NIS2 in Denmark: does it apply to you, and what comes first?

In Denmark, NIS2 is implemented through the Danish NIS 2 Act (in force since 1 July 2025) and other laws. Whether and how it covers you depends on sector, size and the Act's exceptions. You get a ranked list of NIS2 priorities from a named senior lead working at board and executive level, and your leadership decides.

Describe your situation

Written by Behzad Motaghi, founder of Accel Comply. Legal sources checked 13 November 2026.

Board responsibility for cybersecurity sets out which security decisions belong with the board and executive team, and what they can ask to see.

Short answer

Does it apply? Generally yes, if one of your activities is a type listed in Annex 1 or 2 of the Danish NIS 2 Act and you have at least 50 annual work units, or more than EUR 10 million in both turnover and balance sheet. The annexes cover sectors such as transport, health, drinking water, digital infrastructure, manufacturing, food and digital providers, and some types are covered whatever their size. In a group, linked companies count in full and partner companies in proportion, unless the entity operates largely independently of them. Energy and telecom entities are excluded to the extent their own sector acts cover them; for them, the NIS2 requirements come through those acts. Entities designated under the Financial Business Act and those under EU sector rules with at least the same effect, such as DORA for many financial entities, are also outside.

What does it require? Cybersecurity risk-management measures across at least ten areas, approved by the management body, which also oversees them and whose members take relevant training. Covered entities register with their authority and report a significant incident without undue delay: an early warning within 24 hours and a notification within 72 hours of becoming aware of it, or 24 hours for trust service providers. Without undue delay, they also tell the recipients of their services about significant incidents likely to impair the service, and tell recipients who may be hit by a significant cyber threat what measures they can take, and where relevant about the threat itself.

What comes first? Settle whether and how each legal entity is covered, and have counsel confirm it. Then check the registration, the incident reporting path and the management approval. The table below sets out each step with its source.

