NIS2 in the Netherlands and the Nordics: where each country stands

If you operate across northern Europe, NIS2 does not mean one rule book. Each EU country has written the directive into its own law, with its own registration process and supervisors, and Norway is on a separate track. Here is where the Netherlands, Sweden, Denmark, Finland and Norway stand.

Status checked on 5 November 2026. National rules and guidance are still moving, and some details below come from published legal and compliance summaries. Confirm them with the national authority before you act on them.

The overview

Netherlands

The Dutch government business portal confirms that the Cyberbeveiligingswet took effect on 15 August 2026. From that date, covered organisations must meet the duty of care and the duty to report. Serious incidents must be reported to the CSIRT and the supervisory authority as soon as possible, and at most within 24 hours.

• Who is covered: medium and large organisations in an Annex I or II sector, meaning at least 50 employees, or annual turnover and balance sheet total above EUR 10 million. Some providers and government organisations are covered automatically, and the minister can designate other small companies vital to the economy or society.
• Registration: published summaries describe a national register on MijnNCSC, accessed with eHerkenning, with changes reported within two weeks.
• Supervision: this is organised by sector. Published summaries name RDI, ILT, DNB, AFM and NVWA, while the government portal says the assignment of sectors is still being worked out. Check which one applies to you.

Because the law applied without a long transition, Dutch companies that are in scope should treat registration and incident reporting as immediate priorities.

Sweden

The Cybersecurity Act replaced the 2018 NIS Act on 15 January 2026, with no transition period.

• Registration: the law requires notification as soon as it can be done. Sweden’s NCSC has said supervisors may act if notification has not arrived within 14 days, and changes must also be reported within 14 days.
• Authorities: since 1 July 2026, registration and incident reports go to NCSC at the National Defence Radio Establishment (FRA). Supervision is split among thirteen authorities, including the Energy Agency, PTS, Finansinspektionen and Transportstyrelsen.

Denmark

The Danish NIS-2 Act has applied since 1 July 2025. Energy, telecom and finance also have their own sector acts, so check those first if you work in one of them.

• Registration: through Virk.dk with MitID Erhverv. Organisations in scope on 1 July 2025 had until 1 October 2025. Organisations that come into scope later register when the Act begins to apply to them, and changes must be filed within three months.
• Reporting: early warning within 24 hours, notification within 72 hours and a final report within one month, sent to both the competent authority and the CSIRT.

Finland

The Finnish Cybersecurity Act has applied since 8 April 2025, with first registrations due by 8 May 2025.

• Authorities: Traficom supervises sectors including transport, digital infrastructure and ICT service management, and houses NCSC-FI, the national CSIRT. Energiavirasto covers electricity, district heating and gas networks, and Tukes covers areas including chemicals and parts of manufacturing.
• Finance: banking and financial market infrastructure fall under DORA rather than the Finnish Act.
• Reporting: early warning within 24 hours, notification within 72 hours and a final report within one month. Changes to registered data must be reported within two weeks.

Norway

Norway is not an EU member, so EU directives reach it through the EEA process. Its Digital Security Act, in force since 1 October 2025, implements the earlier NIS1 Directive. NIS2 implementation is a separate process, explained by the National Security Authority (NSM). Under the current law, providers of essential services have an initial notification deadline of 24 hours at the latest, while digital service providers should not assume the same timetable.

A Norwegian company can still fall under NIS2 through a subsidiary or activity in the EU, and EU customers may ask for NIS2-level measures in contracts. So it is sensible to plan for NIS2 now, even before it applies at home.

If you operate in several countries

Article 26 of the Directive generally places an entity under the jurisdiction of the Member State where it is established. There are exceptions. Public electronic communications providers fall under the countries where they provide their services. DNS service providers, TLD name registries, domain name registration services, cloud, data centre and content delivery network providers, managed service and managed security service providers, online marketplaces, online search engines and social networking platforms fall under the country of their main establishment in the EU. Public administration entities fall under the country that established them.

1. Map each legal entity and service to its country and sector.
2. Work out which authority is competent for each one, and register everywhere required.
3. Build one group-wide set of measures to the strictest requirement, with national annexes for the differences.
4. Create one incident process that lists each country’s recipient, form and deadline.
5. Check supplier contracts, because customers in one country may pass their duties on to you.

Where to go next

Our NIS2 compliance checklist explains what to prepare step by step, and our guide to NIS2 in Italy covers another market. For help with a multi-country programme, see Setexe’s NIS2 compliance services or contact us.

This article is general information and not legal advice.

Sources

• Directive (EU) 2022/2555 (NIS2), EUR-Lex
• Business.gov.nl: cybersecurity obligations for more companies in critical sectors
• NIS2 status in the Netherlands, nisd2.eu
• Eversheds Sutherland: Netherlands
• NIS2 in Sweden, NIS Solutions
• NIS2 in Denmark, NIS Solutions
• NIS2 in Finland, nisd2.eu
• What Norway’s Digital Security Act is, FM Cybersecurity