Skip to content

EU countries · Overview

One single market,
27 countries

Customs duties and product law are the same across the EU. Language, tax rates, authorities and the speed at which new laws arrive still vary from one country to the next.

Member states27
NIS2 transposed24 of 27 (as of Oct 11, 2026)
VAT17% (Luxembourg) to 27% (Hungary)

EU country · Central Europe

Austria

What suppliers from South America should know about Austria: NISG 2026 in force since Oct 1, 2026, registration by year end, packaging rules, DSB, WKO.

EU country · Western Europe

Belgium

What suppliers from South America should know about Belgium: Port of Antwerp-Bruges, NIS2 since 2024 with CyFun or ISO 27001, three languages, packaging.

EU country · Southeastern Europe

Bulgaria

Bulgaria for exporters from South America: euro since 2026, ports of Varna and Burgas, 20 % VAT and NIS2 in the Cybersecurity Act since February 2026.

EU country · Southeastern Europe

Croatia

Croatia for exporters from South America: Port of Rijeka, euro, 25 % VAT and the EU's first NIS2 law, where authorities classify companies by decision.

EU country · Eastern Mediterranean

Cyprus

Cyprus for companies from South America: a small market, strict NIS2 rules with a 6-hour early warning, the data protection commissioner and 19 % VAT.

EU country · Central Europe

Czech Republic

Czech Republic for exporters from South America: labels in Czech, EKO-KOM, 21 % VAT, and NIS2 through Act No. 264/2025 Coll. and the NÚKIB.

EU country · Northern Europe

Denmark

What suppliers from South America should know about Denmark: NIS 2-loven since July 2025, Datatilsynet, 25 % VAT, packaging register and contacts.

EU country · Baltics

Estonia

What suppliers from South America should know about Estonia: Cybersecurity Act since January 2026, 24-hour duty for service providers, 24 % VAT.

EU country · Northern Europe

Finland

What suppliers from South America should know about Finland: Cybersecurity Act since April 2025, bilingual labels, 25.5 % VAT and useful contacts.

EU country · Western Europe

France

What suppliers from South America should know about France: French on labels, the Triman logo, Loi de vigilance, CNIL and where NIS2 transposition stands.

EU country · Central Europe

Germany

What suppliers from South America should know about Germany: NIS2 law since Dec 2025, Supply Chain Act, LUCID register, data protection authorities, AHKs.

EU country · Southern Europe

Greece

Greece for exporters from South America: Piraeus as the port, NIS2 since 2024 with supplier obligations, the HDPA data protection authority, 24 % VAT.

EU country · Central Europe

Hungary

Hungary for exporters from South America: 27 % VAT, producer responsibility through MOHU and a NIS2 law with mandatory audits overseen by the SZTFH.

EU country · Northwestern Europe

Ireland

What service providers from South America should know about Ireland: EU hubs of big tech and pharma firms, data protection at the DPC, NIS2 still pending.

EU country · Southern Europe

Italy

Italy for South American exporters: coffee, pulp, copper. NIS2 in force since 2024, mandatory labels in Italian, environmental packaging marks.

EU country · Baltics

Latvia

What South American suppliers need to know about Latvia: cybersecurity law, contract rules for providers, EU-only hosting, 21% VAT.

EU country · Baltics

Lithuania

What South American suppliers should know about Lithuania: cybersecurity law with NKSC register, packaging in GPAIS, 21% VAT, port of Klaipėda.

EU country · Western Europe

Luxembourg

What South American service providers should know about Luxembourg: NIS2 law since May 2026, ILR and CSSF, DORA for finance clients, CNPD.

EU country · Southern Europe

Malta

Malta for South American firms: a small market for goods, but buyers in finance and online gaming. NIS2 since January 2026, English is official.

EU country · Western Europe

Netherlands

What suppliers from South America should know about the Netherlands: Port of Rotterdam, the Cyberbeveiligingswet, packaging fees and data protection.

EU country · Central Europe

Poland

What South American suppliers should know about Poland: NIS2 via the KSC amendment since April 2026, BDO packaging register, 23% VAT, Port of Gdańsk.

EU country · Southern Europe

Portugal

Portugal for South American exporters: NIS2 in force since April 2026, mandatory Portuguese labeling, the CNPD as data protection authority, 23% VAT.

EU country · Southeastern Europe

Romania

Romania for South American exporters: Port of Constanța, 21% VAT, the RetuRO deposit system and NIS2 under OUG 155/2024, supervised by the DNSC.

EU country · Central Europe

Slovakia

Slovakia for South American exporters: car industry, euro, 23% VAT, a bottle deposit system and NIS2 through Act 69/2018 with NBÚ and SK-CERT.

EU country · Central Europe

Slovenia

Slovenia for South American exporters: the port of Koper, NIS2 measures due by Dec 19, 2026, instructions in Slovene and a 22% VAT rate.