NIS2 in Denmark: the questions leadership asks

Question	What the Danish NIS 2 Act says	First step for leadership	Source
Is our type of business covered?	What the Danish NIS 2 Act says: The Act covers public and private entities of the types listed in Annex 1 (sectors of high criticality) and Annex 2 (other critical sectors).	First step for leadership: Have someone map each legal entity’s activities against the two annexes.	Source: Section 1(1), Annexes 1 and 2
Are we large enough to be covered?	What the Danish NIS 2 Act says: An Annex 1 type is essential with 250 or more employees, or turnover over EUR 50 million and balance sheet over EUR 43 million. An Annex 1 or 2 type that is not essential is important with 50 or more employees, or turnover and balance sheet each over EUR 10 million. Employees are counted as annual work units, with part-time and part-year work counted as fractions, and an entity only changes size category after crossing a threshold two financial years in a row, unless the change comes from a merger or acquisition. Linked companies in a group count in full and partner companies in proportion, unless the entity operates largely independently of them, especially in its network and information systems (SAMSIK guidance). Essential entities are supervised proactively; important entities after indications of non-compliance.	First step for leadership: Collect annual work units, turnover and balance sheet for the last two financial years for each legal entity, its linked companies and its partner companies.	Source: Sections 4(1), 5(1), 21 and 24; SAMSIK scope guidance (2025)
Can we be covered regardless of size?	What the Danish NIS 2 Act says: Yes. Qualified trust service providers, top-level domain name registries, DNS service providers and central government bodies are essential whatever their size. So are entities identified as critical under the CER Act, former operators of essential services and certain sole or critical providers, although the authority can classify the last two groups as important. Trust service providers that are not essential are important whatever their size.	First step for leadership: Check the special rules before relying on the size test.	Source: Sections 4(3), 5(2) and 5(3)
Could another law apply instead?	What the Danish NIS 2 Act says: Entities are outside the Act to the extent they fall under the Danish acts on preparedness in the energy sector or on security in the telecom sector, if designated under the Financial Business Act, or where sector-specific EU rules have at least the same effect as the Act’s requirements on measures and reporting.	First step for leadership: Ask counsel to confirm which act applies, and record the answer with its date.	Source: Section 1(2) and (3)
Have we registered?	What the Danish NIS 2 Act says: Essential and important entities register within two weeks of coming under the Act and report changes within two weeks. DNS, cloud, data centre and managed service providers and the other digital providers listed in section 9 have three months for both. The first deadline was 1 October 2025. Registration is on virk.dk with MitID Erhverv.	First step for leadership: Confirm the registration exists and that its contact details and IP ranges are current.	Source: Sections 9, 10 and 33(3); Executive Order 620, section 14
What must the measures cover?	What the Danish NIS 2 Act says: Appropriate and proportionate measures covering at least: risk analysis and information system security policies; incident handling; business continuity, backup, disaster recovery and crisis management; supply chain security; security in acquiring, developing and maintaining systems, including vulnerability handling and disclosure; assessing whether the measures work; basic cyber hygiene and training; cryptography and, where relevant, encryption; personnel security, access control and asset management; and, where relevant, multi-factor or continuous authentication, secured voice, video and text communications and secured emergency communications. DNS, cloud, data centre, managed service and trust service providers and the other digital services listed in the implementing regulation must also meet its technical requirements.	First step for leadership: Compare current measures with the ten areas and estimate what closing each gap costs.	Source: Section 6(1); Implementing Regulation (EU) 2024/2690, Articles 1 and 2
What must management do?	What the Danish NIS 2 Act says: The management body approves the measures and oversees their implementation. In a company with both a board and an executive board, the management body is the board; in a company with only an executive board, or with an executive board and a supervisory council, it is the executive board. A company with neither has the body with equivalent powers, and a public authority has its top administrative management. Its members take relevant courses on managing cybersecurity risk and encourage similar training for staff.	First step for leadership: Put the measures to the management body for approval and book the training.	Source: Sections 3(20) and 7
What if we have a significant incident?	What the Danish NIS 2 Act says: An incident is significant if it has caused or can cause severe operational disruption or financial loss for the entity, or considerable damage to others; for DNS, cloud, data centre, managed service and trust service providers and the other digital services listed in Implementing Regulation (EU) 2024/2690, the regulation’s criteria decide whether an incident is significant. Notify the competent authority and the CSIRT without undue delay: an early warning within 24 hours and an incident notification within 72 hours of becoming aware of it (24 hours for trust service providers), an interim report if the CSIRT asks, and a final report within one month of the notification. If the incident is still ongoing then, send a progress report and the final report within one month of handling it. Without undue delay, tell recipients of your services about significant incidents likely to impair the service, and tell recipients who may be hit by a significant cyber threat what measures they can take, and where relevant about the threat itself.	First step for leadership: Name who decides that an incident is significant and who submits the report on virk.dk, and agree the test in advance.	Source: Sections 12, 13 and 15; Implementing Regulation (EU) 2024/2690

Section references are to the Danish NIS 2 Act (Act no. 434 of 6 May 2025) and Executive Order no. 620 of 2 June 2025. Counsel confirms whether and how the Act applies to a specific entity.

What the Danish Act asks of you

Does the Danish NIS 2 Act apply to us?

Denmark implements NIS2 through, among other legislation, the Danish NIS 2 Act, Act no. 434 of 6 May 2025, which entered into force on 1 July 2025 (section 33). The starting point is the entity types in Annexes 1 and 2, subject to the exceptions and extension provisions in section 1. Size and a set of special rules then decide whether the entity is essential or important, and exceptions and sector laws can change the result (Danish NIS 2 Act, sections 1, 4 and 5). The adviser's answer goes into the decision paper with its date and caveats, so management knows what it is relying on.

