Denmark NIS2 Guide: NIS 2 Act, Virk.dk and SAMSIK

Denmark's NIS 2 Act has applied since 1 July 2025, and its registration form asks for something many groups do not have to hand: the static public IP addresses of every server they operate, in CIDR format, kept up to date within three months of any change. The Act (Act No. 434 of 6 May 2025) sits alongside separate energy and telecoms laws, with the Danish Resilience Agency (Styrelsen for Samfundssikkerhed, SAMSIK) coordinating and sector authorities supervising. This guide covers who is in scope, how registration on Virk.dk works, management duties, incident reporting, enforcement, and what the measures mean for service accounts, API keys and AI agents. It is for CISOs, compliance leads and auditors with Danish entities. The Directive is covered in the NIS2 Directive Guide and the cross-country status in the NIS2 Transposition Tracker.

Sources and status, checked 9 November 2026: registration facts come from the Danish Agency for Digital Government (Digitaliseringsstyrelsen) registration guidance and its English NIS 2 pages. The Act text on Retsinformation could not be retrieved during research, so parts of this page are based on secondary sources: PwC Legal's Denmark summary and Legiscope's Danish implementation article. Each such point is attributed. Confirm against the official text before relying on it. This page is not legal advice.

Key takeaways

The registration deadline has passed: covered entities had to register on Virk.dk by 1 October 2025; an entity that becomes covered later has two weeks to register.
Changes within three months: any change to the registered details, including IP ranges, needs a new form marked as an update within three months.
Sector laws split the picture: energy and telecoms have their own laws, and DORA entities do not register under the NIS 2 Act.
Enforcement runs through the courts: PwC reports that Denmark has no administrative fines and that courts impose fines as criminal penalties on the supervisor's recommendation.
Machine identities sit inside management duties: management must approve and oversee the measures, and those measures reach service accounts, keys and AI agents.

Scope: who and what is covered

Coverage follows Annexes 1 and 2 of the Danish Act, which mirror the Directive's sectors. Danish specifics reported by PwC Legal:

Size test: more than 50 employees, or annual turnover and balance sheet above EUR 10 million. PwC stresses the criteria are not cumulative, so headcount alone can bring you in.
Public sector: most public bodies, including municipalities, are covered. Parliament, the National Audit Office, the Ombudsman, the courts and some educational and cultural bodies are excluded, as are bodies handling national security, defence or law enforcement.
Chemicals: manufacturers and distributors are out of scope unless they must register hazardous industrial chemicals under REACH.
Incidental telecoms: cafés, hotels and similar businesses whose telecoms activity is incidental are generally exempt.
Separate sector laws: the energy sector law took effect on 7 March 2025 and the telecoms law on 1 July 2025, according to PwC. The finance sector is aligned with DORA. See the DORA and NIS2 Overlap Mapping Guide.

Digital providers: Digitaliseringsstyrelsen notes that DNS providers, TLD registries, cloud, data centre, CDN, managed service and managed security service providers, online marketplaces, search engines, social networks and trust service providers follow Implementing Regulation (EU) 2024/2690 instead of the general measures and reporting rules. If an entity provides one of these services, the whole entity is covered, even if the service is minor. See the NIS2 Implementing Regulation 2024/2690 Guide.

Authorities

Body	Role	Source
Ministry of Resilience and Preparedness	Responsible ministry; coordinates implementation	Digitaliseringsstyrelsen
Styrelsen for Samfundssikkerhed (SAMSIK)	Overall coordination; contact for the registration process	Digitaliseringsstyrelsen registration guidance
Digitaliseringsstyrelsen (Agency for Digital Government)	Sector authority for digital entities ([email protected])	Digitaliseringsstyrelsen
Other sector authorities	For example energy, health and transport authorities, each within its sector	Legiscope
Danish Defence Intelligence Service	National CSIRT handling incident reports	PwC Legal

Registration on Virk.dk

Registration rests on sections 9 and 10 of the Act. Digitaliseringsstyrelsen's guidance sets out the process:

Open the form on Virk.dk and sign in with MitID Erhverv.
Complete the fields: company name; sector, subsector and type under Annex 1 or 2; email, telephone and IP ranges; and the EU Member States where services are provided.
Certain digital entities also give the main establishment and other EU establishments, or, if established outside the EU, the representative appointed under section 2(4).
Submit. The data is shared automatically with the relevant sector authorities.

The IP address rules

List only static public IP addresses for servers the company operates and controls, physically or virtually.
Do not list dynamic addresses.
If there are none, explain why in the form.
Give several addresses or networks in CIDR format, separated by commas.

