# Instrument Metadata
# Output tuned for LLM consumption -- deterministic parse of the
# EUR-Lex source, no LLM involved in generation.

instrument_id: nis2
celex: "32022L2555"
eli: "http://data.europa.eu/eli/dir/2022/2555/oj"
full_title: Network and Information Security Directive (EU) 2022/2555
short_title: NIS2
instrument_type: directive
document_type: directive
normative_weight: binding
jurisdiction: EU
effective_period:
  from: "2023-01-16"
  to: null
dates:
  adopted: "2022-12-14"
  entered_into_force: "2023-01-16"
status: in_force
legal_status: in_force
structure_levels:
  - title
  - chapter
  - article
total_articles: 46
total_recitals: 144
total_annexes: 3
definitions_article: 6
chunk_strategy: by_chapter
chunks:
  - /nis2/chunks/recitals.md
  - /nis2/chunks/nis2_t01_general_provisions.md
  - /nis2/chunks/nis2_t02_coordinated_cybersecurity_frameworks.md
  - /nis2/chunks/nis2_t03_cooperation_at_union_and_international_l.md
  - /nis2/chunks/nis2_t04_cybersecurity_risk_management_measures_a.md
  - /nis2/chunks/nis2_t05_jurisdiction_and_registration.md
  - /nis2/chunks/nis2_t06_information_sharing.md
  - /nis2/chunks/nis2_t07_supervision_and_enforcement.md
  - /nis2/chunks/nis2_t08_delegated_and_implementing_acts.md
  - /nis2/chunks/nis2_t09_final_provisions.md
  - /nis2/chunks/annexes.md
key_dates:
  - date: "2016-04-13"
    type: citation
    article: "38"
    context: "…in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making. 5. As soon as…"
  - date: "2022-12-14"
    type: lifecycle
    context: "Adopted"
  - date: "2023-01-16"
    type: deadline
    article: "3"
    context: "…(g) if the Member State so provides, entities which that Member State identified before 16 January 2023 as operators of essential services in…"
  - date: "2023-01-16"
    type: lifecycle
    context: "Entered into force"
  - date: "2023-07-17"
    type: review
    article: "4"
    context: "…those laid down in Article 23(1) to (6) of this Directive. 3. The Commission shall, by 17 July 2023, provide guidelines clarifying the…"
  - date: "2024-02-01"
    type: review
    article: "14"
    context: "…Group may request from the CSIRTs network a technical report on selected topics. 7. By 1 February 2024 and every two years thereafter, the…"
  - date: "2024-07-17"
    type: review
    article: "16"
    context: "…on the basis of agreed procedural arrangements provided for in Article 15(6). 7. By 17 July 2024 and every 18 months thereafter,…"
  - date: "2024-10-17"
    type: deadline
    article: "21"
    context: "…undue delay, all necessary, appropriate and proportionate corrective measures. 5. By 17 October 2024, the Commission shall adopt…"
  - date: "2024-10-17"
    type: deadline
    article: "23"
    context: "…Article 30 and of a communication submitted pursuant to paragraph 2 of this Article. By 17 October 2024, the Commission shall, with regard to…"
  - date: "2024-10-17"
    type: deadline
    article: "34"
    context: "…the Commission the provisions of the laws which it adopts pursuant to this paragraph by 17 October 2024 and, without delay, any subsequent…"
  - date: "2024-10-17"
    type: deadline
    article: "41"
    context: "1. By 17 October 2024, Member States shall adopt and…"
  - date: "2024-10-18"
    type: application
    article: "41"
    context: "…shall immediately inform the Commission thereof. They shall apply those measures from 18 October 2024. 2. When Member States adopt the…"
  - date: "2024-10-18"
    type: application
    article: "42"
    context: "In Regulation (EU) No 910/2014, Article 19 is deleted with effect from 18 October 2024."
  - date: "2024-10-18"
    type: application
    article: "43"
    context: "In Directive (EU) 2018/1972, Articles 40 and 41 are deleted with effect from 18 October 2024."
  - date: "2024-10-18"
    type: application
    article: "44"
    context: "Directive (EU) 2016/1148 is repealed with effect from 18 October 2024. References to the repealed Directive…"
  - date: "2025-01-17"
    type: deadline
    article: "27"
    context: "…to in paragraph 1 to submit the following information to the competent authorities by 17 January 2025: (a) the name of the entity; (b) the…"
  - date: "2025-01-17"
    type: deadline
    article: "36"
    context: "…provided for shall be effective, proportionate and dissuasive. Member States shall, by 17 January 2025, notify the Commission of those rules…"
  - date: "2025-01-17"
    type: review
    article: "15"
    context: "…application of the provisions of this Article concerning operational cooperation. 4. By 17 January 2025, and every two years thereafter, the…"
  - date: "2025-04-17"
    type: deadline
    article: "3"
    context: "…Member States as important entities pursuant to Article 2(2), points (b) to (e). 3. By 17 April 2025, Member States shall establish a list…"
  - date: "2027-10-17"
    type: review
    article: "40"
    context: "By 17 October 2027 and every 36 months thereafter, the…"