Start with the legal entity, not the group. Check whether one of its activities matches a type in Annex 1 or 2, then apply the size test, counting linked companies in full and partner companies in proportion unless the entity operates largely independently of them, then the special rules that bring an entity in regardless of size and the exceptions that take it out. Danish rules apply to entities established in Denmark. DNS, cloud, data centre, managed service and the other digital providers in section 2(2) fall under the EU country where their cybersecurity decisions are mainly taken, with fallbacks to where cybersecurity operations are carried out and then the EU country where the entity’s establishment with the most employees is located, and a provider with no EU establishment that offers services in the EU appoints a representative in one of the countries where it offers them (section 2(3) and (4)). The Danish Resilience Agency points companies to its NIS2tjek.dk tool for a first check, and counsel confirms the result.

A legal adviser can only assess the facts in front of them. Accel Comply gathers those facts for the specific legal entity: its services, the countries involved and the sector being considered. The assessment then covers the entity and service the decision is about, not a group overview.

Management responsibility under NIS2: what must be approved and overseen?

In an essential or important entity, the management body must approve the cybersecurity risk-management measures and oversee their implementation, and its members must attend relevant training on managing cybersecurity risk (Danish NIS 2 Act, section 7). Accel Comply prepares the proposal for that approval, so the management body knows what it is signing off, and the senior lead follows up with IT and suppliers. Keep the legal adviser, the decision owner and the operating owner distinct: one person can contribute in several places, but accountability must not disappear into a working group.

Which deadlines does management need to know about?

Record each deadline with its source, so it is clear who must act and when. Do not merge them into one generic NIS2 deadline:

Legal deadline: for covered entities, an early warning and an incident notification must be sent without undue delay, and no later than 24 and 72 hours respectively after becoming aware of a significant incident; for trust service providers, the deadline for the incident notification is 24 hours (Danish NIS 2 Act, section 13(1), points 1 and 2, and section 13(2))
Customer deadline: the notification or evidence duty written into the contract
Internal deadline: the escalation point that lets the right owner act in time

Which Danish authority supervises you?

Supervision is split by sector under Executive Order no. 620 of 2 June 2025, and for public bodies the public administration rules come first. Find your sector and the authority that receives your registration and answers your questions:

Municipalities and central government (except the bodies named in the rows below); chemicals; manufacturing of computers, electronic and optical products, electrical equipment, machinery, motor vehicles and other transport equipment; internet exchange points; vessel traffic services: Danish Resilience Agency (Styrelsen for Samfundssikkerhed)
Health, medical devices and the regions, plus the Danish Resilience Agency itself and its ministry: Danish Health Data Authority (Sundhedsdatastyrelsen)
DNS (except root name server operators), top-level domains, domain name registration, cloud, data centres, content delivery networks, trust services, managed (security) services, online marketplaces, search engines and social networks: Agency for Digital Government (Digitaliseringsstyrelsen)
Air, rail and road transport, ports, postal and courier services, plus Banedanmark and the Danish Road Directorate: Danish Civil Aviation and Railway Authority (Trafikstyrelsen)
Shipping companies: Danish Maritime Authority (Søfartsstyrelsen)
Drinking water, wastewater and waste management (except incineration): Danish Environmental Protection Agency (Miljøstyrelsen)
Waste incineration plants: Danish Energy Agency (Energistyrelsen)
Industrial food production, processing and wholesale distribution: Danish Veterinary and Food Administration (Fødevarestyrelsen)
Space and research: Danish Agency for Higher Education and Science (Uddannelses- og Forskningsstyrelsen); space bodies under the Ministry of Climate, Energy and Utilities: Danish Agency for Climate Data (Klimadatastyrelsen)
Outside the NIS 2 Act, own sector act: energy, under the Danish act on preparedness in the energy sector: Danish Energy Agency (Energistyrelsen)
Outside the NIS 2 Act, own sector act: public electronic communications networks and services, under the Danish telecom act: Danish Resilience Agency (Styrelsen for Samfundssikkerhed)
Outside the NIS 2 Act, own sector act: designated operators of financial digital infrastructure: Danish Financial Supervisory Authority (Finanstilsynet)

A customer requirement may still call for a management decision on what you promise and invest, even when it does not settle whether the Act applies to you. Keep the two questions apart.