This is where cloud estates cause trouble. Elastic addresses, load balancers and egress gateways are often owned by platform teams and change with deployments. Pull the list from your cloud inventory, not from a spreadsheet, and set a review that fires when a static address is allocated or released.

Updates: submit a new form within three months of a change and mark it as an update of a previous registration. DORA-covered companies do not register under the NIS 2 Act.

MitID Erhverv rights: the people who can file for the company hold a privileged business identity. Record them, review them on role change and keep a deputy.

Management duties and measures

Digitaliseringsstyrelsen lists four headline obligations: registration, specific requirements for management, incident reporting and adequate security measures. Legiscope reports that management must approve and oversee the risk management measures, must take training on cybersecurity risks, and cannot delegate the responsibility away, in line with Article 20 of the Directive. For the board view, see the NIS2 Management Liability Executive Briefing.

The Act does not name a standard, according to PwC, though official guidance points to DS/EN ISO/IEC 27001:2023, NIST CSF 2.0 and the DS IEC 62443 series. Use whichever your group already runs and map it to the Article 21 areas. The ISO 27001 Certification Guide covers certification.

Incident reporting

Channel: incidents are reported via Virk.dk, according to Digitaliseringsstyrelsen.
Timelines: PwC states Denmark made no changes to the Directive's reporting rules. Legiscope gives the stages: early warning within 24 hours, notification within 72 hours, and a final report within one month of the notification, or one month after handling ends for ongoing incidents.
One process for two duties: PwC notes that significant incidents and GDPR personal data breaches can be reported through the same process and platform. That helps when a leaked credential exposes personal data.

The Cyber Incident Reporting Requirements Map sets out the overlaps with other regimes.

Enforcement

PwC Legal reports that Denmark has no administrative fines under the Act: competent national courts impose fines as criminal penalties, taking account of the recommendation of the supervisory authority that brings the case. We could not confirm national maximum amounts from two independent sources, so they are not given here. Confirm against the official text before relying on it.

In practice this means a sanction follows a referral and a court process, which favours a clear evidence trail: decisions, approvals and remediation records that show the measures were taken seriously.

What it means for AI agents and non-human identities

The IP list is an NHI clue: every static address you register belongs to a server or service, and most of those run under service accounts. Use the registration exercise to confirm each one has an owner.
Inventory per entity: list service accounts, API keys, OAuth applications, certificates and AI agents for each Danish entity. The Non-Human Identity (NHI) Guide explains the categories.
Agents need their own identity: give each AI agent a distinct identity with scoped permissions and logging, so its actions can be explained in a 72-hour notification.
Supplier access: keys and grants held by managed service providers belong in supply chain evidence.
Review cadence: NHI Mgmt Group recommends quarterly review of privileged machine identities and annual review of the rest. This is our recommendation, not a Danish requirement.

Compliance steps

Check each Danish entity against Annexes 1 and 2 and the non-cumulative size test.
Confirm Virk.dk registration and that the IP ranges are current and static.
Set a three-month update process tied to cloud address changes.
Record MitID Erhverv holders who can register and report.
Minute management approval of the measures and keep training records.
Add machine identities and AI agents to access control evidence.
Rehearse joint NIS 2 and GDPR reporting through Virk.dk.

Common failure patterns

Dynamic addresses in the form: listing addresses that change, or none at all without an explanation.
Size test misread: assuming both headcount and turnover must be exceeded.
Late updates: mergers, new services or new address blocks not filed within three months.
Separate GDPR and NIS 2 teams: two parallel reports with different facts about the same incident.
Service accounts with no owner: access reviews cover staff only.

Practitioner checklist

Confirm Annex coverage and size for each Danish entity.
Verify the Virk.dk registration and its static IP list.
Set an owner for three-month registration updates.
Keep at least two MitID Erhverv holders able to file.
Record management approval and training.
Include machine identities and AI agents in access evidence.
Rehearse 24-hour, 72-hour and one-month reporting.
Check whether DORA or a sector law applies instead.

Standards and references

Related NHI Mgmt Group resources: NIS2 Directive Guide · NIS2 Transposition Tracker · NIS2 Readiness Checklist · Finland NIS2 Implementation Guide · Non-Human Identity (NHI) Guide. This guide summarises the Danish NIS 2 Act as it stood on 9 November 2026 and is not legal advice.

Denmark NIS2 Implementation: NIS 2 Act registration, authorities and reporting