generated_at: "2026-09-08T12:37:03.349Z"

articles:
  - article_number: 1
    article_title: Subject matter
    chunk_file: /nis2/chunks/nis2_t01_general_provisions.md
    path: "Title 1 > Article 1"
    applies_to_entities:
      - member_states
      - competent_authorities
    topics:
      - operational_resilience
      - ict_risk
      - security
    keywords:
      - security
      - RTS
      - reporting
      - cybersecurity
      - incident
      - risk
    contains:
      obligations: false
      prohibitions: false
      permissions: false
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references: []
    external_references:
      - instrument_type: directive
        reference: "2022/2557"
    recitals: []

  - article_number: 2
    article_title: Scope
    chunk_file: /nis2/chunks/nis2_t01_general_provisions.md
    path: "Title 1 > Article 2"
    applies_to_entities:
      - member_states
      - competent_authorities
      - european_commission
    topics:
      - operational_resilience
      - ict_risk
      - data_protection
      - trust_services
    keywords:
      - POS
      - security
      - data
      - privacy
      - cross-border
      - system
      - network
      - RTS
      - ITS
      - risk
      - domain name system
      - trust service
      - trust service provider
      - public administration entity
      - public electronic communications network
      - electronic communications service
      - entity
    contains:
      obligations: true
      prohibitions: true
      permissions: true
      definitions: true
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 21
      - target: Article 3
      - target: Article 27
    external_references:
      - instrument_type: directive
        reference: "2022/2557"
      - instrument_type: regulation
        reference: "2022/2554"
      - instrument_type: regulation
        reference: "2016/679"
      - instrument_type: directive
        reference: "2002/58/EC"
    recitals:
      - 7
      - 16

  - article_number: 3
    article_title: Essential and important entities
    chunk_file: /nis2/chunks/nis2_t01_general_provisions.md
    path: "Title 1 > Article 3"
    applies_to_entities:
      - member_states
      - competent_authorities
      - european_commission
    topics:
      - operational_resilience
      - ict_risk
      - competent_authorities
      - security
      - trust_services
    keywords:
      - POS
      - security
      - network
      - guidelines
      - cybersecurity
      - dns
      - dns service provider
      - trust service
      - trust service provider
      - qualified trust service
      - qualified trust service provider
      - public electronic communications network
      - electronic communications service
      - entity
    contains:
      obligations: true
      prohibitions: false
      permissions: true
      definitions: true
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 2
        paragraph: "2"
      - target: Article 2
        paragraph: "3"
    external_references:
      - instrument_type: directive
        reference: "2022/2557"
      - instrument_type: directive
        reference: "2016/1148"
    recitals: []

  - article_number: 4
    article_title: Sector-specific Union legal acts
    chunk_file: /nis2/chunks/nis2_t01_general_provisions.md
    path: "Title 1 > Article 4"
    applies_to_entities:
      - competent_authorities
      - european_commission
    topics:
      - operational_resilience
      - ict_risk
      - security
    keywords:
      - supervision
      - security
      - access
      - RTS
      - guidelines
      - notification
      - cybersecurity
      - incident
      - risk
    contains:
      obligations: true
      prohibitions: true
      permissions: false
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 21
        paragraph: "1"
      - target: Article 21
        paragraph: "2"
      - target: Article 23
        paragraph: "1"
    external_references: []
    recitals: []

