NIS2 Denmark: Compliance, Authorities & Key Requirements
Understand how Denmark implements the NIS2 Directive (EU) 2022/2555, what counts as an essential or important entity, how registration works, who supervises compliance, and what steps to take to get ready.
Introduction: NIS2 Directive & the Danish context
The NIS2 Directive strengthens cybersecurity requirements across the EU. In Denmark, NIS2 is implemented through a general framework law and sector-specific acts. If you operate in Denmark (or offer services there), assess whether you are an essential or important entity and prepare accordingly.
NIS2 Directive implementation in Denmark
Denmark transposed NIS2 via the NIS-2-loven — Lov om foranstaltninger til sikring af et højt cybersikkerhedsniveau (Act on measures to ensure a high level of cybersecurity). The Act entered into force on 1 July 2025.
Status
Transposed; in force since 1 July 2025.
Official law
Registration
Covered organisations register via Virk.dk (MitID). Deadline: 1 October 2025.
| Sector | Danish note |
|---|---|
| Energy | Sector law in force since 7 March 2025; implements elements of the CER Directive. Stricter requirements may apply based on risk classification. |
| Telecom | In force since 1 July 2025. Providers with limited/ancillary public access (e.g., cafés, hotels) are generally exempt from most NIS2 requirements. |
| Finance | Aligned with the DORA Regulation; in force. Supervision by sector authority. |
Public sector: most administrative bodies (incl. municipalities) are covered, with exclusions (e.g., Parliament, Ombudsman, courts). Defence, law enforcement and certain security bodies are exempt.
Chemicals: entities not subject to REACH registration for hazardous industrial chemicals are considered out of scope.
NIS2 Denmark: what you need to know about compliance & certification
Denmark follows NIS2’s two-tier model (Essential / Important) and applies size criteria in line with the directive.
Scope criteria
- Operate in Annex I or II sector (services matter).
- Meet medium-size thresholds (≥50 employees or ≥€10m turnover/balance total). (Some sectors apply regardless of size.)
- Established in Denmark or provide relevant services on Danish territory.
Obligations
- Risk management & security policy (IT/OT)
- Incident handling & reporting
- Business continuity & crisis management
- Supply-chain security & vendor risk
- Network segmentation, access control, encryption
- Executive/board accountability & training
Standards & certification
The Act does not mandate a specific standard. Official guidance references ISO/IEC 27001:2023, NIST CSF 2.0, and IEC 62443 as useful alignment frameworks.
National NIS2 timeline & key dates
Sector-specific requirements (Denmark)
- Telecom: entities with limited, ancillary public access (e.g., cafés, hotels, housing associations) are generally exempt from most NIS2 obligations.
- Energy: sub-sector thresholds apply; stricter duties may be imposed based on risk classification.
- Finance: aligned with DORA requirements; supervised by the financial authority.
Penalties for non-compliance
Denmark does not apply administrative fines in the same way as some EU Member States. Instead, sanctions are imposed by competent national courts as criminal penalties, typically following su pervisory authority’s recommendation. The maximum penalty levels are aligned with the turnover-based caps established under NIS2.
How to prepare for NIS2 in Denmark
- Determine scope: confirm your Annex I/II services and size thresholds; classify EE/IE.
- Register: submit your details on Virk.dk by 1 Oct 2025.
- Governance: secure board-level approval and accountability for cybersecurity.
- Risk management: implement/upscale ISO 27001/NIST CSF aligned controls across IT/OT.
- Supply chain: assess MSPs/MSSPs and critical suppliers; build contractual security requirements.
- Incident readiness: build detection, escalation and 24/7 reporting workflow to CSIRT.
- Continuity & crisis: document BCP/DR, run exercises and penetration tests.
- Train & prove: management training, staff awareness, and auditable evidence.