New cybersecurity requirements in most critical sectors
Official title (in Danish): Lov om foranstaltninger til sikring af et højt cybersikkerhedsniveau (NIS 2-loven)
In short
Reading time: 1 min- What changes: The act requires management of cybersecurity risks, reporting of significant incidents, and supervision of the entities covered.
- Who: The act applies to most of the sectors covered by the NIS 2 Directive. The telecoms, energy and finance sectors are not included.
- When: The Act entered into force on 1 July 2025.
Written by AI from verbatim quotes from the source and checked by code and AI. Dates, tables and the fact box are calculated by fixed rules. Unofficial translation. Always read the original.
Sources and original
Read the official text (in Danish) →
The case at the Danish Parliament (ft.dk)
Source: Retsinformation.dk
Translated from Danish · The Danish version and the original source apply.
Summary by the Danish Parliament (in Danish)
Formålet med lovforslaget er at implementere Europa-Parlamentet og Rådets direktiv (EU) 2022/2555 af 14. december 2022 om foranstaltninger til sikring af et højt fælles cybersikkerhedsniveau i hele Unionen, om ændring af forordning (EU) nr. 910/2014 og direktiv (EU) 2018/1972 og om ophævelse af direktiv (EU) 2016/2259 (NIS 2-direktivet) for størstedelen af de sektorer, der er omfattet af NIS 2-direktiets anvendelsesområde, med undtagelse af tele-, energi- og finanssektorerne. Med lovforslaget lægges der op til, at NIS 2-direktivet minimumimplementeres i overensstemmelse med regeringens principper for implementering af erhvervsrettet EU-regulering. Lovforslaget fastsætter bl.a. krav om foranstaltninger til styring af cybersikkerhedsrisici, herunder f.eks. politikker for risikoanalyse, underretningspligter ved bl.a. væsentlige hændelser og tilsyns- og håndhævelsesforanstaltninger.
Source: Folketinget (ft.dk). Reproduced unchanged.
Timeline
How to read the timeline
- Filled dot: this has happened. The date and the source are shown below the point.
- Empty dot: an upcoming step. The date may be known or not known yet.
- Square: the case ended here, e.g. because the bill was rejected or withdrawn.
- "The date is in the source, but entry into force has not been confirmed yet" (or just "not confirmed yet") means the date has passed, but the source does not yet show that the law or rule has entered into force. We only change the status when the source confirms it.
- Introduced · 6 February 2025Status in the Danish Parliament: Fremsat
- Passed · 29 April 2025Status in the Danish Parliament: 3.beh./Vedtaget
- Stadfæstet · 6 May 2025Status in the Danish Parliament: Stadfæstet
- In force · 1 July 2025Status in the Danish Parliament: Stadfæstet