EU country · Southern Europe

Spain

What South American exporters need to know about Spain: NIS2 not yet transposed, ENS for public sector clients, Spanish labels, packaging registry.

EU country · Northern Europe

Sweden

What suppliers from South America need to know about Sweden: Cybersäkerhetslag since January 2026, new supplier rules from October, IMY, 25% VAT.

Why your customer's country matters

If you ship goods to the EU, you pay the same duty and follow the same product rules wherever they land. The guide Exporting to the EU explains what that involves. A container of coffee from Huila clears customs in Hamburg under the same rules as in Valencia.

After that, the differences start. Labels and instructions usually have to be in the local language. VAT ranges from 17% to 27%. Packaging is reported to national registers, and each country has its own authorities for data protection, market surveillance and cybersecurity.

You see this most clearly with NIS2. The directive is addressed to the member states, so only the national law decides who is covered, where companies register and which authority supervises them. Some countries transposed it in 2024, others only in 2026. Spain, France and Ireland had not passed a law by the deadline; in July 2026 the Commission took them to the Court of Justice of the EU, together with the Netherlands. The Netherlands brought its law into force shortly afterward.

What this means for you as a supplier: ask your customer which national law it is classified under. That law determines the reporting deadlines and the evidence it will write into your contract. Many suppliers keep that evidence in one place so they can reuse it from one customer to the next. A GRC platform such as Sightadel links NIS2 measures and ISO 27001 controls to the same documents.

The 27 countries compared

CountryOfficial language(s)NIS2 transposition (status)Standard VAT rate
AustriaGermanNISG 2026, in force since Oct 1, 202620%
BelgiumDutch, French, GermanNIS2 law of Apr 26, 2024, in force since Oct 18, 202421%
BulgariaBulgarianAmendment to the Cybersecurity Act, State Gazette No. 17 of Feb 13, 202620%
CroatiaCroatianZakon o kibernetičkoj sigurnosti (NN 14/2024), since Feb 15, 202425%
CyprusGreek, TurkishN. 60(I)/2025, since Apr 25, 202519%
Czech RepublicCzechZákon 264/2025 Sb., since Nov 1, 202521%
DenmarkDanishNIS 2-loven (lov nr. 434/2025), since Jul 1, 202525%
EstoniaEstonianAmendment to the Küberturvalisuse seadus, since Jan 1, 202624%
FinlandFinnish, SwedishKyberturvallisuuslaki 124/2025, since Apr 8, 202525.5%
FranceFrenchBill before parliament, not yet passed20%
GermanyGermanNIS2UmsuCG, since Dec 6, 202519%
GreeceGreekLaw 5160/2024, since Nov 27, 202424%
HungaryHungarianAct LXIX of 2024, since Jan 1, 202527%
IrelandIrish, EnglishBill in preparation, not yet introduced23%
ItalyItalianD.Lgs. 138/2024, since Oct 16, 202422%
LatviaLatvianNacionālās kiberdrošības likums, since Sep 1, 202421%
LithuaniaLithuanianRevised Kibernetinio saugumo įstatymas, since Oct 18, 202421%
LuxembourgLuxembourgish, French, GermanLaw of May 5, 2026, since May 10, 202617%
MaltaMaltese, EnglishL.N. 71 of 2025, fully in force since Jan 23, 202618%
NetherlandsDutchCyberbeveiligingswet, since Aug 15, 202621%
PolandPolishAmendment to the KSC Act (Dz.U. 2026 poz. 252), since Apr 3, 202623%
PortugalPortugueseDecreto-Lei 125/2025, since Apr 3, 202623%
RomaniaRomanianOUG 155/2024, published Dec 31, 2024, confirmed by Legea 124/202521%
SlovakiaSlovakAmendment 366/2024 Z. z. to Act 69/2018, since Jan 1, 202523%
SloveniaSlovenianZInfV-1, since Jun 19, 202522%
SpainSpanishBill, not yet passed21%
SwedenSwedishCybersäkerhetslag (2025:1506), since Jan 15, 202625%

Besides Spanish, some Spanish regions have further official languages, such as Catalan, Basque and Galician. The tax rates come from the European Commission's overview; reduced rates for food and other goods are not listed.

To see where your company stands on the EU rules, take the free EU Readiness Check.

FAQ

Is customs duty the same in every EU country?
Yes. The EU is a customs union with a common customs tariff. VAT and some excise duties differ.
Which countries have not transposed NIS2 yet?
As of October 11, 2026: Spain, France and Ireland. The Commission took them to the Court of Justice of the EU in July 2026.
Where is VAT highest?
In Hungary, at 27%. Luxembourg has the lowest standard rate at 17%.
Which tool helps me answer NIS2 questionnaires from customers in different EU countries?
Deadlines and registration differ from country to country, but the security measures customers ask about largely follow Article 21 of the directive. Sightadel organizes these measures and the evidence for them and is developed and hosted in Germany. For questions about your systems reachable from the internet, veyrisk produces a report on your external attack surface.