The DNS Research Federation has been following the transposition and implementation of the NIS2 Directive across all 27 EU Member States. Below are the latest updates on the implementation of the NIS2 Directive:

• So far, Belgium, Croatia, Hungary, Italy, Latvia and Lithuania have transposed the Directive into national law. 
• Romania: On 15 October 2024, the Directoratul Național de Securitate Cibernetică (DNSC), Romania’s national cybersecurity agency, published a draft Government Emergency Ordinance. This means that the draft is intended to be adopted by the Government before going before the Parliament of Romania, where it will either be confirmed and stay in force or be rejected.
• Hungary: Despite having already transposed the NIS2 Directive into Act XXIII of 2023, Hungary has decided to draft a completely new Cybersecurity Act which aims to implement the NIS2 and CER Directives, as well as the ENISA and DORA Regulations. On 29 October, this draft law was submitted to Parliament.
• Italy: Entities that fall under the purview of Italy’s Decree 4 September 2024, n. 138, which transposes the NIS2 Directive, are mandated to notify the competent National NIS Authority by registering on the ACN digital platform. This digital platform will be made available by ACN on 1 December 2024. Digital Providers are required to register before 17 January 2025 and all other entities that fall under scope must have registered by 28 February 2025. Failure to register will be considered a violation and fines of up to 0.1% of the entity's annual worldwide turnover will apply.

There are also two public consultations running at this point in time: 

• ENISA: The European Union Agency for Cybersecurity has recently opened a public consultation to collect feedback on the draft guidance on the technical and methodological requirements of Commission Implementing Regulation (EU) 2024/2690 of 17.10.2024, which lays down rules for the application of the NIS2 Directive. The link to the consultation form is here. Comments must be submitted by  9 December 2024. 
• Portugal: On 22 November 2024, the Minister of State for the Presidency published a draft for the law that will implement the NIS2 Directive. The consultation on the draft will run until 7 December 2024 and comments can be submitted here.

This information complements our continuously updated NIS2 Article 28 Tracker on our website, providing you with the most recent updates on open consultations and progress with national transposition efforts. For more details on each Member State’s progress, please refer to our Tracker. 

New Features in Our NIS2 Tracker this Month

We have recently added an accompanying Methodology page to our NIS2 Tracker. The Methodology page explains how we have split the NIS2 transition process into four different ‘Phases’ for the purposes of our Tracker. These Phases are: Not Started, In Preparation, Transposed and Implementation. The Methodology page also expands on how each of these Phases are associated with ‘Statuses’. 

Where Member States have published a draft law, we have updated our NIS2 Tracker to show whether their latest draft includes concepts relating to the domain name industry and Article 28 of the NIS2 Directive. We have also included a breakdown of how their draft text implementing Article 28 compares to that in the EU Directive.