NIS2 vs DORA — Side-by-Side Comparison for EU Cybersecurity and Operational Resilience

NIS2 is Directive (EU) 2022/2555. It gives measures for “a high common level of cybersecurity across the Union” (Article 1(1)). NIS2 binds the Member States. Essential and important entities get their duties from the national law that transposes NIS2 (Article 41).

DORA is Regulation (EU) 2022/2554. It gives “uniform requirements” for the digital operational resilience of financial entities (Article 1(1)). DORA applies directly in all Member States (Article 64). It applies to the financial entities of Article 2(1), points (a) to (t), and to ICT third-party service providers (Article 2(1), point (u)).

This page compares the scope, the duties, and the authorities of the two instruments. It also tells you how NIS2 and DORA apply to one financial entity, and how to set them up in Modulos.

Which instrument applies

NIS2 and DORA each have a scope test. Find the item that applies to you:

• Financial entity — DORA applies to the financial entities of DORA Article 2(1), points (a) to (t). Article 2(3) gives exclusions, and Article 2(4) lets Member States exclude some entities. Read DORA first. National law can also identify the financial entity as an essential or important entity (NIS2 Article 3). Then read NIS2 Article 4(1) to find which NIS2 provisions continue to apply. See DORA Article 1(2) and NIS2 Article 4.
• Essential or important entity that is not a financial entity — NIS2 applies through the national law that transposes it. If the entity gives ICT services to financial entities, DORA also applies to it. Then it is an ICT third-party service provider (DORA Article 2(1), point (u)). DORA Article 3(19) defines that provider as “an undertaking providing ICT services”. See the Article 2 scope test.
• ICT third-party service provider — read these provisions:
  • DORA Articles 28 and 29 give duties to the financial entity, for example the register of information. DORA Article 30 gives the key contractual provisions of the contract between the financial entity and the provider.
  • DORA Articles 31 to 44 apply if the ESAs designate the provider as a critical ICT third-party service provider (DORA Articles 3(23) and 31).
  • NIS2 applies to the provider if the provider is an essential or important entity. Examples are a cloud computing service provider and a managed service provider (NIS2 Annex I, points 8 and 9) in the scope of NIS2 Article 2.
• Group with financial entities and other entities — DORA applies to the financial entities of the group. NIS2 applies to a different entity of the group only if that entity is of a type in NIS2 Annex I or II and is in the scope of NIS2 Article 2. A group entity that gives ICT services to the financial entities of the group is an ICT third-party service provider (DORA Article 3(19)). DORA Article 3(20) defines the ICT intra-group service provider. It is an undertaking of a financial group that provides “predominantly ICT services” to financial entities in the same group or in the same institutional protection scheme.

Summary

• NIS2 — a Directive. Article 41(1) gives 17 October 2024 as the date to adopt the national measures. The national measures apply from 18 October 2024. NIS2 applies to essential and important entities of a type in Annex I or II, with the scope test of Articles 2 and 3. See Dates and transposition of NIS2.
• DORA — a Regulation that applies from 17 January 2025 (Article 64). Its scope is the entity types of Article 2(1), with the exclusions of Article 2(3) and (4). See Who DORA applies to.
• Relation — for financial entities that national law identifies as essential or important entities, DORA is a sector-specific Union legal act for NIS2 Article 4 (DORA Article 1(2)). Where the DORA requirements are “at least equivalent in effect”, “the relevant provisions” of NIS2 do not apply to those entities (NIS2 Article 4(1)). For the conditions, see DORA Article 1(2) and NIS2 Article 4.
• Authorities — each Member State designates or establishes the NIS2 competent authorities and CSIRTs (NIS2 Articles 8 and 10). DORA Article 46 gives the DORA competent authority for each type of financial entity.

The two instruments side by side

The next table compares the structure, the reports, and the enforcement of NIS2 and DORA. For the duties on the same topic, see Provisions of NIS2 and DORA on the same topic.