  - article_number: 5
    article_title: Minimum harmonisation
    chunk_file: /nis2/chunks/nis2_t01_general_provisions.md
    path: "Title 1 > Article 5"
    applies_to_entities:
      - member_states
    topics:
      - operational_resilience
      - ict_risk
      - security
    keywords:
      - security
      - cybersecurity
    contains:
      obligations: true
      prohibitions: true
      permissions: false
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references: []
    external_references: []
    recitals:
      - 142

  - article_number: 6
    article_title: Definitions
    chunk_file: /nis2/chunks/nis2_t01_general_provisions.md
    path: "Title 1 > Article 6"
    applies_to_entities:
      - credit_institutions
      - member_states
      - competent_authorities
    topics:
      - operational_resilience
      - ict_risk
      - liability
      - outsourcing
      - security
      - trust_services
    keywords:
      - SCA
      - API
      - supervision
      - POS
      - security
      - data
      - access
      - privacy
      - agent
      - cross-border
      - system
      - network
      - ITS
      - network and information system
      - security of network and information systems
      - cybersecurity
      - national cybersecurity strategy
      - near miss
      - incident
      - large-scale cybersecurity incident
    contains:
      obligations: false
      prohibitions: false
      permissions: true
      definitions: true
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references: []
    external_references:
      - instrument_type: directive
        reference: "2018/1972"
      - instrument_type: regulation
        reference: "2019/881"
      - instrument_type: regulation
        reference: "2019/881"
      - instrument_type: regulation
        reference: "2019/881"
      - instrument_type: regulation
        reference: "2019/881"
      - instrument_type: regulation
        reference: "2019/881"
      - instrument_type: regulation
        reference: "910/2014"
      - instrument_type: regulation
        reference: "910/2014"
      - instrument_type: regulation
        reference: "910/2014"
      - instrument_type: regulation
        reference: "910/2014"
      - instrument_type: directive
        reference: "2018/1972"
      - instrument_type: directive
        reference: "2018/1972"
    recitals:
      - 16
      - 109
      - 121

  - article_number: 7
    article_title: National cybersecurity strategy
    chunk_file: /nis2/chunks/nis2_t02_coordinated_cybersecurity_frameworks.md
    path: "Title 2 > Article 7"
    applies_to_entities:
      - member_states
      - competent_authorities
      - european_commission
    topics:
      - operational_resilience
      - ict_risk
      - security
    keywords:
      - POS
      - security
      - access
      - network
      - RTS
      - notification
      - cybersecurity
      - national cybersecurity strategy
      - incident
      - risk
      - cyber threat
      - ict product
      - ict service
      - vulnerability
    contains:
      obligations: true
      prohibitions: false
      permissions: true
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 12
        paragraph: "1"
    external_references:
      - instrument_type: directive
        reference: "2022/2557"
    recitals: []

  - article_number: 8
    article_title: Competent authorities and single points of contact
    chunk_file: /nis2/chunks/nis2_t02_coordinated_cybersecurity_frameworks.md
    path: "Title 2 > Article 8"
    applies_to_entities:
      - member_states
      - competent_authorities
      - european_commission
    topics:
      - operational_resilience
      - ict_risk
      - security
      - competent_authorities
    keywords:
      - security
      - cross-border
      - ITS
      - cybersecurity
      - entity
    contains:
      obligations: true
      prohibitions: false
      permissions: false
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references: []
    external_references: []
    recitals: []

  - article_number: 9
    article_title: National cyber crisis management frameworks
    chunk_file: /nis2/chunks/nis2_t02_coordinated_cybersecurity_frameworks.md
    path: "Title 2 > Article 9"
    applies_to_entities:
      - member_states
      - competent_authorities
      - european_commission
    topics:
      - operational_resilience
      - ict_risk
      - security
    keywords:
      - SCA
      - POS
      - security
      - network
      - ITS
      - cybersecurity
      - incident
      - large-scale cybersecurity incident
      - entity
    contains:
      obligations: true
      prohibitions: false
      permissions: true
      definitions: true
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references: []
    external_references: []
    recitals:
      - 121

