Cyber security law has moved from guidance to statutory duties with registration, incident reporting and management accountability. In the EU, NIS2 covers medium and large entities in 18 sectors, but transposition is uneven: Germany's law is in force while France's was still a bill in October 2026. Product makers face the Cyber Resilience Act, whose reporting duties began on 11 September 2026. Singapore, Saudi Arabia and the US regulate critical infrastructure and, increasingly, cloud and digital infrastructure providers.
NIS2 in the EU
Member States had until 17 October 2024 to transpose NIS2. Medium-sized and large entities in the critical sectors must take risk-management measures and report significant incidents, and top management is accountable for compliance. In January 2026 the Commission proposed targeted amendments to ease compliance for about 28,700 companies.
National implementation differs. Germany's law entered into force on 6 December 2025, with the BSI as supervisor and a reporting sequence of an early warning within 24 hours, a notification within 72 hours and a final report within one month. France had not yet enacted its law in October 2026. A group operating in several Member States must map which national law applies to each entity.1234567
Products, infrastructure and providers
The Cyber Resilience Act places duties on manufacturers of products with digital elements. Its reporting obligations have applied since 11 September 2026, ahead of the main compliance deadline in December 2027.
Singapore's 2024 amendments to the Cybersecurity Act extend regulation to foundational digital infrastructure such as cloud services and data centres. Saudi Arabia's Essential Cybersecurity Controls are mandatory for government entities, their affiliates and operators of critical national infrastructure. In the US, the federal CIRCIA reporting rule has not been issued; once in force it will require covered incidents to be reported to CISA within 72 hours and ransom payments within 24 hours.891011
| Market | Regime | Status or clock | Source |
|---|---|---|---|
| EU | NIS2 Directive | Transposition deadline 17 October 2024; amendments proposed January 2026 | European Commission |
| Germany | NIS2 implementation act (BSIG) | In force 6 December 2025; 24 hours, 72 hours, one month | BSI; gesetze-im-internet.de |
| France | Draft Resilience law | Not yet enacted (October 2026) | ANSSI |
| EU | Cyber Resilience Act | Reporting from 11 September 2026; main deadline December 2027 | European Commission |
| Singapore | Cybersecurity Act as amended 2024 | Extends to cloud and data centre providers | CSA |
| Saudi Arabia | Essential Cybersecurity Controls (ECC-2:2024) | Mandatory for government entities, affiliates and CNI operators | NCA |
| United States (federal) | CIRCIA | Final rule not issued; 72 hours and 24 hours once in force | CISA |
Decisions to make
- Which of our EU entities fall within NIS2 sectors and size thresholds, and under which national law?257Transposition differs; Germany's law is in force while France's is pending.
- Do we sell connected products or software in the EU?8The Cyber Resilience Act reporting duties have applied since 11 September 2026.
- Is the board trained and accountable for cyber risk?3NIS2 makes top management accountable for risk-management measures.
- Do we provide services to Saudi government entities or critical infrastructure?10The ECC controls become mandatory for those entities and their affiliates.
Documents usually needed
- Scoping analysis of NIS2 entity status by Member State
- Registration confirmations with national authorities
- Cyber risk-management policies approved by management
- Incident reporting playbook covering 24-hour, 72-hour and one-month stages
- Product vulnerability handling and reporting procedures for the CRA
Common mistakes
- Assuming NIS2 applies identically across the EU
- Waiting for French transposition before preparing
- Treating cyber reporting as separate from personal data breach reporting
- Overlooking product obligations under the Cyber Resilience Act
- Leaving cyber risk entirely to IT without board oversight
Questions businesses ask
Is NIS2 in force everywhere in the EU?
The transposition deadline was 17 October 2024, but some Member States were late. Germany's law entered into force on 6 December 2025; France had not enacted its law in October 2026.157
Does the US have a federal cyber incident reporting rule?
Not yet for most critical infrastructure: the CIRCIA final rule has not been issued. SEC registrants already disclose material incidents.11
What this guide does not yet confirm
These points need checking with a qualified local professional before you rely on them.
- India's CERT-In incident reporting directions could not yet be checked.
- The UK Cyber Security and Resilience Bill status and the UK NIS Regulations were not researched.