Item	NIS2 (Directive (EU) 2022/2555)	DORA (Regulation (EU) 2022/2554)
Instrument	A Directive, addressed to the Member States (Article 46). Member States adopt national measures and apply them (Article 41(1)).	A Regulation, “binding in its entirety and directly applicable in all Member States” (Article 64).
Scope	Entities of a type in Annex I or II that are medium-sized enterprises or larger, and that “provide their services or carry out their activities within the Union” (Article 2(1)). Article 2(2) to (4) add entities “regardless of their size”. An example is entities that a Member State identifies in Article 2(2), points (b) to (e). NIS2 does not apply to entities that a Member State exempted from DORA in DORA Article 2(4) (Article 2(10)).	The entities of Article 2(1), points (a) to (u). Points (a) to (t) are the financial entities (Article 2(2)), and point (u) is ICT third-party service providers. Article 2(3) gives exclusions. Examples are institutions for occupational retirement provision with pension schemes that together have no more than 15 members in total (point (c)). Other examples are insurance intermediaries that are microenterprises or small or medium-sized enterprises (point (e)). A Member State can exclude some entities (Article 2(4)).
Entity categories and proportionality	Essential entities (Article 3(1)) and important entities (Article 3(2)).	Articles 5 to 15 (the ICT risk management framework) apply to financial entities other than the entities of Article 16(1). The entities of Article 16(1) have the simplified ICT risk management framework (Article 16). Some provisions have their own rules for microenterprises (Article 3(60)), for example Articles 24(1) and 26(1).
Dates	Adopted on 14 December 2022. Entry into force on 16 January 2023 (Article 45). The date for transposition was 17 October 2024. The national measures apply from 18 October 2024 (Article 41(1)).	Adopted on 14 December 2022. Entry into force on 16 January 2023. DORA applies from 17 January 2025 (Article 64).
Incident reports and time limits	The entity sends these reports to the CSIRT or, where applicable, the competent authority (Article 23(4)). Point (a): an early warning, “without undue delay and in any event within 24 hours of becoming aware of the significant incident”. Point (b): an incident notification, “without undue delay and in any event within 72 hours of becoming aware of the significant incident”. Point (c): an intermediate report “upon the request of a CSIRT or, where applicable, the competent authority”. Point (d): a final report “not later than one month after the submission of the incident notification under point (b)”. Point (e): for an incident that continues when the final report is due, “a progress report at that time and a final report within one month of their handling of the incident”. For significant incidents “that have an impact on the provision of its trust services”, a trust service provider sends the incident notification “without undue delay and in any event within 24 hours of becoming aware” of them (Article 23(4), second subparagraph).	The financial entity reports major ICT-related incidents to the relevant competent authority of Article 46 (Article 19(1)). A special reporting procedure applies to credit institutions “classified as significant” in accordance with Regulation (EU) No 1024/2013, Article 6(4). These institutions report to the “relevant national competent authority” designated in accordance with Directive 2013/36/EU, Article 4. That authority immediately sends the report to the ECB (Article 19(1), third subparagraph). The reports are an initial notification, an intermediate report, and a final report (Article 19(4)). Delegated Regulation (EU) 2025/301 gives their time limits (Article 20, point (a)(ii)). See Time limits for the reports.
Content and forms of the reports	The Commission can adopt implementing acts on the type of information, the format, and the procedure of the notifications of Articles 23(1) and 30. These acts can also include the communications of Article 23(2) (Article 23(11), first subparagraph). Implementing Regulation (EU) 2024/2690 gives “the cases in which an incident shall be considered to be significant” for the entities of its Article 1.	Delegated Regulation (EU) 2025/301 gives the content of the reports (Article 20, point (a)). Implementing Regulation (EU) 2025/302 gives “the standard forms, templates and procedures” (Article 20, point (b)).