  - article_number: 10
    article_title: Computer security incident response teams (CSIRTs)
    chunk_file: /nis2/chunks/nis2_t02_coordinated_cybersecurity_frameworks.md
    path: "Title 2 > Article 10"
    applies_to_entities:
      - member_states
      - competent_authorities
      - european_commission
    topics:
      - operational_resilience
      - ict_risk
      - security
      - data_protection
    keywords:
      - POS
      - security
      - data
      - network
      - RTS
      - ITS
      - cybersecurity
      - incident
      - incident handling
      - entity
    contains:
      obligations: true
      prohibitions: false
      permissions: true
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 11
        paragraph: "1"
      - target: Article 11
        paragraph: "3"
      - target: Article 29
      - target: Article 19
      - target: Article 12
        paragraph: "1"
    external_references: []
    recitals: []

  - article_number: 11
    article_title: "Requirements, technical capabilities and tasks of CSIRTs"
    chunk_file: /nis2/chunks/nis2_t02_coordinated_cybersecurity_frameworks.md
    path: "Title 2 > Article 11"
    applies_to_entities:
      - member_states
      - competent_authorities
    topics:
      - operational_resilience
      - ict_risk
      - security
      - risk_assessment
    keywords:
      - SCA
      - POS
      - security
      - data
      - access
      - system
      - scheme
      - network
      - RTS
      - network and information system
      - cybersecurity
      - incident
      - risk
      - cyber threat
      - vulnerability
      - standard
      - entity
    contains:
      obligations: true
      prohibitions: true
      permissions: true
      definitions: true
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 12
        paragraph: "1"
      - target: Article 10
        paragraph: "3"
    external_references: []
    recitals: []

  - article_number: 12
    article_title: Coordinated vulnerability disclosure and a European vulnerability database
    chunk_file: /nis2/chunks/nis2_t02_coordinated_cybersecurity_frameworks.md
    path: "Title 2 > Article 12"
    applies_to_entities:
      - member_states
      - competent_authorities
    topics:
      - operational_resilience
      - ict_risk
      - security
    keywords:
      - POS
      - security
      - data
      - access
      - system
      - network
      - RTS
      - ITS
      - reporting
      - network and information system
      - risk
      - ict product
      - ict service
      - vulnerability
    contains:
      obligations: true
      prohibitions: false
      permissions: true
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references: []
    external_references: []
    recitals: []

  - article_number: 13
    article_title: Cooperation at national level
    chunk_file: /nis2/chunks/nis2_t02_coordinated_cybersecurity_frameworks.md
    path: "Title 2 > Article 13"
    applies_to_entities:
      - member_states
      - competent_authorities
    topics:
      - operational_resilience
      - ict_risk
      - security
      - data_protection
    keywords:
      - SEPA
      - POS
      - data
      - RTS
      - reporting
      - notification
      - near miss
      - incident
      - risk
      - cyber threat
    contains:
      obligations: true
      prohibitions: false
      permissions: false
      definitions: true
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 23
      - target: Article 30
    external_references:
      - instrument_type: regulation
        reference: "910/2014"
      - instrument_type: regulation
        reference: "2022/2554"
      - instrument_type: directive
        reference: "2018/1972"
      - instrument_type: directive
        reference: "2022/2557"
    recitals: []

  - article_number: 14
    article_title: Cooperation Group
    chunk_file: /nis2/chunks/nis2_t03_cooperation_at_union_and_international_l.md
    path: "Title 3 > Article 14"
    applies_to_entities:
      - member_states
      - competent_authorities
      - european_commission
    topics:
      - operational_resilience
      - ict_risk
      - security
      - committee_procedure
      - implementing_acts
    keywords:
      - SCA
      - POS
      - security
      - cross-border
      - network
      - RTS
      - ITS
      - cybersecurity
      - near miss
      - incident
      - large-scale cybersecurity incident
      - risk
      - cyber threat
      - vulnerability
      - standard
      - technical specification
      - representative
    contains:
      obligations: true
      prohibitions: false
      permissions: true
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: true
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 7
        paragraph: "2"
      - target: Article 2
        paragraph: "2"
      - target: Article 19
        paragraph: "9"
      - target: Article 22
        paragraph: "1"
      - target: Article 37
      - target: Article 19
        paragraph: "1"
      - target: Article 19
        paragraph: "5"
      - target: Article 19
        paragraph: "6"
      - target: Article 40
      - target: Article 39
        paragraph: "2"
    external_references:
      - instrument_type: regulation
        reference: "2022/2554"
      - instrument_type: directive
        reference: "2022/2557"
    recitals: []

