NIS2 cybersecurity measures — Articles 20 and 21

This section is about Articles 20, 21, 22, 24 and 25 of the NIS2 Directive, Directive (EU) 2022/2555. These Articles are in Chapter IV of the Directive. Article 20 gives the obligations of the management bodies. Article 21 gives the cybersecurity risk-management measures. Article 22 is about the coordinated security risk assessments of critical supply chains. Articles 24 and 25 are about certification and standards.

Article 23 of the Directive gives the reporting obligations: see NIS2 Article 23. The NIS2 Directive is “addressed to the Member States” (Article 46). Articles 20 and 21(1) to (4) tell Member States to make sure that entities do something. An entity has the obligation through the national law that transposes the provision. Other obligations of entities are in Articles 3(4), 27 and 28 (Who NIS2 applies to) and in Articles 23 and 29(4).

If “sector-specific Union legal acts require essential or important entities to adopt cybersecurity risk-management measures or to notify significant incidents”, and those requirements are “at least equivalent in effect”, “the relevant provisions of this Directive” do not apply to those entities: see Article 4.

Article 20 — Governance

Article 20(1) of the NIS2 Directive is about the management bodies of essential and important entities:

Member States shall ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken by those entities in order to comply with Article 21, oversee its implementation and can be held liable for infringements by the entities of that Article.

The second subparagraph of Article 20(1) is about the liability rules of national law: Article 20(1) is “without prejudice to national law as regards the liability rules applicable to public institutions, as well as the liability of public servants and elected or appointed officials”.

Article 20(2) tells Member States to make sure that the members of the management bodies “are required to follow training”. Member States also “shall encourage” essential and important entities “to offer similar training to their employees on a regular basis”. The training gives these persons “sufficient knowledge and skills to enable them to identify risks and assess cybersecurity risk-management practices and their impact on the services provided by the entity”.

The liability of the management bodies in Article 20(1) is different from the liability of a natural person in Article 32(6). Article 33(5) applies Article 32(6) to important entities: see Liability of natural persons.

Article 21(1) — “appropriate and proportionate” measures

Article 21(1) of the NIS2 Directive gives the general obligation in its first subparagraph:

Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems which those entities use for their operations or for the provision of their services, and to prevent or minimise the impact of incidents on recipients of their services and on other services.

The second subparagraph of Article 21(1) has two sentences. The first sentence gives this rule: the measures “shall ensure a level of security of network and information systems appropriate to the risks posed”. For this level, the measures take into account these items:

• The state-of-the-art.
• “Where applicable, relevant European and international standards”.
• The cost of implementation.

The second sentence gives the test for “proportionality”:

When assessing the proportionality of those measures, due account shall be taken of the degree of the entity’s exposure to risks, the entity’s size and the likelihood of occurrence of incidents and their severity, including their societal and economic impact.

Article 21(2) — the all-hazards approach and the minimum measures

Article 21(2) of the NIS2 Directive starts as follows:

The measures referred to in paragraph 1 shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following:

The ten points (a) to (j) are a minimum. The sections below give each point. For the relevant entities, the Annex of Implementing Regulation (EU) 2024/2690 gives the technical and methodological requirements of each point: see Article 21(5).

Article 21(2)(a) — policies on risk analysis and information system security

Article 21(2), point (a), of the NIS2 Directive gives one of the minimum measures for essential and important entities:

policies on risk analysis and information system security;

In Article 20(1), the management bodies “approve” the measures. Point (a) does not tell the entity how frequently it examines its policies. For the relevant entities, Annex points 1 and 2 of Implementing Regulation (EU) 2024/2690 give the technical and methodological requirements of point (a). For example, the management bodies examine the policy on the security of network and information systems “at least annually” (point 1.1.2). The entity examines the “risk assessment results and the risk treatment plan at planned intervals and at least annually” (point 2.1.4). ISO/IEC 27001:2022 clauses 5.2 and 6.1 and Annex A control 5.1 are related to point (a).

Article 21(2)(b) — incident handling

Article 21(2), point (b), of the NIS2 Directive gives one of the minimum measures for essential and important entities:

incident handling;

In Article 6(8) of the Directive, incident handling is “any actions and procedures aiming to prevent, detect, analyse, and contain or to respond to and recover from an incident”. The reporting obligations for significant incidents are in Article 23. For their time limits, see the reports of Article 23(4). For the relevant entities, Annex point 3 of Implementing Regulation (EU) 2024/2690 gives the technical and methodological requirements of point (b). These start with the “Incident handling policy” (point 3.1) and end with “Post-incident reviews” (point 3.6). ISO/IEC 27001:2022 Annex A controls 5.24 to 5.28 are related to point (b).