- UAE federal cyber security requirements were not researched.
- Cyber Resilience Act report deadlines and content were not confirmed on an official page.
- NIS2 status in Member States other than Germany and France was not compared.
Sources and review status
Each statement is numbered to the source it was checked against. We use official sources where we can, and each statement says whether it was checked against an official or a secondary source. Sources last checked on 19 October 2026. None of it has been professionally reviewed yet: it is research checked against official and secondary sources by WONE Global, not legal or tax advice.
Member States had until 17 October 2024 to transpose the NIS2 Directive into national law. Directive (EU) 2022/2555, in force since January 2023, covering 18 critical sectors.
As a rule, medium-sized and large entities in the NIS2 critical sectors must take cybersecurity risk-management measures and notify significant incidents to national authorities. 18 critical sectors under Directive (EU) 2022/2555.
Reused from market guide claim it-data-005.
NIS2 introduces accountability of top management for non-compliance with cybersecurity risk-management measures. Entities in scope of NIS2 as transposed in each Member State.
On 20 January 2026 the Commission proposed targeted amendments to the NIS2 Directive, which it says will ease compliance for 28,700 companies, including 6,200 micro and small enterprises. Proposal only; adoption not confirmed.
Germany's NIS2 implementation act (NIS2-Umsetzungs- und Cybersicherheitsstärkungsgesetz) was promulgated on 5 December 2025 and entered into force on 6 December 2025, with the BSI as the competent supervisory authority for in-scope entities. Entities in the sectors listed in Annexes 1 and 2 of the BSI Act (BSIG) that meet the size thresholds, plus certain entity types regardless of size.
The BSI does not notify entities of their status; businesses must assess for themselves whether they are in scope. Reused from market guide claim de-data-007.
Significant security incidents must be reported to the joint BSI and BBK reporting office with an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report no later than one month after the notification. Particularly important and important entities. An intermediate report is due only on BSI request; a progress report replaces the final report while an incident is ongoing.
Reused from market guide claim de-data-011.
France has not yet enacted its NIS 2 transposition law: ANSSI refers to the national implementing text as the draft 'projet de loi Résilience' and asks future essential and important entities to begin securing their systems now. The EU transposition deadline was 17 October 2024. Status as at 18 October 2026.
Entity counts, sector lists and sanctions under the French text are not stated on this page and will only be fixed once the law and implementing decrees are adopted. Reused from market guide claim fr-data-007.
Reporting obligations under the EU Cyber Resilience Act apply from 11 September 2026, ahead of the main compliance deadline in December 2027. Manufacturers of products with digital elements placed on the EU market. The Act has been in force since December 2024. Report content and deadlines were not confirmed on the page read.
Amendments to the Cybersecurity Act passed in May 2024 extend regulation to foundational digital infrastructure providers such as cloud service providers and data centres, to entities of special cybersecurity interest and to systems of temporary cybersecurity concern, and widen CII incident reporting to include supply-chain incidents. Foundational digital infrastructure providers must follow codes and standards of practice and report prescribed incidents.
The page states the May 2024 passage but not the commencement date of each new part. Reused from market guide claim sg-data-010.
The National Cybersecurity Authority's Essential Cybersecurity Controls (ECC-2:2024) are mandatory for government entities and their affiliated companies inside and outside the Kingdom, and for private sector entities that own, operate or host critical national infrastructure. Other entities are encouraged to adopt them. ECC-2:2024 has 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols. NCA assesses compliance by self-assessment, compliance-tool reports and field audits.
Effective date shown as 2024 edition; exact commencement date not stated in the extract. Reused from market guide claim sa-data-013.
The final rule under the Cyber Incident Reporting for Critical Infrastructure Act of 2022 has not been issued; once in force, covered entities will have to report covered cyber incidents to CISA within 72 hours and ransom payments within 24 hours. Federal; critical infrastructure entities as defined in the final rule. Reporting is voluntary until the rule takes effect.
The CISA page describes the effective date as yet to be determined, but parts of its wording appear dated; confirm the rule's status before relying on this. Reused from market guide claim us-data-012.
Questions on this topic
11 statements on cyber security obligations
