EU countries · Overview
One single market,
27 countries
Customs duties and product law are the same across the EU. Language, tax rates, authorities and the speed at which new laws arrive still vary from one country to the next.
EU country · Central Europe
Austria
What suppliers from South America should know about Austria: NISG 2026 in force since Oct 1, 2026, registration by year end, packaging rules, DSB, WKO.
EU country · Western Europe
Belgium
What suppliers from South America should know about Belgium: Port of Antwerp-Bruges, NIS2 since 2024 with CyFun or ISO 27001, three languages, packaging.
EU country · Southeastern Europe
Bulgaria
Bulgaria for exporters from South America: euro since 2026, ports of Varna and Burgas, 20 % VAT and NIS2 in the Cybersecurity Act since February 2026.
EU country · Southeastern Europe
Croatia
Croatia for exporters from South America: Port of Rijeka, euro, 25 % VAT and the EU's first NIS2 law, where authorities classify companies by decision.
EU country · Eastern Mediterranean
Cyprus
Cyprus for companies from South America: a small market, strict NIS2 rules with a 6-hour early warning, the data protection commissioner and 19 % VAT.
EU country · Central Europe
Czech Republic
Czech Republic for exporters from South America: labels in Czech, EKO-KOM, 21 % VAT, and NIS2 through Act No. 264/2025 Coll. and the NÚKIB.
EU country · Northern Europe
Denmark
What suppliers from South America should know about Denmark: NIS 2-loven since July 2025, Datatilsynet, 25 % VAT, packaging register and contacts.
EU country · Baltics
Estonia
What suppliers from South America should know about Estonia: Cybersecurity Act since January 2026, 24-hour duty for service providers, 24 % VAT.
EU country · Northern Europe
Finland
What suppliers from South America should know about Finland: Cybersecurity Act since April 2025, bilingual labels, 25.5 % VAT and useful contacts.
EU country · Western Europe
France
What suppliers from South America should know about France: French on labels, the Triman logo, Loi de vigilance, CNIL and where NIS2 transposition stands.
EU country · Central Europe
Germany
What suppliers from South America should know about Germany: NIS2 law since Dec 2025, Supply Chain Act, LUCID register, data protection authorities, AHKs.
EU country · Southern Europe
Greece
Greece for exporters from South America: Piraeus as the port, NIS2 since 2024 with supplier obligations, the HDPA data protection authority, 24 % VAT.
EU country · Central Europe
Hungary
Hungary for exporters from South America: 27 % VAT, producer responsibility through MOHU and a NIS2 law with mandatory audits overseen by the SZTFH.
EU country · Northwestern Europe
Ireland
What service providers from South America should know about Ireland: EU hubs of big tech and pharma firms, data protection at the DPC, NIS2 still pending.
EU country · Southern Europe
Italy
Italy for South American exporters: coffee, pulp, copper. NIS2 in force since 2024, mandatory labels in Italian, environmental packaging marks.
EU country · Baltics
Latvia
What South American suppliers need to know about Latvia: cybersecurity law, contract rules for providers, EU-only hosting, 21% VAT.
EU country · Baltics
Lithuania
What South American suppliers should know about Lithuania: cybersecurity law with NKSC register, packaging in GPAIS, 21% VAT, port of Klaipėda.
EU country · Western Europe
Luxembourg
What South American service providers should know about Luxembourg: NIS2 law since May 2026, ILR and CSSF, DORA for finance clients, CNPD.
EU country · Southern Europe
Malta
Malta for South American firms: a small market for goods, but buyers in finance and online gaming. NIS2 since January 2026, English is official.
EU country · Western Europe
Netherlands
What suppliers from South America should know about the Netherlands: Port of Rotterdam, the Cyberbeveiligingswet, packaging fees and data protection.
EU country · Central Europe
Poland
What South American suppliers should know about Poland: NIS2 via the KSC amendment since April 2026, BDO packaging register, 23% VAT, Port of Gdańsk.
EU country · Southern Europe
Portugal
Portugal for South American exporters: NIS2 in force since April 2026, mandatory Portuguese labeling, the CNPD as data protection authority, 23% VAT.
EU country · Southeastern Europe
Romania
Romania for South American exporters: Port of Constanța, 21% VAT, the RetuRO deposit system and NIS2 under OUG 155/2024, supervised by the DNSC.
EU country · Central Europe
Slovakia
Slovakia for South American exporters: car industry, euro, 23% VAT, a bottle deposit system and NIS2 through Act 69/2018 with NBÚ and SK-CERT.
EU country · Central Europe
Slovenia
Slovenia for South American exporters: the port of Koper, NIS2 measures due by Dec 19, 2026, instructions in Slovene and a 22% VAT rate.
EU country · Southern Europe
Spain
What South American exporters need to know about Spain: NIS2 not yet transposed, ENS for public sector clients, Spanish labels, packaging registry.
EU country · Northern Europe
Sweden
What suppliers from South America need to know about Sweden: Cybersäkerhetslag since January 2026, new supplier rules from October, IMY, 25% VAT.
Why your customer's country matters
If you ship goods to the EU, you pay the same duty and follow the same product rules wherever they land. The guide Exporting to the EU explains what that involves. A container of coffee from Huila clears customs in Hamburg under the same rules as in Valencia.