Article 21(2)(c) — business continuity, such as backup management and disaster recovery, and crisis management

Article 21(2), point (c), of the NIS2 Directive gives one of the minimum measures for essential and important entities:

business continuity, such as backup management and disaster recovery, and crisis management;

In point (c), backup management and disaster recovery are examples of business continuity (“such as”). Crisis management is a different item. For the relevant entities, Annex point 4 of Implementing Regulation (EU) 2024/2690 gives the technical and methodological requirements of point (c):

• “Business continuity and disaster recovery plan” (point 4.1).
• “Backup and redundancy management” (point 4.2).
• “Crisis management” (point 4.3).

Annex point 13, “Environmental and physical security”, also refers to point (c). ISO/IEC 27001:2022 clause 8.1 and Annex A controls 5.29 and 5.30 are related to point (c).

Article 21(2)(d) — supply chain security

Article 21(2), point (d), of the NIS2 Directive gives one of the minimum measures for essential and important entities:

supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers;

In point (d), “including” adds the “security-related aspects” of the relations with direct suppliers or service providers to supply chain security. It does not limit point (d) to direct suppliers. Article 21(3) gives the items that entities take into account for point (d): see Article 21(3). For the relevant entities, Annex point 5 of Implementing Regulation (EU) 2024/2690 gives the technical and methodological requirements of point (d). These are a “Supply chain security policy” (point 5.1) and a “Directory of suppliers and service providers” (point 5.2). ISO/IEC 27001:2022 clause 8.1 and Annex A controls 5.19 to 5.23 are related to point (d).

Article 21(2)(e) — security in network and information systems acquisition, development and maintenance

Article 21(2), point (e), of the NIS2 Directive gives one of the minimum measures for essential and important entities:

security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure;

Article 12 of the Directive gives two tools for vulnerabilities:

• Each Member State must designate one of its CSIRTs as a coordinator for coordinated vulnerability disclosure (Article 12(1)).
• ENISA must “develop and maintain” a European vulnerability database (Article 12(2)). With the European vulnerability database, entities can “disclose and register, on a voluntary basis, publicly known vulnerabilities in ICT products or ICT services”.

For the relevant entities, Annex point 6 of Implementing Regulation (EU) 2024/2690 gives the technical and methodological requirements of point (e). These start with “Security in acquisition of ICT services or ICT products” (point 6.1) and end with “Vulnerability handling and disclosure” (point 6.10). In point 6.10.2(e), the relevant entities “lay down a procedure for disclosing vulnerabilities in accordance with the applicable national coordinated vulnerability disclosure policy”. ISO/IEC 27001:2022 clause 8.1 and Annex A controls 8.8 and 8.25 to 8.31 are related to point (e).

Article 21(2)(f) — policies and procedures to assess the effectiveness of cybersecurity risk-management measures

Article 21(2), point (f), of the NIS2 Directive gives one of the minimum measures for essential and important entities:

policies and procedures to assess the effectiveness of cybersecurity risk-management measures;

Point (f) does not tell the entity how frequently it does this work. In Article 20(1), the management bodies approve the measures “in order to comply with Article 21” and “oversee its implementation”. For the relevant entities, Annex point 7 of Implementing Regulation (EU) 2024/2690 gives the technical and methodological requirements of point (f):

• In point 7.2, the relevant entities select these items:
  • The measures that they monitor and measure.
  • The methods for “monitoring, measurement, analysis and evaluation, as applicable”.
  • The time “when the monitoring and measuring is to be performed”, and the persons “responsible for monitoring and measuring the effectiveness of the cybersecurity risk-management measures”.
  • The time “when the results from monitoring and measurement are to be analysed and evaluated”, and “who has to analyse and evaluate these results”.
• In point 7.3, the entity examines the policy and procedures “at planned intervals and when significant incidents or significant changes to operations or risks” occur.

ISO/IEC 27001:2022 clauses 9.1 and 9.2 are related to point (f).

