Docs

Appearance

NIS2 Supervision and Enforcement — Articles 31 to 37 ​

This section gives the powers of the competent authorities and the administrative fines in Chapter VII of NIS2. The obligations of an entity are in the sections for cybersecurity measures and incident reporting.

Chapter VII of NIS2 (Articles 31 to 37) gives the rules on supervision and enforcement. Each Member State “shall designate or establish one or more competent authorities responsible for cybersecurity and for the supervisory tasks referred to in Chapter VII” (Article 8(1)). Member States make sure that their competent authorities “effectively supervise and take the measures necessary to ensure compliance with this Directive” (Article 31(1)). Member States can let competent authorities “prioritise supervisory tasks”, “based on a risk-based approach” (Article 31(2)). Article 3 gives the essential entities and the important entities (Essential and important entities).

Supervision of essential and important entities ​

In NIS2, Article 32 is for the supervision of essential entities, and Article 33 is for the supervision of important entities. In recital 122, essential entities “should be subject to a comprehensive ex ante and ex post supervisory regime”, and important entities to “a light, ex post only, supervisory regime”. Recital 122 adds that important entities “should therefore not be required to systematically document compliance with cybersecurity risk-management measures”. Article 33(1) gives the condition for the supervision of important entities. When competent authorities are “provided with evidence, indication or information that an important entity allegedly does not comply with this Directive”, they “take action, where necessary, through ex post supervisory measures”.

Competent authorities have these minimum supervisory powers (Article 32(2) for essential entities, Article 33(2) for important entities):

  • “on-site inspections and off-site supervision, including random checks conducted by trained professionals” for essential entities, and “on-site inspections and off-site ex post supervision conducted by trained professionals” for important entities
  • security audits by “an independent body or a competent authority”: “regular and targeted” security audits for essential entities, “targeted” security audits for important entities
  • “ad hoc audits”, for essential entities only
  • security scans “based on objective, non-discriminatory, fair and transparent risk assessment criteria, where necessary with the cooperation of the entity concerned”
  • requests for information “necessary to assess the cybersecurity risk-management measures adopted by the entity concerned, including documented cybersecurity policies”, and about compliance with Article 27
  • requests for access to “data, documents and information necessary to carry out their supervisory tasks”
  • requests for “evidence of implementation of cybersecurity policies”.

Articles 32(2) and 33(2) also give these rules for security audits. “The targeted security audits referred to in the first subparagraph, point (b), shall be based on risk assessments conducted by the competent authority or the audited entity, or on other risk-related available information”. “The results of any targeted security audit shall be made available to the competent authority”. “The costs of such targeted security audit carried out by an independent body shall be paid by the audited entity, except in duly substantiated cases when the competent authority decides otherwise”.

For the requests of Article 32(2), points (e) to (g), and of Article 33(2), points (d) to (f), the competent authorities “shall state the purpose of the request and specify the information requested” (Articles 32(3) and 33(3)). These powers are powers of the competent authorities. They are not obligations of entities.

Enforcement powers ​

In NIS2, Article 32(4) gives the minimum enforcement powers for essential entities, and Article 33(4) for important entities. Member States make sure that competent authorities have these powers:

  • to “issue warnings about infringements of this Directive”
  • to “adopt binding instructions”, or to order the entity to “remedy the deficiencies identified or the infringements of this Directive”
  • to order the entity to “cease conduct that infringes this Directive and desist from repeating that conduct”
  • to order the entity to make its cybersecurity risk-management measures “comply with Article 21” or to “fulfil the reporting obligations laid down in Article 23, in a specified manner and within a specified period”
  • to order the entity to tell “the natural or legal persons with regard to which they provide services or carry out activities which are potentially affected by a significant cyber threat” about the cyber threat and about “any possible protective or remedial measures which can be taken by those natural or legal persons in response to that threat”
  • to order the entity to “implement the recommendations provided as a result of a security audit within a reasonable deadline”
  • to order the entity to “make public aspects of infringements of this Directive in a specified manner”
  • to “impose, or request the imposition by the relevant bodies, courts or tribunals, in accordance with national law, of an administrative fine pursuant to Article 34”, together with the other measures.

For essential entities only, competent authorities can also designate a monitoring officer “with well-defined tasks for a determined period of time to oversee the compliance of the entities concerned with Articles 21 and 23” (Article 32(4)(g)).

Article 32(5) gives more powers for essential entities when the enforcement measures of Article 32(4), points (a) to (d) and (f), are “ineffective”. Then the competent authorities can give the entity a time limit in which to “take the necessary action to remedy the deficiencies or to comply with the requirements of those authorities”. If the entity does not do this before the end of the time limit, the competent authorities can:

  • “suspend temporarily, or request a certification or authorisation body, or a court or tribunal, in accordance with national law, to suspend temporarily a certification or authorisation concerning part or all of the relevant services provided or activities carried out by the essential entity”
  • request “that the relevant bodies, courts or tribunals, in accordance with national law, prohibit temporarily any natural person who is responsible for discharging managerial responsibilities at chief executive officer or legal representative level in the essential entity from exercising managerial functions in that entity”.

Article 32(5) gives this limit: “Temporary suspensions or prohibitions imposed pursuant to this paragraph shall be applied only until the entity concerned takes the necessary action to remedy the deficiencies or comply with the requirements of the competent authority for which such enforcement measures were applied”. It also gives this rule: “The imposition of such temporary suspensions or prohibitions shall be subject to appropriate procedural safeguards in accordance with the general principles of Union law and the Charter, including the right to an effective remedy and to a fair trial, the presumption of innocence and the rights of the defence”. The Article 32(5) measures do not apply to public administration entities.