After that, the differences start. Labels and instructions usually have to be in the local language. VAT ranges from 17% to 27%. Packaging is reported to national registers, and each country has its own authorities for data protection, market surveillance and cybersecurity.
You see this most clearly with NIS2. The directive is addressed to the member states, so only the national law decides who is covered, where companies register and which authority supervises them. Some countries transposed it in 2024, others only in 2026. Spain, France and Ireland had not passed a law by the deadline; in July 2026 the Commission took them to the Court of Justice of the EU, together with the Netherlands. The Netherlands brought its law into force shortly afterward.
What this means for you as a supplier: ask your customer which national law it is classified under. That law determines the reporting deadlines and the evidence it will write into your contract. Many suppliers keep that evidence in one place so they can reuse it from one customer to the next. A GRC platform such as Sightadel links NIS2 measures and ISO 27001 controls to the same documents.
The 27 countries compared
| Country | Official language(s) | NIS2 transposition (status) | Standard VAT rate |
|---|---|---|---|
| Austria | German | NISG 2026, in force since Oct 1, 2026 | 20% |
| Belgium | Dutch, French, German | NIS2 law of Apr 26, 2024, in force since Oct 18, 2024 | 21% |
| Bulgaria | Bulgarian | Amendment to the Cybersecurity Act, State Gazette No. 17 of Feb 13, 2026 | 20% |
| Croatia | Croatian | Zakon o kibernetičkoj sigurnosti (NN 14/2024), since Feb 15, 2024 | 25% |
| Cyprus | Greek, Turkish | N. 60(I)/2025, since Apr 25, 2025 | 19% |
| Czech Republic | Czech | Zákon 264/2025 Sb., since Nov 1, 2025 | 21% |
| Denmark | Danish | NIS 2-loven (lov nr. 434/2025), since Jul 1, 2025 | 25% |
| Estonia | Estonian | Amendment to the Küberturvalisuse seadus, since Jan 1, 2026 | 24% |
| Finland | Finnish, Swedish | Kyberturvallisuuslaki 124/2025, since Apr 8, 2025 | 25.5% |
| France | French | Bill before parliament, not yet passed | 20% |
| Germany | German | NIS2UmsuCG, since Dec 6, 2025 | 19% |
| Greece | Greek | Law 5160/2024, since Nov 27, 2024 | 24% |
| Hungary | Hungarian | Act LXIX of 2024, since Jan 1, 2025 | 27% |
| Ireland | Irish, English | Bill in preparation, not yet introduced | 23% |
| Italy | Italian | D.Lgs. 138/2024, since Oct 16, 2024 | 22% |
| Latvia | Latvian | Nacionālās kiberdrošības likums, since Sep 1, 2024 | 21% |
| Lithuania | Lithuanian | Revised Kibernetinio saugumo įstatymas, since Oct 18, 2024 | 21% |
| Luxembourg | Luxembourgish, French, German | Law of May 5, 2026, since May 10, 2026 | 17% |
| Malta | Maltese, English | L.N. 71 of 2025, fully in force since Jan 23, 2026 | 18% |
| Netherlands | Dutch | Cyberbeveiligingswet, since Aug 15, 2026 | 21% |
| Poland | Polish | Amendment to the KSC Act (Dz.U. 2026 poz. 252), since Apr 3, 2026 | 23% |
| Portugal | Portuguese | Decreto-Lei 125/2025, since Apr 3, 2026 | 23% |
| Romania | Romanian | OUG 155/2024, published Dec 31, 2024, confirmed by Legea 124/2025 | 21% |
| Slovakia | Slovak | Amendment 366/2024 Z. z. to Act 69/2018, since Jan 1, 2025 | 23% |
| Slovenia | Slovenian | ZInfV-1, since Jun 19, 2025 | 22% |
| Spain | Spanish | Bill, not yet passed | 21% |
| Sweden | Swedish | Cybersäkerhetslag (2025:1506), since Jan 15, 2026 | 25% |
Besides Spanish, some Spanish regions have further official languages, such as Catalan, Basque and Galician. The tax rates come from the European Commission's overview; reduced rates for food and other goods are not listed.
To see where your company stands on the EU rules, take the free EU Readiness Check.
FAQ
Is customs duty the same in every EU country?
Which countries have not transposed NIS2 yet?
Where is VAT highest?
Which tool helps me answer NIS2 questionnaires from customers in different EU countries?
- Your Europe: VAT rates in the EU
- European Commission: NIS2 transposition in the member states
- European Commission: Reasoned opinions sent to 19 member states (May 2025)
- European Union: Official languages of the member states
General information, not legal advice. The official texts are authoritative.
EU rule · Cybersecurity
NIS2
What NIS2 means for IT service providers, software firms and industrial suppliers in South America: duties, reporting deadlines, proof for EU clients.
Guide · First steps
Exporting to the EU
Tariff codes, origin, CE marking, food law, customs, contracts and compliance: seven steps into the EU market, plus a plan for your first 90 days.
Free check
EU Readiness Check
See in 10 minutes which EU rules apply to your company and where the gaps are. Free, with a detailed PDF report sent to you by email.