Article 21(2)(g) — basic cyber hygiene practices and cybersecurity training

Article 21(2), point (g), of the NIS2 Directive gives one of the minimum measures for essential and important entities:

basic cyber hygiene practices and cybersecurity training;

Point (g) does not tell the entity who gets the training. It gives no examples of basic cyber hygiene practices. Article 20(2) gives a different training obligation for the members of the management bodies. For the relevant entities, Annex point 8 of Implementing Regulation (EU) 2024/2690 gives the technical and methodological requirements of point (g). These are “Awareness raising and basic cyber hygiene practices” (point 8.1) and “Security training” (point 8.2). ISO/IEC 27001:2022 clauses 7.2 and 7.3 and Annex A control 6.3 are related to point (g).

Article 21(2)(h) — cryptography and encryption

Article 21(2), point (h), of the NIS2 Directive gives one of the minimum measures for essential and important entities:

policies and procedures regarding the use of cryptography and, where appropriate, encryption;

Point (h) is about policies and procedures for cryptography. It is about encryption only “where appropriate”. For the relevant entities, Annex point 9 of Implementing Regulation (EU) 2024/2690 gives the technical and methodological requirements of point (h). For example, point 9.2 is about “the type, strength and quality of the cryptographic measures”, the “cryptographic algorithms”, and the “approach to key management”. ISO/IEC 27001:2022 Annex A control 8.24 is related to point (h).

Article 21(2)(i) — human resources security, access control, and asset management

Article 21(2), point (i), of the NIS2 Directive gives one of the minimum measures for essential and important entities:

human resources security, access control policies and asset management;

Point (i) has three items. For the relevant entities, Annex points 10 (“Human resources security”), 11 (“Access control”) and 12 (“Asset management”) of Implementing Regulation (EU) 2024/2690 apply. Two examples:

• Point 10.2.1 is about the “verification of the background of their employees”, “to the extent feasible” and “if necessary for their role, responsibilities and authorisations”.
• Point 11.2 is about access rights “based on the principles of need-to-know, least privilege and separation of duties”. The relevant entities also “review access rights at planned intervals”.

ISO/IEC 27001:2022 Annex A controls 5.9, 5.15 and 6.1 are related to point (i).

Article 21(2)(j) — multi-factor authentication or continuous authentication, and “secured” communications

Article 21(2), point (j), of the NIS2 Directive gives one of the minimum measures for essential and important entities:

the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate.

Point (j) names three items, and ends with “within the entity, where appropriate”. For the relevant entities, Annex points 11.6 (“Authentication”) and 11.7 (“Multi-factor authentication”) of Implementing Regulation (EU) 2024/2690 apply. ISO/IEC 27001:2022 Annex A controls 5.17 and 8.5 are related to point (j).

Article 21(3) — suppliers and service providers

Article 21(3) of the NIS2 Directive is about the supply chain security measures of Article 21(2), point (d):

Member States shall ensure that, when considering which measures referred to in paragraph 2, point (d), of this Article are appropriate, entities take into account the vulnerabilities specific to each direct supplier and service provider and the overall quality of products and cybersecurity practices of their suppliers and service providers, including their secure development procedures. Member States shall also ensure that, when considering which measures referred to in that point are appropriate, entities are required to take into account the results of the coordinated security risk assessments of critical supply chains carried out in accordance with Article 22(1).

Article 21(3) gives two obligations:

• The first sentence is about the vulnerabilities of each direct supplier and service provider. It is also about “the overall quality of products and cybersecurity practices of their suppliers and service providers, including their secure development procedures”. This item applies to all suppliers and service providers of the entity.
• The second sentence is about the results of the coordinated security risk assessments of critical supply chains of Article 22(1).

In Article 22(1), the Cooperation Group, together with the Commission and ENISA, “may carry out coordinated security risk assessments of specific critical ICT services, ICT systems or ICT products supply chains”. In Article 22(2), the Commission identifies “the specific critical ICT services, ICT systems or ICT products that may be subject to the coordinated security risk assessment referred to in paragraph 1”.

Article 21(4) — corrective measures

Article 21(4) of the NIS2 Directive gives the obligation of an entity that does not comply with the Article 21(2) measures:

Member States shall ensure that an entity that finds that it does not comply with the measures provided for in paragraph 2 takes, without undue delay, all necessary, appropriate and proportionate corrective measures.