  - article_number: 15
    article_title: CSIRTs network
    chunk_file: /nis2/chunks/nis2_t03_cooperation_at_union_and_international_l.md
    path: "Title 3 > Article 15"
    applies_to_entities:
      - member_states
    topics:
      - operational_resilience
      - ict_risk
      - security
    keywords:
      - SCA
      - transfer
      - POS
      - security
      - cross-border
      - network
      - RTS
      - ITS
      - guidelines
      - cybersecurity
      - near miss
      - incident
      - large-scale cybersecurity incident
      - risk
      - cyber threat
      - representative
    contains:
      obligations: true
      prohibitions: false
      permissions: false
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 10
      - target: Article 12
        paragraph: "1"
      - target: Article 9
        paragraph: "4"
      - target: Article 19
        paragraph: "9"
      - target: Article 40
      - target: Article 19
    external_references: []
    recitals: []

  - article_number: 16
    article_title: European cyber crisis liaison organisation network (EU-CyCLONe)
    chunk_file: /nis2/chunks/nis2_t03_cooperation_at_union_and_international_l.md
    path: "Title 3 > Article 16"
    applies_to_entities:
      - member_states
      - european_commission
    topics:
      - operational_resilience
      - ict_risk
      - security
    keywords:
      - SCA
      - POS
      - security
      - network
      - RTS
      - ITS
      - cybersecurity
      - incident
      - large-scale cybersecurity incident
      - representative
    contains:
      obligations: true
      prohibitions: false
      permissions: true
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 9
        paragraph: "4"
      - target: Article 15
        paragraph: "6"
    external_references: []
    recitals: []

  - article_number: 17
    article_title: International cooperation
    chunk_file: /nis2/chunks/nis2_t03_cooperation_at_union_and_international_l.md
    path: "Title 3 > Article 17"
    applies_to_entities: []
    topics:
      - operational_resilience
      - ict_risk
      - data_protection
    keywords:
      - data
      - network
      - RTS
    contains:
      obligations: true
      prohibitions: false
      permissions: true
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references: []
    external_references: []
    recitals: []

  - article_number: 18
    article_title: Report on the state of cybersecurity in the Union
    chunk_file: /nis2/chunks/nis2_t03_cooperation_at_union_and_international_l.md
    path: "Title 3 > Article 18"
    applies_to_entities:
      - member_states
      - european_commission
    topics:
      - operational_resilience
      - ict_risk
      - security
      - risk_assessment
    keywords:
      - SCA
      - security
      - data
      - network
      - RTS
      - cybersecurity
      - incident
      - risk
      - cyber threat
    contains:
      obligations: true
      prohibitions: false
      permissions: false
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 19
    external_references:
      - instrument_type: regulation
        reference: "2019/881"
    recitals: []

  - article_number: 19
    article_title: Peer reviews
    chunk_file: /nis2/chunks/nis2_t03_cooperation_at_union_and_international_l.md
    path: "Title 3 > Article 19"
    applies_to_entities:
      - member_states
      - competent_authorities
      - european_commission
    topics:
      - operational_resilience
      - ict_risk
      - security
      - conflicts_of_interest
    keywords:
      - POS
      - security
      - cross-border
      - network
      - RTS
      - ITS
      - reporting
      - cybersecurity
      - risk
    contains:
      obligations: true
      prohibitions: true
      permissions: true
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 21
      - target: Article 23
      - target: Article 37
      - target: Article 29
    external_references: []
    recitals: []

  - article_number: 20
    article_title: Governance
    chunk_file: /nis2/chunks/nis2_t04_cybersecurity_risk_management_measures_a.md
    path: "Title 4 > Article 20"
    applies_to_entities:
      - member_states
    topics:
      - operational_resilience
      - ict_risk
      - security
      - liability
      - enforcement
    keywords:
      - liability
      - security
      - ITS
      - cybersecurity
      - risk
      - entity
    contains:
      obligations: true
      prohibitions: false
      permissions: false
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 21
    external_references: []
    recitals: []