Information to recipients, clients, and the public	“Where appropriate”, the entity notifies the recipients of its services, “without undue delay”, of significant incidents that are “likely to adversely affect the provision of those services” (Article 23(1)). “Where applicable”, the entity gives “any measures or remedies that those recipients are able to take in response to that threat” “without undue delay” to the recipients that a significant cyber threat can have an effect on (Article 23(2)). “Where appropriate”, it also tells them about the threat. After it consults the entity, the CSIRT or the competent authority can tell the public about the significant incident. It can also tell the entity to do this (Article 23(7)). This applies “where public awareness is necessary to prevent a significant incident or to deal with an ongoing significant incident”, or where disclosure is “otherwise in the public interest”.	A major ICT-related incident can be one that “has an impact on the financial interests of clients”. Then the financial entity tells its clients about the incident and about the measures that it took to decrease the bad effects of the incident. It does this “without undue delay as soon as they become aware of it” (Article 19(3)). For a significant cyber threat, the financial entity tells the clients that “are potentially affected” of “any appropriate protection measures”, where applicable (Article 19(3)). Financial entities have crisis communication plans (Article 14(1)).
Penalties	Member States make sure that, for infringements of Article 21 or 23, essential entities are subject to administrative fines “of a maximum of at least EUR 10 000 000 or of a maximum of at least 2 %” (Article 34(4)). For important entities, the values are EUR 7 000 000 or 1.4% (Article 34(5)). The percentage is of “the total worldwide annual turnover in the preceding financial year of the undertaking” to which the entity belongs. The higher value applies.	Member States make the rules for administrative penalties and remedial measures, which are “effective, proportionate and dissuasive” (Article 50(3)). DORA gives no amounts for these penalties. A Member State is permitted not to make rules for administrative penalties for breaches that have criminal penalties in its national law (Article 52(1)). The Lead Overseer imposes periodic penalty payments on a critical ICT third-party service provider. This applies where the provider does not comply with measures of Article 35(1), points (a) to (c). The decision comes after a minimum of 30 calendar days from the notification of the measures (Article 35(6)). The payment is up to 1% of the average daily worldwide turnover of the provider in the preceding business year (Article 35(8)). It applies each day until compliance, for no more than six months after the notification of the decision (Article 35(7)).
Authorities	Each Member State designates or establishes competent authorities (Article 8(1)), a single point of contact (Article 8(3)), and CSIRTs (Article 10(1)).	Article 46 gives the competent authority for each type of financial entity. For credit institutions, it is the authority “designated in accordance with Article 4” of Directive 2013/36/EU. For “credit institutions classified as significant”, it is the ECB (point (a)). For investment firms, it is the authority “designated in accordance with Article 4 of Directive (EU) 2019/2034” (point (c)). For each critical ICT third-party service provider, the ESAs appoint one ESA as Lead Overseer (Article 31(1)(b)).
Cooperation between Member States	The Cooperation Group (Article 14), the CSIRTs network (Article 15), and EU-CyCLONe (Article 16). “Where appropriate”, the CSIRT, the competent authority, or the single point of contact tells the other affected Member States and ENISA about a significant incident (Article 23(6)).	Articles 19(6) and (7) connect the competent authority, the ESAs, and the ECB. See Incident reports of a financial entity for report routes and checks of relevance to other Member States.