The obligation starts when the entity finds that it does not comply with the Article 21(2) measures. The time limit is “without undue delay”. The competent authorities can also order an entity to make sure that its measures comply with Article 21. Article 32(4)(d) gives this enforcement measure for essential entities, and Article 33(4)(d) for important entities: see Enforcement powers.

Article 21(5) — Implementing Regulation (EU) 2024/2690

Article 21(5) of the NIS2 Directive is about implementing acts on the Article 21(2) measures. It has four subparagraphs:

• The first subparagraph tells the Commission to adopt implementing acts by 17 October 2024. These implementing acts give the technical and methodological requirements of the Article 21(2) measures for 11 entity types. Implementing Regulation (EU) 2024/2690 uses the same 11 entity types (see below).
• The second subparagraph lets the Commission adopt such implementing acts, “as well as sectoral requirements, as necessary”, for other essential and important entities.
• In the third subparagraph, when the Commission prepares the implementing acts, it “shall, to the extent possible, follow European and international standards, as well as relevant technical specifications”. It works with the Cooperation Group and ENISA “on the draft implementing acts”.
• In the fourth subparagraph, the “examination procedure” of Article 39(2) applies.

The Commission adopted Commission Implementing Regulation (EU) 2024/2690 on 17 October 2024. It used Article 21(5), first subparagraph, and Article 23(11), second subparagraph, of the Directive for this. The Regulation entered into force on 7 November 2024, “the twentieth day following that of its publication in the Official Journal” (Article 16). The publication was on 18 October 2024. The Regulation is “binding in its entirety and directly applicable in all Member States” (Article 16). Article 15 of the Regulation repeals Implementing Regulation (EU) 2018/151.

Article 1 of the Regulation gives the entity types that are “the relevant entities”. Only these 11 entity types are relevant entities:

• DNS service providers.
• TLD name registries.
• Cloud computing service providers.
• Data center service providers.
• Content delivery network providers.
• Managed service providers.
• Managed security service providers.
• Providers of online marketplaces.
• Providers of online search engines.
• Providers of social networking services platforms.
• Trust service providers.

Recital 1 of the Regulation refers to these entity types “as covered by Article 3” of the Directive, thus to essential or important entities. For the relevant entities, the Regulation has two functions:

• It gives the technical and methodological requirements of the Article 21(2) measures (Article 2 and the Annex).
• It “further specifies the cases in which an incident shall be considered to be significant” for Article 23(3) (Articles 3 to 14). For this part of the Regulation, see Article 23(3).

The Annex of the Regulation gives the technical and methodological requirements of the measures of Article 21(2), points (a) to (j) (Article 2(1)). In the first subparagraph of Article 2(2), the relevant entities “shall ensure a level of security of network and information systems appropriate to the risks posed”. For this, the Regulation tells the relevant entities that “they shall take due account of the degree of their exposure to risks, their size and the likelihood of occurrence of incidents and their severity, including their societal and economic impact”. The second subparagraph of Article 2(2) applies where the Annex gives a condition for a requirement:

Where the Annex to this Regulation provides that a technical or methodological requirement of a cybersecurity risk-management measure shall be applied ‘where appropriate’, ‘where applicable’ or ‘to the extent feasible’, and where a relevant entity considers it not appropriate, not applicable or not feasible for the relevant entity to apply certain such technical and methodological requirements, the relevant entity shall in a comprehensible manner document its reasoning to that effect.

The Annex of the Regulation has 13 points:

Annex point	Name	Article 21(2) point
1	“Policy on the security of network and information systems”	(a)
2	“Risk management policy”	(a)
3	“Incident handling”	(b)
4	“Business continuity and crisis management”	(c)
5	“Supply chain security”	(d)
6	“Security in network and information systems acquisition, development and maintenance”	(e)
7	“Policies and procedures to assess the effectiveness of cybersecurity risk-management measures”	(f)
8	“Basic cyber hygiene practices and security training”	(g)
9	“Cryptography”	(h)
10	“Human resources security”	(i)
11	“Access control”	(i) and (j)
12	“Asset management”	(i)
13	“Environmental and physical security”	(c), (e) and (i)

Implementing Regulation (EU) 2024/2690 does not apply to essential and important entities that are not relevant entities. These entities have the Article 21 obligations through the national law that transposes Article 21. The ENISA “Technical Implementation Guidance” on the Regulation (version 1.0, June 2025) is for the relevant entities. This guidance “is not legally binding and is only of an advisory character”.