Do not use penalty figures as a scoping shortcut.

Penalty headlines do not establish whether a particular entity is covered or what it must do next. Settle scope, authority and priorities first, so the board decides on your actual situation, not on a headline. For the record, the Danish Act punishes breaches of, among others, the measures, registration and reporting duties with a fine and lets companies be held criminally liable, but it does not state a maximum amount (section 32). The figures often quoted come from the EU directive. For breaches of its measures or reporting articles, it requires the maximum fine to be at least EUR 10 million or 2 percent of the total worldwide annual turnover in the previous financial year of the undertaking the entity belongs to, whichever is higher, for essential entities, and at least EUR 7 million or 1.4 percent for important entities, while each member state decides whether and how fines apply to public administration. For an essential entity outside public administration, the authority can also, once earlier enforcement has not worked and a deadline has passed, temporarily bar people with management responsibility at the level of chief executive or legal representative from management functions in that entity (section 23).

What should sit behind management’s decision?

Collect only what management needs in order to decide, and what the owner needs in order to act:

Entity: legal name, registration and group boundary
Services: what is supplied, to whom and in which jurisdictions
Sector: the classification being tested and why
Thresholds: the facts used for size or special-scope tests
Primary text: the current EU, Danish and sector-specific sources relied on
Legal boundary: what counsel has confirmed and what remains uncertain
Customer request: what the customer requires in the contract, kept apart from the legal question
Operating owner: who maintains the controls, records and response process
Decision owner: who in management approves the position and the next step
Review point: the date or event that requires the position to be checked again

Three NIS2 decisions that sit with management.

What starts first, and how much to spend

Each item comes with its cost and consequence, so the executive team and board know what they are approving and what can wait.

Who in the executive team owns what

Each measure gets an owner in the executive team and a date, so the board knows whom to ask when something stalls.

How management oversees the work

Leadership gets a status update at intervals you agree: what's done, what has stalled and what needs a new decision. The update draws on information supplied by your own people and suppliers.

How Accel Comply takes NIS2 to a management decision

Accel Comply identifies the NIS2 decisions your executive team and board have to take themselves: what starts first, who owns it and what the board needs to see before it can stand behind its approval. Your senior lead prepares those decisions with leadership, IT and suppliers and follows up on what you decide.

Pin down the decision that put NIS2 on the management agenda, and the entity and service it concerns, so the work answers that decision.
Write down the legal questions for your adviser, so the practical work can start while they are answered.
Put the recommendation to the executive team and board, and get the decision written down so it can be followed through.
Decide whether the work stops, is carried out in-house or is followed through by the senior lead for an agreed period.

It starts with a 30-minute conversation to see whether there’s a fit, and a scoping session of 30 to 60 minutes. Then you agree scope and timing for a paid gap analysis or fixed-fee assessment around your senior lead’s availability.

When is Accel Comply relevant?

When NIS2 has reached the executive team or board as a decision about money, priorities or accountability, and nobody in-house has been given the job of preparing it. Or when your own head of IT or security wants a second view or part of the work taken off their hands. If you are a financial entity, read the DORA page too.

Author and primary sources

Accel Comply was founded by Behzad Motaghi, who has held senior IT and security roles since 2009.

Checked 13 November 2026. Check the current text and the competent authority for your sector before relying on a legal position.

Turn the requirement into a plan your leadership owns and your people can carry out.

Accel Comply helps leadership choose goals, assign responsibility and plan your people's time and suppliers' contributions. You also agree how the result will be checked. The senior lead on the engagement can coordinate follow-up with your IT people and suppliers until the agreed handover.

See the full service

What's standing in the way of growth, new business or your AI plans? Find out what it will take.

A few lines are enough: what the business needs to achieve, what's in the way and who in leadership makes the call. You get a reply about your own situation without having to set aside time for a meeting first.

Describe your situation Or book a 30-minute call