For the enforcement measures of Article 32(4) and (5), the competent authorities “shall comply with the rights of the defence and take account of the circumstances of each individual case” (Article 32(7)). Article 33(5) applies Article 32(7) and (8) to the measures for important entities. The competent authorities “shall set out a detailed reasoning for their enforcement measures” (Article 32(8)). Before they adopt the measures, they “shall notify the entities concerned of their preliminary findings”. They “shall also allow a reasonable time for those entities to submit observations, except in duly substantiated cases where immediate action to prevent or respond to incidents would otherwise be impeded”.

Liability of natural persons ​

NIS2 Article 32(6) is about each natural person “responsible for or acting as a legal representative of an essential entity on the basis of the power to represent it, the authority to take decisions on its behalf or the authority to exercise control of it”. Member States make sure that this person “has the power to ensure its compliance with this Directive”. Member States also make sure “that it is possible to hold such natural persons liable for breach of their duties to ensure compliance with this Directive”. Article 33(5) applies Article 32(6) to (8) to important entities. For public administration entities, Article 32(6) applies “without prejudice to national law as regards the liability of public servants and elected or appointed officials”. This liability is different from the liability of the management bodies for infringements of Article 21 (Article 20(1)).

Administrative fines and other penalties ​

NIS2 Article 34 is about administrative fines on essential and important entities for infringements of the Directive. Member States make sure that these fines are “effective, proportionate and dissuasive, taking into account the circumstances of each individual case” (Article 34(1)). In Article 34(4) and (5), Member States make sure that essential and important entities that infringe Article 21 or 23 “are subject, in accordance with paragraphs 2 and 3 of this Article, to administrative fines”:

  • Essential entities — “of a maximum of at least EUR 10 000 000 or of a maximum of at least 2 % of the total worldwide annual turnover in the preceding financial year of the undertaking to which the essential entity belongs, whichever is higher” (Article 34(4)).
  • Important entities — “of a maximum of at least EUR 7 000 000 or of a maximum of at least 1,4 % of the total worldwide annual turnover in the preceding financial year of the undertaking to which the important entity belongs, whichever is higher” (Article 34(5)).

These values are minimum levels for the maximum fine in national law. A Member State can set a maximum that is more than these values. Administrative fines “shall be imposed in addition to any of the measures referred to in Article 32(4), points (a) to (h), Article 32(5) and Article 33(4), points (a) to (g)” (Article 34(2)). Article 34(3) gives this rule: “When deciding whether to impose an administrative fine and deciding on its amount in each individual case, due regard shall be given, as a minimum, to the elements provided for in Article 32(7).” Examples are “the seriousness of the infringement” and “the duration of the infringement”.

Member States “may provide for the power to impose periodic penalty payments in order to compel an essential or important entity to cease an infringement of this Directive in accordance with a prior decision of the competent authority” (Article 34(6)). Each Member State “may lay down the rules on whether and to what extent administrative fines may be imposed on public administration entities” (Article 34(7)). Article 34(8) applies when “the legal system of a Member State does not provide for administrative fines”. Then that Member State makes sure that “the fine is initiated by the competent authority and imposed by competent national courts or tribunals”. It also makes sure “that those legal remedies are effective and have an equivalent effect to the administrative fines imposed by the competent authorities”.

Article 35 is about NIS2 and the GDPR, Regulation (EU) 2016/679. An infringement of Articles 21 and 23 “can entail a personal data breach, as defined in Article 4, point (12), of Regulation (EU) 2016/679 which is to be notified pursuant to Article 33 of that Regulation”. When competent authorities find such an infringement during supervision or enforcement, they tell the GDPR supervisory authorities “without undue delay” (Article 35(1)). If a GDPR supervisory authority imposes an administrative fine (GDPR Article 58(2)(i)), the competent authority does not impose an Article 34 fine for an infringement “arising from the same conduct”. But the competent authority can impose its enforcement measures (Article 35(2)).

Article 31(3) is also about the GDPR. The competent authorities “shall work in close cooperation with supervisory authorities under Regulation (EU) 2016/679 when addressing incidents resulting in personal data breaches”, “without prejudice to the competence and tasks of the supervisory authorities under that Regulation”.

Article 36 tells Member States to “lay down rules on penalties applicable to infringements of national measures adopted pursuant to this Directive”. Member States notify these rules to the Commission “by 17 January 2025”. Article 37 is about mutual assistance. The competent authorities of the Member States “shall cooperate with and assist each other as necessary” when one or more of these conditions apply:

  • an entity gives services in more than one Member State
  • an entity gives services in one or more Member States, and its network and information systems are in one or more other Member States.

Sources ​

  • NIS2, Directive (EU) 2022/2555 of 14 December 2022, OJ L 333, 27.12.2022, p. 80: Articles 3, 8(1), 20(1), 21, 23, 27, and 31 to 37, and recital 122 (EUR-Lex).
  • GDPR, Regulation (EU) 2016/679: Articles 4(12), 33, and 58(2)(i) (EUR-Lex).

Disclaimer

This page gives general information. It is not legal advice.

In each Member State, the national law that transposes NIS2 gives the competent authorities their powers and sets the maximum fines. Before you make a decision, read the Directive on EUR-Lex and the national law, and get legal advice.