For the fines in NIS2, see Administrative fines and other penalties. Article 34 is in NIS2 Chapter VII. Where NIS2 Article 4(1) applies, NIS2 Chapter VII does not apply to the financial entity.

Provisions of NIS2 and DORA on the same topic

NIS2 and DORA have provisions on the same topics. The next table is the mapping of this page.

Topic	NIS2	DORA	Difference in the texts
Management body	Article 20(1): the management bodies approve the measures of Article 21, oversee their implementation, and “can be held liable”. Article 20(2): the members of the management bodies “follow training”.	Article 5(2): the management body is responsible for the implementation of all arrangements of the ICT risk management framework. It bears “the ultimate responsibility for managing the financial entity’s ICT risk” (point (a)). Article 5(4): members keep sufficient knowledge and skills up to date to “understand and assess ICT risk and its impact” on operations. This includes “specific training on a regular basis, commensurate to the ICT risk being managed”.	DORA Article 5(2), points (b) to (i), give more tasks of the management body.
Risk management	Article 21(1): “appropriate and proportionate technical, operational and organisational measures”. Article 21(2), points (a) to (j): a minimum of ten measures. Implementing Regulation (EU) 2024/2690 gives the technical and methodological requirements for the entities of its Article 1 (Article 21(5)).	Article 6(1): the ICT risk management framework. Articles 7 to 14: its parts. Article 16: the simplified ICT risk management framework. Delegated Regulation (EU) 2024/1774 gives the tools, methods, processes, and policies, and the simplified framework.	DORA gives the parts of the framework in Articles 7 to 14. NIS2 gives the measures in Article 21(2).
Incident handling	Article 21(2), point (b): incident handling.	Article 17: an ICT-related incident management process “to detect, manage and notify ICT-related incidents”.	DORA Article 17(3) gives the parts of that ICT-related incident management process.
Classification of incidents	Article 23(3): an incident is a significant incident if one of these conditions applies. It “has caused or is capable of causing severe operational disruption of the services or financial loss for the entity concerned”. Or it “has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage”.	Article 18(1): six criteria for the classification of ICT-related incidents. Delegated Regulation (EU) 2024/1772 gives the criteria and the materiality thresholds.	NIS2 has a test with two alternatives. DORA has six criteria and materiality thresholds.
Reports	Article 23(4): early warning, incident notification, intermediate report, final report, and progress report.	Article 19(4): initial notification, intermediate report, and final report.	For the time limits and the recipients, see The two instruments side by side.
Suppliers and third parties	Article 21(2), point (d): supply chain security. Article 21(3): “the vulnerabilities specific to each direct supplier and service provider”, and the results of the coordinated security risk assessments of critical supply chains of Article 22(1).	Articles 28 and 29: the duties of the financial entity, with the register of information (Article 28(3)) and ICT concentration risk (Article 29). Article 30: the key contractual provisions. Article 30(5): subcontracting. Delegated Regulations (EU) 2024/1773 and 2025/532 and Implementing Regulation (EU) 2024/2956 give more rules.	DORA Article 30 gives the content of the contract for all financial entities. For the entities of its Article 1, Implementing Regulation (EU) 2024/2690, Annex, point 5.1.4, gives items for their contracts with suppliers, “where appropriate”.
Testing	Article 21(2), point (f): “policies and procedures to assess the effectiveness of cybersecurity risk-management measures”. Implementing Regulation (EU) 2024/2690, Annex, point 6.5: a policy and procedures for security testing, for the entities of its Article 1.	Articles 24 and 25: a “digital operational resilience testing programme” for financial entities other than microenterprises. Articles 26 and 27: threat-led penetration testing (TLPT, Article 3(17)) “at least every 3 years”. This applies to the financial entities that the competent authorities identify, other than the entities of Article 16(1) and microenterprises (Article 26(1) and (8)). The competent authority can change the frequency. Delegated Regulation (EU) 2025/1190 gives more TLPT rules.	NIS2 has no TLPT duty.
Information sharing	Article 29: entities can share cybersecurity information on a voluntary basis in cybersecurity information-sharing arrangements. They notify the competent authorities of their participation (Article 29(4)). Article 30: voluntary notifications to the CSIRTs or the competent authorities.	Article 45: financial entities can share cyber threat information and intelligence in information-sharing arrangements. They notify the competent authorities of their participation (Article 45(3)). Article 19(2): voluntary notification of significant cyber threats.	In NIS2 and in DORA, the sharing is voluntary and the notice of participation is a duty. NIS2 Article 30 relates to DORA Article 19(2), not to DORA Article 45.
Oversight of critical ICT third-party service providers	NIS2 has no such framework. In Article 22(1), the Cooperation Group can do coordinated security risk assessments of critical supply chains.	Articles 31 to 44: the Oversight Framework for critical ICT third-party service providers, with a Lead Overseer for each provider. See Articles 31 to 44.	NIS2 has no equivalent of the Oversight Framework.

DORA Article 1(2) and NIS2 Article 4

DORA Article 1(2) and NIS2 Article 4 tell a financial entity which NIS2 provisions apply to it. DORA Article 1(2) applies to “financial entities identified as essential or important entities pursuant to national rules transposing Article 3 of Directive (EU) 2022/2555”. For those entities, DORA “shall be considered a sector-specific Union legal act for the purposes of Article 4” of NIS2. DORA Article 1(2) only gives DORA this status. NIS2 Article 4 gives the effect:

• NIS2 Article 4(1), first sentence — a sector-specific Union legal act can have requirements for essential or important entities to adopt cybersecurity risk-management measures or to notify significant incidents. Where those requirements are “at least equivalent in effect” to the NIS2 obligations, “the relevant provisions of this Directive, including the provisions on supervision and enforcement laid down in Chapter VII, shall not apply to such entities”.
• NIS2 Article 4(2) — the requirements are equivalent in effect if one of these conditions applies:
  • (a) the cybersecurity risk-management measures are “at least equivalent in effect” to the measures of NIS2 Article 21(1) and (2).
  • (b) the sector-specific Union legal act gives the CSIRTs, the competent authorities, or the single points of contact of NIS2 “immediate access, where appropriate automatic and direct, to the incident notifications”. Also, its requirements to notify significant incidents are “at least equivalent in effect” to NIS2 Article 23(1) to (6).
• NIS2 Article 4(1), second sentence — sector-specific Union legal acts can “not cover all entities in a specific sector”. Then “the relevant provisions” of NIS2 “continue to apply to the entities not covered by those sector-specific Union legal acts”.
• NIS2 recital 28 — the DORA provisions on ICT risk management, the management of ICT-related incidents and the reporting of major ICT-related incidents, digital operational resilience testing, information-sharing arrangements, and ICT third-party risk “should apply instead of those provided for in this Directive”. Recital 28 also tells Member States that they “should therefore not apply” the NIS2 provisions on risk management, reporting, supervision, and enforcement to financial entities in the scope of DORA. A recital helps to interpret the Articles, and it gives no duty.
• NIS2 Article 2(10) — NIS2 does not apply to entities that a Member State exempted from DORA in accordance with DORA Article 2(4).

For a financial entity in NIS2 scope, “the relevant provisions” of NIS2 continue to apply if one of these conditions applies:

• The DORA requirements are not “at least equivalent in effect” to the NIS2 obligations.
• DORA does not apply to the entity.

Where NIS2 Article 4(1) applies, NIS2 Chapter VII (Articles 31 to 37) does not apply to the financial entity. The DORA competent authorities of Article 46 make sure that the entity complies with DORA (DORA Chapter VII, Articles 46 to 56).

A Member State can also tell financial entities to send their DORA incident reports to the NIS2 authorities (DORA Article 19(1)). Read the national law that transposes NIS2 in each Member State where the entity is in scope.

For the full text of the two provisions, see Sector-specific Union legal acts — Article 4 and Article 1(2) — DORA and NIS2.

Incident reports of a financial entity

A financial entity reports major ICT-related incidents in accordance with DORA Article 19. NIS2 Article 4 tells it if NIS2 Article 23 also applies. NIS2 and DORA connect the reports in these ways:

• DORA reports — for the financial entity's reporting routes, stages, time limits, and forms, see The two instruments side by side. A major ICT-related incident has “a high adverse impact on the network and information systems that support critical or important functions of the financial entity” (DORA Article 3(10)). A financial entity can also notify significant cyber threats on a voluntary basis (DORA Article 19(2)).
• DORA time limits on weekends — For financial entities identified as essential or important entities (NIS2 Article 3), the weekend and bank-holiday extension excludes the initial notification and intermediate report (Delegated Regulation (EU) 2025/301, Article 5(5)).
• NIS2 Article 23 — where NIS2 Article 4(1) applies on the condition of Article 4(2)(b), NIS2 Article 23 does not apply to the financial entity. Where Article 23 applies, the entity reports significant incidents to the CSIRT or, where applicable, the competent authority (NIS2 Article 23(4)). For the time limits, see The two instruments side by side.
• Reports to NIS2 authorities — a Member State can tell some or all financial entities to send the initial notification and each report also to the NIS2 competent authorities or CSIRTs. The entities use the templates of DORA Article 20 (DORA Article 19(1), sixth subparagraph). A Member State can also let financial entities send their voluntary notifications of significant cyber threats to the NIS2 CSIRTs (DORA Article 19(2), third subparagraph).
• From the DORA authority to the NIS2 authorities — the DORA competent authority receives the initial notification and each report. Then it gives details of the major ICT-related incident to the NIS2 competent authorities, single points of contact, or CSIRTs, “in a timely manner” (DORA Article 19(6), point (c)). EBA, ESMA, or EIOPA and the ECB then examine if the incident “is relevant for competent authorities in other Member States” (DORA Article 19(7)). They do this in consultation with ENISA and in cooperation with the competent authority.
• “At the request of the CSIRT or the competent authority”, the single point of contact sends Article 23(1) notifications to its counterparts in other affected Member States (NIS2 Article 23(8)).

For the DORA rules on reports to NIS2 authorities, see Reports to NIS2 authorities. For NIS2 Article 23, see Article 23(4) — reports and time limits.

