify what each source establishes and what an organisation should verify next.

What counts as enforcement evidence

An enacted statute establishes a legal framework, but it does not demonstrate that a particular company has been fined. An authority’s registration portal shows a compliance process, but registration does not certify the registrant’s security. A consultation or readiness assessment may inform future supervision without being an inspection or a binding corrective order.

For a financial sanction, a useful record identifies the deciding authority, the legal basis, the recipient or published anonymised reference, the decision date and the amount. It should distinguish an initial decision from an appeal judgment, a settlement or payment. A news report describing a cyberattack cannot supply those missing elements. Nor can a fine under GDPR or an older national cybersecurity law automatically be relabelled a NIS2 fine.

This edition does not reproduce the previously circulated company-fine amounts or aggregate audit and spending totals that could not be tied to adequate official evidence. No entity-specific NIS2 fine is presented here as independently established. That is a limit of this tracker, not a finding that no authority has imposed a fine anywhere. The legal exposure and supervisory powers described below do not depend on a public fine appearing in this selection.

Selected national status at the September cut-off

The table is a navigation aid, not a conclusion that every requirement began on the same date as the relevant statute. Transitional provisions, implementing instruments and individual notifications may matter. Each jurisdiction requires a check of the provision governing the organisation and the particular duty.

Belgium: an operative law, with duties to examine individually

The Belgian law of 26 April 2024 provides the national framework. Article 98 establishes 18 October 2024 as its entry-into-force date. The official consolidated record checked for this update includes amendments published in January 2026, so a document downloaded when the law was first enacted may no longer reflect every current provision.

For an organisation, the next question is its actual classification and the duties attached to it. A group-level statement that “Belgium is compliant” does not show whether the relevant legal entity has assessed its scope, completed the applicable registration and selected the appropriate conformity process. Those are separate items to track with their own source and evidence.

This tracker does not infer a completed authority audit, certificate or sanction from the existence of that framework. Where an organisation relies on a conformity milestone, record the route and level concerned and the exact applicable deadline. A later certification step should not be confused with the date the law started, or treated as a general suspension of other obligations.

Germany: distinguish the original commencement from the current text

The official BSIG consolidated text records the new statute’s commencement on 6 December 2025. Its current citation also identifies amendments made during 2026. A tracker that still describes the German implementation as a pending 2024 or 2025 bill is therefore out of date.

The practical review starts with the current classification provisions and the obligations applicable to the organisation’s services. An earlier analysis under the previous BSIG cannot be assumed to cover the recast regime. Equally, a press headline about a larger regulated population does not establish that every supplier in a sector is included.

Maintain the version date used for the assessment and identify which amendments affect the conclusion. If the business changes its services or ownership structure, revisit the scope analysis. This is more useful than a green country-level status that remains unchanged while the organisation’s factual position or the operative law evolves.

Italy: enactment is established; implementation still needs a specific trigger

Italy’s official publication of Legislative Decree 138 of 4 September 2024 identifies publication on 1 October and commencement on 16 October 2024. These are three different dates: adoption, publication and entry into force. None should be replaced by an estimated enforcement launch.

For an Italian entity, maintain the applicable registration and authority communications alongside the legislation and implementing requirements. Where a duty depends on an individual communication or a defined implementation period, the tracker needs that trigger. Copying another company’s deadline without checking the basis may produce a false assurance even when both organisations operate in the same sector.

The Ministry’s explanation of its sector-authority role also helps distinguish sector functions from the national role of ACN. The organisation should identify who receives a filing, who supervises the relevant duty and where technical assistance is obtained. This update does not assert a particular Italian company fine or a national number of completed audits.

Netherlands: the July announcement must be followed by August commencement

The Dutch government’s announcement of 7 July 2026 explained the new Cyberbeveiligingswet, replacing the Wbni. The operative commencement provision is Article 35 of the Cyberbeveiligingsbesluit: both the law and the decree entered into force on 15 August 2026.

An organisation using a spring or early-summer status report therefore needs to update its legal assessment. The official announcement identifies registration, risk-management measures, incident reporting, management responsibility and supervision. Registration should be connected to the correct legal entity and services, while the organisation separately checks which authority and CSIRT arrangements apply.

Specific transitional rules or training periods should be read against the duty they actually concern. They should not be converted into a general period during which all cybersecurity obligations can be ignored. The useful evidence is the applicable provision and its trigger, together with the organisation’s implementation record, rather than a generic claim that a grace period exists.

France: a bill and a working reference framework

The French parliamentary dossier distinguishes the Senate’s adoption on 12 March 2025 from the subsequent National Assembly process. At this update’s cut-off, the Assembly agenda schedules public discussion of the resilience and cybersecurity bill for 7 October 2026. That future agenda entry is not an enacted law or a guarantee that the schedule will remain unchanged.

ANSSI’s NIS2 page continues to describe national transposition as forthcoming. It explains that ReCyF, released on 17 March 2026, is a working document containing recommended measures and is non-binding by default at this stage. Preparation and pre-registration can therefore be useful without being described as completed compliance with an enacted French NIS2 statute.

For a French operation, record separately its existing duties, the bill’s progress and voluntary preparatory work. A supplier should not advertise a working reference framework as proof that every proposed statutory requirement has become binding. The next meaningful legal update is an official legislative or commencement event, not simply another readiness webinar.