  - article_number: 21
    article_title: Cybersecurity risk-management measures
    chunk_file: /nis2/chunks/nis2_t04_cybersecurity_risk_management_measures_a.md
    path: "Title 4 > Article 21"
    applies_to_entities:
      - member_states
      - european_commission
    topics:
      - operational_resilience
      - ict_risk
      - security
      - trust_services
      - committee_procedure
      - implementing_acts
    keywords:
      - authentication
      - POS
      - security
      - data
      - access
      - system
      - network
      - ITS
      - network and information system
      - security of network and information systems
      - cybersecurity
      - incident
      - incident handling
      - risk
      - vulnerability
      - standard
      - technical specification
      - dns
      - dns service provider
      - trust service
    contains:
      obligations: true
      prohibitions: false
      permissions: true
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: true
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 22
        paragraph: "1"
      - target: Article 14
        paragraph: "4"
      - target: Article 39
        paragraph: "2"
    external_references: []
    recitals: []

  - article_number: 22
    article_title: Union level coordinated security risk assessments of critical supply chains
    chunk_file: /nis2/chunks/nis2_t04_cybersecurity_risk_management_measures_a.md
    path: "Title 4 > Article 22"
    applies_to_entities:
      - european_commission
    topics:
      - operational_resilience
      - ict_risk
      - security
      - risk_assessment
    keywords:
      - security
      - system
      - risk
      - ict product
      - ict service
    contains:
      obligations: true
      prohibitions: false
      permissions: true
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references: []
    external_references: []
    recitals: []

  - article_number: 23
    article_title: Reporting obligations
    chunk_file: /nis2/chunks/nis2_t04_cybersecurity_risk_management_measures_a.md
    path: "Title 4 > Article 23"
    applies_to_entities:
      - member_states
      - competent_authorities
      - european_commission
    topics:
      - operational_resilience
      - ict_risk
      - security
      - liability
      - competent_authorities
      - trust_services
      - committee_procedure
      - implementing_acts
    keywords:
      - liability
      - POS
      - security
      - data
      - cross-border
      - network
      - RTS
      - ITS
      - reporting
      - notification
      - near miss
      - incident
      - cyber threat
      - significant cyber threat
      - dns
      - dns service provider
      - trust service
      - trust service provider
      - online marketplace
      - online search engine
    contains:
      obligations: true
      prohibitions: true
      permissions: true
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: true
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 30
      - target: Article 14
        paragraph: "4"
      - target: Article 39
        paragraph: "2"
    external_references:
      - instrument_type: directive
        reference: "2022/2557"
    recitals: []

  - article_number: 24
    article_title: Use of European cybersecurity certification schemes
    chunk_file: /nis2/chunks/nis2_t04_cybersecurity_risk_management_measures_a.md
    path: "Title 4 > Article 24"
    applies_to_entities:
      - member_states
      - european_commission
    topics:
      - operational_resilience
      - ict_risk
      - security
    keywords:
      - POS
      - security
      - scheme
      - cybersecurity
      - ict product
      - ict service
      - ict process
      - trust service
      - qualified trust service
      - entity
    contains:
      obligations: true
      prohibitions: false
      permissions: true
      definitions: false
      penalties: false
      delegated_powers: true
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 21
      - target: Article 38
    external_references:
      - instrument_type: regulation
        reference: "2019/881"
      - instrument_type: regulation
        reference: "2019/881"
      - instrument_type: regulation
        reference: "2019/881"
    recitals:
      - 93

  - article_number: 25
    article_title: Standardisation
    chunk_file: /nis2/chunks/nis2_t04_cybersecurity_risk_management_measures_a.md
    path: "Title 4 > Article 25"
    applies_to_entities:
      - member_states
    topics:
      - operational_resilience
      - ict_risk
      - security
    keywords:
      - POS
      - security
      - system
      - network
      - guidelines
      - network and information system
      - security of network and information systems
      - standard
      - technical specification
    contains:
      obligations: true
      prohibitions: false
      permissions: false
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 21
        paragraph: "1"
      - target: Article 21
        paragraph: "2"
    external_references: []
    recitals: []