The European Commission proposal COM(2026) 13 of 20 January 2026 has a fifth subparagraph for Article 21(5). This subparagraph applies where the Commission adopts the implementing acts of subparagraphs 1 and 2 of Article 21(5). Then, Member States “shall not impose any further technical, methodological or sectoral requirements of the measures referred to in Article 21(2) of Directive (EU) 2022/2555 on the entities in scope of those implementing acts”. As of October 2026, the proposal is not law: see the proposals to amend NIS2.

Articles 24 and 25 — certification and standards

In Articles 24 and 25 of the NIS2 Directive, the Member States, the Commission, and ENISA have powers and obligations on certification and on standards. Article 24(1) and Article 25(1) refer to the Article 21 measures.

Article 24(1) lets Member States “require essential and important entities to use particular ICT products, ICT services and ICT processes”. These ICT products, ICT services and ICT processes are “certified under European cybersecurity certification schemes adopted pursuant to Article 49 of Regulation (EU) 2019/881”. With them, the entity can demonstrate compliance with “particular requirements of Article 21”. They can be “developed by the essential or important entity or procured from third parties”. Member States also “shall encourage” essential and important entities to use qualified trust services.

Article 24(2) lets the Commission adopt delegated acts on “which categories of essential and important entities are to be required to use certain certified ICT products, ICT services and ICT processes or obtain a certificate”. The Commission adopts these delegated acts “where insufficient levels of cybersecurity have been identified”. Each of these delegated acts includes “an implementation period”.

Article 25(1) tells Member States to “encourage the use of European and international standards and technical specifications relevant to the security of network and information systems”. Article 25(1) is “to promote the convergent implementation of Article 21(1) and (2)”. Member States do this “without imposing or discriminating in favour of the use of a particular type of technology”. In Article 25(2), ENISA, together with the Member States, gives “advice and guidelines regarding the technical areas to be considered” and on the standards that are available.

ISO/IEC 27001:2022 is a standard for information security management systems. The NIS2 Directive does not make it necessary. The NIS2 obligations of an entity come from the national law that transposes the Directive and, for relevant entities, from Implementing Regulation (EU) 2024/2690. The competent authorities supervise these obligations (Articles 32 and 33). Thus, a certificate to ISO/IEC 27001 is not sufficient to show compliance with these obligations. For the related clauses and controls of ISO/IEC 27001, see the provisions below.

If the proposal COM(2026) 13 of 20 January 2026 becomes law, it adds Article 24(4) to (6) on a “certificate on the cyber posture”. As of October 2026, this Article 24 change in the proposal is not law: see the proposals to amend NIS2.

Guidance on the Article 21 measures

The NIS Cooperation Group gives a “Reference document on security measures for entities under NIS2” (version 1.0, June 2026) that “is not legally binding”. It is guidance on the Article 21 measures and does not change the obligations in the Directive or in Implementing Regulation (EU) 2024/2690.

Articles 20 and 21 in Modulos

Modulos gives NIS2 as two Frameworks, each with the name NIS2: OFF-15 at the Organization level and MFF-15 at the AI System level. OFF-15 has Requirements for Articles 20 and 21, and MFF-15 has Requirements for Article 21 at the AI System level.

NIS2 does not divide the measures into these two levels: Article 20(1) connects the management bodies to the measures of the entity. For the Requirements and the steps, see Requirements of the NIS2 Frameworks.

Article 21 compared with ISO/IEC 27001, DORA, and the EU AI Act

Below, we compare each Article 21(2) point of the NIS2 Directive with related provisions of ISO/IEC 27001:2022, DORA, and the EU AI Act. Each row gives provisions that are related to the NIS2 point. A row does not show that the provisions are equivalent. Article 1(2) of DORA makes DORA a sector-specific Union legal act for Article 4 of NIS2. This applies to financial entities that are essential or important entities: see Article 4 on the scope section.

