Lawbster is desktop-first for professionals — but we won't let you down for a quick read.

NIS2 Directive

Table of Contents

Chapter I — GENERAL PROVISIONS

Art. 1 — Subject matter Art. 2 — Scope Art. 3 — Essential and important entities Art. 4 — Sector-specific Union legal acts Art. 5 — Minimum harmonisation Art. 6 — Definitions

Chapter II — COORDINATED CYBERSECURITY FRAMEWORKS

Art. 7 — National cybersecurity strategy Art. 8 — Competent authorities and single points of contact Art. 9 — National cyber crisis management frameworks Art. 10 — Computer security incident response teams (CSIRTs)Art. 11 — Requirements, technical capabilities and tasks of CSIRTs Art. 12 — Coordinated vulnerability disclosure and a European vulnerability database Art. 13 — Cooperation at national level

Chapter III — COOPERATION AT UNION AND INTERNATIONAL LEVEL

Art. 14 — Cooperation Group Art. 15 — CSIRTs network Art. 16 — European cyber crisis liaison organisation network (EU-CyCLONe)Art. 17 — International cooperation Art. 18 — Report on the state of cybersecurity in the Union Art. 19 — Peer reviews

Chapter IV — CYBERSECURITY RISK-MANAGEMENT MEASURES AND REPORTING OBLIGATIONS

Art. 20 — Governance Art. 21 — Cybersecurity risk-management measures Art. 22 — Union level coordinated security risk assessments of critical supply chains Art. 23 — Reporting obligations Art. 24 — Use of European cybersecurity certification schemes Art. 25 — Standardisation

Chapter V — JURISDICTION AND REGISTRATION

Art. 26 — Jurisdiction and territoriality Art. 27 — Registry of entities Art. 28 — Database of domain name registration data

Chapter VI — INFORMATION SHARING

Art. 29 — Cybersecurity information-sharing arrangements Art. 30 — Voluntary notification of relevant information

Chapter VII — SUPERVISION AND ENFORCEMENT

Art. 31 — General aspects concerning supervision and enforcement Art. 32 — Supervisory and enforcement measures in relation to essential entities Art. 33 — Supervisory and enforcement measures in relation to important entities Art. 34 — General conditions for imposing administrative fines on essential and important entities Art. 35 — Infringements entailing a personal data breach Art. 36 — Penalties Art. 37 — Mutual assistance

Chapter VIII — DELEGATED AND IMPLEMENTING ACTS

Art. 38 — Exercise of the delegation Art. 39 — Committee procedure

Chapter IX — FINAL PROVISIONS

Art. 40 — Review Art. 41 — Transposition Art. 42 — Amendment of Regulation (EU) No 910/2014 Art. 43 — Amendment of Directive (EU) 2018/1972 Art. 44 — Repeal Art. 45 — Entry into force Art. 46 — Addressees

Recitals

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144

Annexes

Annex I Annex II Annex III

Lawbster — EU Regulation Library Lawbster is a multilingual library of EU regulations for legal professionals, free to browse without an account — available in English, German, and French, with full regulation texts presented article by article.

Digital Markets Act (DMA)

Cybersecurity Act

Digital Services Act (DSA)

Data Governance Act (DGA)

Product Liability Directive (PLD)

Critical Entities Resilience Directive (CER)

Cyber Resilience Act (CRA)

DMA Implementing Regulation

Imprint · Privacy