NIS2 and DORA in Modulos

In Modulos, NIS2 and DORA are different Frameworks at each level:

Level	NIS2	DORA	Controls that the two Frameworks share
Organization	OFF-15	OFF-16	47
AI System	MFF-15	MFF-16	40

At Organization level, the 47 shared Controls are 58% of the OFF-15 Controls and 54% of the OFF-16 Controls. At AI System level, the 40 shared Controls are 56% of the MFF-15 Controls and 74% of the MFF-16 Controls.

Do these steps in this sequence:

1. Find if DORA applies to the entity (DORA Article 2).
2. Find if national law identifies the entity as an essential or important entity (NIS2 Article 3).
3. If DORA applies and the entity is an essential or important entity, do the test of NIS2 Article 4.
4. If DORA applies, add OFF-16 to the organization AI System.
5. If NIS2 duties apply to the entity, add OFF-15 to the same AI System.
6. Add MFF-16 to the AI System of each “service or application” that you examine against DORA.
7. If NIS2 duties apply to the entity, add MFF-15 to each AI System that the entity uses for its services.

For the steps of each Framework, see Other Frameworks on the same AI Systems and The two NIS2 Frameworks.

See Control overlap for shared-Control behavior. Follow the Requirement procedure for each Framework.

Where to go next

NIS2

Directive (EU) 2022/2555: scope, dates, structure, and supervision.

DORA

Regulation (EU) 2022/2554: scope, dates, structure, and penalties.

NIS2 cybersecurity measures (Article 21)

The ten categories of cybersecurity risk-management measures in Article 21(2).

DORA ICT risk and resilience operations

DORA Articles 7 to 23: the parts of the ICT risk management framework, incident management, classification, and reports.

DORA testing and third-party risk

DORA Articles 24 to 44: testing, TLPT, ICT third-party risk, the register of information, and the Oversight Framework.

AI governance frameworks compared

Frameworks by legal status and scope.

Frequently asked questions

Answers with links to the full rules.

Sources of this page

• NIS2 — Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022, OJ L 333, 27.12.2022, p. 80 (EUR-Lex). Articles 1 to 10: 1(1), 2(1) to (4) and (10), 3(1) and (2), 4(1) and (2), 8(1) and (3), and 10(1). Articles 14 to 23: 14 to 16, 20 to 22, and 23(1) to (4), (6) to (8), and (11). Articles 29 to 46: 29, 30, 34(4) and (5), 41(1), 45, and 46. Annexes I and II, and recital 28.
• DORA — Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022, OJ L 333, 27.12.2022, p. 1 (EUR-Lex). Articles 1 to 6: 1(1) and (2), 2, 3, points (10), (17), (19), (20), (23), (60), and (61), 5(2) and (4), and 6(1). Articles 14 to 31: 14(1), 16 to 20, 24 to 30, and 31(1). Articles 35 to 64: 35(6) to (8), 45, 46, 50, 52, and 64.
• Delegated Regulation (EU) 2024/1772 of the Commission of 13 March 2024, for the classification of ICT-related incidents and cyber threats and the materiality thresholds (EUR-Lex).
• Delegated Regulation (EU) 2024/1773 of the Commission of 13 March 2024, for the policy on the use of “ICT services supporting critical or important functions” (EUR-Lex).
• Delegated Regulation (EU) 2024/1774 of the Commission of 13 March 2024, for the ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework (EUR-Lex).
• Implementing Regulation (EU) 2024/2956 of the Commission of 29 November 2024, for the standard templates for the register of information (EUR-Lex).
• Delegated Regulation (EU) 2025/301 of the Commission of 23 October 2024, for the content and the time limits of the reports of major ICT-related incidents: Article 5(4) to (6) (EUR-Lex).
• Implementing Regulation (EU) 2025/302 of the Commission of 23 October 2024, for the forms, templates, and procedures of the reports (EUR-Lex).
• Delegated Regulation (EU) 2025/532 of the Commission of 24 March 2025, for subcontracting of ICT services that are necessary for critical or important functions (EUR-Lex).
• Delegated Regulation (EU) 2025/1190 of the Commission of 13 February 2025, for threat-led penetration testing (EUR-Lex).
• Implementing Regulation (EU) 2024/2690 of the Commission of 17 October 2024, OJ L, 2024/2690, 18.10.2024: Article 1, and Annex, points 5.1.4 and 6.5 (EUR-Lex).

Disclaimer

This page gives general information. It is not legal advice.