NIS2 Article 21(2) point	ISO/IEC 27001:2022	DORA, Regulation (EU) 2022/2554	EU AI Act, Regulation (EU) 2024/1689
(a) policies on risk analysis and information system security	Clauses 5.2 and 6.1, Annex A 5.1	Article 5 “Governance and organisation”, Article 6 “ICT risk management framework”, Delegated Regulation (EU) 2024/1774, Article 3 “ICT risk management”	Article 9 “Risk management system”
(b) incident handling	Annex A 5.24 to 5.28	Article 17 “ICT-related incident management process”	Article 73 “Reporting of serious incidents”
(c) business continuity and crisis management	Clause 8.1, Annex A 5.29 and 5.30	Article 11 “Response and recovery”, Article 12 “Backup policies and procedures, restoration and recovery procedures and methods”	No Article here
(d) supply chain security, with Article 21(3)	Clause 8.1, Annex A 5.19 to 5.23	Articles 28 to 30 on ICT third-party risk	Article 25 “Responsibilities along the AI value chain”
(e) security in network and information systems acquisition, development and maintenance	Clause 8.1, Annex A 8.8 and 8.25 to 8.31	Article 7 “ICT systems, protocols and tools”, Article 8 “Identification”, Article 9 “Protection and prevention”	Article 15 “Accuracy, robustness and cybersecurity”
(f) policies and procedures to assess the effectiveness of cybersecurity risk-management measures	Clauses 9.1 and 9.2	Articles 24 to 27 on digital operational resilience testing	No Article here
(g) basic cyber hygiene practices and cybersecurity training	Clauses 7.2 and 7.3, Annex A 6.3	Article 5(4) on “specific training” for the management body, Article 13(6) on “ICT security awareness programmes”	Article 4 “AI literacy”
(h) cryptography and encryption	Annex A 8.24	Delegated Regulation (EU) 2024/1774, Article 6 “Encryption and cryptographic controls”	No Article here
(i) human resources security, access control policies and asset management	Annex A 5.9, 5.15 and 6.1	Article 8 “Identification”, Article 9(4)(c) on access to “information assets and ICT assets”	No Article here
(j) multi-factor authentication or continuous authentication, and “secured” communications	Annex A 5.17 and 8.5	Article 9(4)(d) on “strong authentication mechanisms”	No Article here

For the two instruments side by side, see “NIS2 vs DORA”.

Where to go next

NIS2 overview

Dates, transposition, structure, and the proposals

Supervision and enforcement (Articles 31 to 37)

Powers of the competent authorities, liability of natural persons, and fines

Scope and applicability

Article 2 scope, essential and important entities, and Article 4

Incident reporting (Article 23)

Significant incidents, the reports and their time limits, and Articles 29 and 30

Operationalizing in Modulos

The two NIS2 Frameworks, the steps, and the Requirements

NIS2 vs DORA

Where each instrument applies to financial entities

Sources

• Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 (NIS 2 Directive), OJ L 333, 27.12.2022, p. 80 (EUR-Lex):
  • Articles 4(1), 6(8), 12(1) and (2), 20 to 25, 39(2), and 46.
  • Articles 32(4), 32(6), 33(4), and 33(5).
• Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024, OJ L, 2024/2690, 18.10.2024 (EUR-Lex): recital 1, Articles 1, 2, 15 and 16, and the Annex.
• NIS Cooperation Group, “Reference document on security measures for entities under NIS2”, version 1.0, June 2026, “not legally binding”: section 1.2 (European Commission).
• ENISA, Technical Implementation Guidance on Commission Implementing Regulation (EU) 2024/2690, version 1.0, June 2025, “not legally binding”, for the relevant entities (ENISA).
• ISO/IEC 27001:2022 (ISO).
• Regulation (EU) 2022/2554 (DORA): Articles 1(2), 5 to 9, 11 to 13, 17, and 24 to 30 (EUR-Lex).
• Commission Delegated Regulation (EU) 2024/1774: Articles 3 and 6 (EUR-Lex).
• Regulation (EU) 2024/1689 (EU AI Act), consolidated version of 27 July 2026: Articles 4, 9, 15, 25, and 73 (EUR-Lex).
• European Commission, proposal COM(2026) 13 of 20 January 2026 for a Directive that changes Directive (EU) 2022/2555: Article 1, points (7) and (9) (EUR-Lex).

Disclaimer

This page gives general information. It is not legal advice.

The obligations of an entity come from the national law that transposes the NIS2 Directive and, for relevant entities, from Implementing Regulation (EU) 2024/2690. Before you make decisions, read the Directive and the Regulation on EUR-Lex and the national law, and get legal advice.