Spain: preparatory legislation and continuing existing duties

The Spanish government presented its anteproyecto on 14 January 2025. The Interior Ministry’s consultation record identifies publication on 16 January and closure on 10 February 2025. That preparatory procedure should not be described as parliamentary enactment.

The official sources checked on 28 September did not establish a published law completing Spanish transposition. This is a dated verification limit, not a prediction of when legislation will pass. Organisations should continue to distinguish the proposed framework from the existing Royal Decree-law 12/2018 and its applicable implementing rules.

A delay in NIS2 transposition does not cancel existing network-security, sectoral, ENS or GDPR obligations. Nor does it prevent a customer from requiring justified contractual security measures. In a compliance register, give those duties their correct legal or contractual source, rather than presenting every cybersecurity request as an already enforceable Spanish NIS2 obligation.

The Commission’s infringement action concerns Member States

On 8 July 2026, the Commission announced referrals concerning Ireland, Spain, France and the Netherlands. The stated issue was failure to notify full transposition. The announcement included a request for financial sanctions against the States concerned, consisting of lump sums and daily penalties until complete notification.

This is distinct from a national authority imposing an administrative fine on an essential or important entity. A tracker should not add a requested State penalty to corporate enforcement totals. It should also preserve chronology: the July announcement remains a historical event even though the Dutch law subsequently commenced in August. This update does not assert that the Court has ruled on those referrals or that a particular proceeding has been formally closed.

What the EU fine thresholds actually mean

Article 34 of Directive (EU) 2022/2555 requires national maximum administrative fines of at least €10 million or two per cent of worldwide annual turnover for the relevant essential-entity infringements, whichever is higher. For important entities, the corresponding figures are €7 million or 1.4 per cent, again whichever is higher.

These are minimum requirements for the available national maxima. They are neither automatic amounts payable after every incident nor an EU ceiling preventing a higher national maximum. The applicable national offence, procedure and assessment matter. The NIS2 penalties guide explains how seriousness, duration, responsibility, cooperation and other factors relate to exposure.

Article 20 addresses management approval, oversight, training and accountability through the relevant legal framework. It does not establish a uniform automatic personal fine for every executive. The temporary measures described in Article 32 for essential entities also have conditions and safeguards. A tracker must identify the actual decision and its basis before describing an individual as suspended or personally sanctioned.

Audits and supervision are not interchangeable totals

Article 32 provides for supervision of essential entities before and after problems arise, including inspections and security audits under its conditions. Article 33 takes a different approach for important entities, with supervision triggered when evidence, indications or information suggest non-compliance. An organisation’s essential or important classification therefore affects how it should understand supervisory exposure.

A regulator questionnaire, a self-assessment, a private certification audit and an authority inspection should not be counted as the same event. Before using an annual audit total, check the reporting period, population and definition. A programme announced for the next year does not prove completed inspections, and several activities concerning one entity may not represent several distinct organisations.

For internal reporting, track what has actually been received: an information request, an inspection notice, a finding or an order with a deadline. Assign an owner and preserve the response and supporting evidence. This gives management a useful view of enforcement exposure without inventing a numerical probability of inspection from incomplete public data.

Incident reports: check the threshold and the clock

The directive’s general reporting sequence concerns significant incidents: an early warning without undue delay and within twenty-four hours of awareness, followed by notification within seventy-two hours. Trust-service providers have a twenty-four-hour notification rule for significant incidents affecting provision of their trust services. Intermediate reports may be requested, and the final report is generally due within a month of notification.

If the incident is still ongoing at that point, the directive requires a progress report and a final report within a month of handling the incident. The NIS2 incident-reporting guide explains those branches. A tracker entry should record which national or directly applicable rule governs the entity, when awareness occurred and which submission was due; “reported within a month” is not enough to assess the earlier duties.

One event may also trigger GDPR or DORA analysis. The comparison of incident reporting under DORA, NIS2 and GDPR helps separate thresholds and recipients. DORA’s sector-specific relationship with NIS2 must be assessed through Article 4 and the covered requirements, as explained in the DORA versus NIS2 guide. It is not a rule that every financial entity must duplicate every filing under both regimes.

Jurisdiction and evidence for the next update

Article 26 starts from establishment but contains important exceptions. Public communications providers are linked to where they provide services. Specified digital providers, including cloud and managed-service providers, use a main-establishment rule with defined criteria. Certain providers established outside the Union must designate a representative. Simply asserting that every country with customers can impose the same NIS2 obligations misses those distinctions.

A multinational should keep an entity-and-service map alongside its country tracker. For each relevant operation, record the classification, jurisdictional reasoning, authority, operative instruments and next verifiable milestone. Link that record to the evidence supporting NIS2 risk management, rather than treating legislative monitoring as a substitute for implementing controls.

The NIS2 compliance guide covers that implementation work, while the EU compliance framework overview places it alongside other applicable regimes. For this tracker, a meaningful future update requires a new official enactment, commencement provision, supervisory publication or identifiable decision. Until then, the dated evidence and its limits should remain visible, rather than being replaced by unsupported claims about fines, spending increases or enforcement intensity.