NIS2 in Denmark

Key facts at a glance

Is your company in scope? Common Denmark scenarios

Two worked examples of how NIS2 scoping plays out in Denmark. Not sure where you land? Run the free NIS2 scope checker.

What Denmark businesses need to know

• Denmark transposed NIS2 with the NIS 2-loven, LOV nr 434 af 06/05/2025, in force since 1 July 2025 (§ 33, stk. 1), completed by two executive orders: BEK nr 620 on the competent authorities and digital communication, and BEK nr 653 on domain name registration data. It repealed four NIS1 acts of 2018 and does not apply to the Faroe Islands and Greenland (§ 34). The European Commission closed its infringement case INFR(2024)0265 on 30 January 2026.

• Energy, telecommunications and the financial entities designated under § 333 of the Danish financial business act are outside the NIS 2-loven to the extent their own acts cover them (§ 1, stk. 2): a Danish energy or telecom company reads lov om styrket beredskab i energisektoren or lov om sikkerhed og beredskab i telesektoren instead. Sector Union acts with at least the same effect also prevail (§ 1, stk. 3).

• The size test is written into the act for the entity itself, with no reference to Recommendation 2003/361/EC: an entity of the annexes is important from 50 persons, or with turnover and balance sheet both above EUR 10 million (§ 5, stk. 1), and an Annex 1 entity is essential from 250 persons, or with turnover above EUR 50 million and balance sheet above EUR 43 million (§ 4, stk. 1). Whether group figures count is not settled by the act.

• Qualified trust service providers, TLD registries, DNS service providers, central government entities and critical entities identified under the Danish CER act are essential at any size (§ 4, stk. 3), and every other trust service provider is important (§ 5, stk. 3). No ministerial exemption can be made for a trust service provider (§ 1, stk. 6).

• Local public administration and education come in only where a minister extends the act to them by executive order (§ 1, stk. 7), and none was found on 5 November 2026. A municipality that carries out an Annex activity, as a healthcare provider for example, is under the act on that ground, as a whole (bill L 141): that is why BEK 620 names the municipalities among the entities SAMSIK supervises. Central and regional public administration are in the act's annex (Bilag 1, pkt. 10): central government at any size (§ 4, stk. 3), a region by the size tests of §§ 4 and 5.

• Essential and important entities and domain name registration service providers register with the relevant competent authority within two weeks of coming into scope and report changes within two weeks (§ 10); the digital types also file the Article 27 information within three months (§ 9, stk. 2). Everything goes through SAMSIK's self-service solution on Virk.dk, signed with MitID (BEK 620, § 14). SAMSIK's registration page gives three months for every change; for essential and important entities the act's two weeks govern.

• Every significant incident is notified to both the competent authority of the entity's sector and the CSIRT (§ 12, stk. 1), through the self-service solution on Virk.dk; the Danish Defence Intelligence Service (Forsvarets Efterretningstjeneste, FE) handles the reports as the national CSIRT (SAMSIK). From becoming aware of the significant incident: an early warning within 24 hours, an incident notification (hændelsesunderretning) within 72 hours, 24 for trust service providers, an interim report at the CSIRT's request, and a final report at the latest one month after the notification or, for an incident still ongoing then, a status report and the final report one month after the incident has been handled (§ 13).

• No executive order sets the measures or the significance thresholds: § 6, stk. 1 restates the directive's ten measures, supply chain security among them, and § 12, stk. 2 the directive's criteria for a significant incident. The minister may set detailed rules on the measures (§ 6, stk. 3), and none existed on 30 October 2026.

• The management body (ledelsesorgan), in a company with an executive board and a board of directors the board (§ 3, nr. 20), approves the measures and oversees their implementation (§ 7, stk. 1); its members attend relevant courses on cybersecurity risk management and encourage similar courses for the other employees, with no interval set (§ 7, stk. 2).

• Breaches are criminal offences under § 32, and companies can be held criminally liable under chapter 5 of the Criminal Code (§ 32, stk. 2). In an essential entity, a person with management responsibility at chief executive or legal-representative level can be temporarily banned from management functions, never in a public administration entity (§ 23).

NIS2 in Denmark: frequently asked questions

Is NIS2 in force in Denmark?

Yes. The NIS 2-loven, LOV nr 434 af 06/05/2025, has applied since 1 July 2025 (§ 33, stk. 1), and the first registrations were due by 1 October 2025 (§ 33, stk. 3). Two executive orders complete it, BEK nr 620 (competent authorities and digital communication) and BEK nr 653 (domain name registration data); none sets measures or significance thresholds. The European Commission closed its infringement case on 30 January 2026.

Does the NIS 2-loven apply to Danish energy and telecom companies?

Not to the extent their own acts cover them: the NIS 2-loven does not apply to entities covered by lov om styrket beredskab i energisektoren or lov om sikkerhed og beredskab i telesektoren, nor to the financial entities designated under § 333 of lov om finansiel virksomhed (§ 1, stk. 2). SAMSIK confirms that NIS 2 is implemented in separate legislation for each of these three sectors. Sector Union acts with at least the same effect also prevail for measures, incident notification and informing recipients (§ 1, stk. 3).

Where does a Danish entity notify a significant incident?

To both the competent authority of its sector and the CSIRT (§ 12, stk. 1), digitally through SAMSIK's self-service solution on Virk.dk, signed with MitID (BEK 620, § 14); SAMSIK's NIS 2 page links it as 'Indberet hændelse (virk.dk)', and the Danish Defence Intelligence Service (FE) handles the reports as the national CSIRT. The clock runs from becoming aware of the significant incident: an early warning within 24 hours, the notification within 72 (24 for trust service providers), the final report at the latest one month after the notification (§ 13). The entity also informs the recipients of its services without undue delay of significant incidents likely to affect the provision of its services (§ 15, stk. 1).

How fast must a Danish entity register under the NIS 2-loven?

Within two weeks of coming into scope (§ 10, stk. 2), and within two weeks of any change (§ 10, stk. 3), with the relevant competent authority through SAMSIK's self-service solution on Virk.dk; domain name registration service providers register too. The digital types also file the Article 27 information within three months (§ 9, stk. 2). SAMSIK's registration page gives three months for every change, but for essential and important entities the act's two weeks govern.

How is the size of a Danish entity measured under the NIS 2-loven?

By the act's own thresholds, applied to the entity itself: an entity is important from 50 persons, or with turnover and balance sheet both above EUR 10 million (§ 5, stk. 1), and an Annex 1 entity essential from 250 persons, or with turnover above EUR 50 million and balance sheet above EUR 43 million (§ 4, stk. 1). The act does not refer to Recommendation 2003/361/EC or to its partner and linked enterprises, so whether group figures count is not settled by the act.