  - article_number: 26
    article_title: Jurisdiction and territoriality
    chunk_file: /nis2/chunks/nis2_t05_jurisdiction_and_registration.md
    path: "Title 5 > Article 26"
    applies_to_entities:
      - member_states
    topics:
      - operational_resilience
      - ict_risk
      - enforcement
      - security
    keywords:
      - POS
      - security
      - data
      - system
      - network
      - ITS
      - network and information system
      - cybersecurity
      - risk
      - dns
      - dns service provider
      - online marketplace
      - online search engine
      - cloud computing service
      - data centre service
      - content delivery network
      - social networking services platform
      - representative
      - public electronic communications network
      - electronic communications service
    contains:
      obligations: true
      prohibitions: false
      permissions: true
      definitions: true
      penalties: true
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references: []
    external_references: []
    recitals: []

  - article_number: 27
    article_title: Registry of entities
    chunk_file: /nis2/chunks/nis2_t05_jurisdiction_and_registration.md
    path: "Title 5 > Article 27"
    applies_to_entities:
      - member_states
      - competent_authorities
    topics:
      - operational_resilience
      - ict_risk
    keywords:
      - security
      - data
      - access
      - network
      - ITS
      - dns
      - dns service provider
      - online marketplace
      - online search engine
      - cloud computing service
      - data centre service
      - content delivery network
      - social networking services platform
      - representative
      - entity
      - managed service provider
      - managed security service provider
    contains:
      obligations: true
      prohibitions: false
      permissions: false
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 26
        paragraph: "3"
      - target: Article 3
        paragraph: "4"
    external_references: []
    recitals: []

  - article_number: 28
    article_title: Database of domain name registration data
    chunk_file: /nis2/chunks/nis2_t05_jurisdiction_and_registration.md
    path: "Title 5 > Article 28"
    applies_to_entities:
      - member_states
    topics:
      - operational_resilience
      - ict_risk
      - data_protection
    keywords:
      - POS
      - security
      - data
      - access
      - dns
    contains:
      obligations: true
      prohibitions: true
      permissions: false
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references: []
    external_references: []
    recitals: []

  - article_number: 29
    article_title: Cybersecurity information-sharing arrangements
    chunk_file: /nis2/chunks/nis2_t06_information_sharing.md
    path: "Title 6 > Article 29"
    applies_to_entities:
      - member_states
      - competent_authorities
    topics:
      - operational_resilience
      - ict_risk
      - security
    keywords:
      - POS
      - security
      - RTS
      - cybersecurity
      - near miss
      - incident
      - cyber threat
      - vulnerability
    contains:
      obligations: true
      prohibitions: false
      permissions: true
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 7
        paragraph: "2"
    external_references: []
    recitals: []

  - article_number: 30
    article_title: Voluntary notification of relevant information
    chunk_file: /nis2/chunks/nis2_t06_information_sharing.md
    path: "Title 6 > Article 30"
    applies_to_entities:
      - member_states
      - competent_authorities
    topics:
      - operational_resilience
      - ict_risk
      - competent_authorities
    keywords:
      - POS
      - RTS
      - reporting
      - notification
      - near miss
      - incident
      - cyber threat
      - entity
    contains:
      obligations: true
      prohibitions: true
      permissions: true
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 23
    external_references: []
    recitals: []

  - article_number: 31
    article_title: General aspects concerning supervision and enforcement
    chunk_file: /nis2/chunks/nis2_t07_supervision_and_enforcement.md
    path: "Title 7 > Article 31"
    applies_to_entities:
      - member_states
      - competent_authorities
    topics:
      - operational_resilience
      - ict_risk
      - supervision
      - data_protection
      - competent_authorities
      - enforcement
      - risk_assessment
    keywords:
      - supervision
      - POS
      - data
      - incident
      - risk
    contains:
      obligations: true
      prohibitions: false
      permissions: true
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 32
      - target: Article 33
    external_references:
      - instrument_type: regulation
        reference: "2016/679"
    recitals: []

  - article_number: 32
    article_title: Supervisory and enforcement measures in relation to essential entities
    chunk_file: /nis2/chunks/nis2_t07_supervision_and_enforcement.md
    path: "Title 7 > Article 32"
    applies_to_entities:
      - member_states
      - competent_authorities
      - ict_third_party_providers
    topics:
      - operational_resilience
      - ict_risk
      - supervision
      - authorisation
      - liability
      - competent_authorities
      - enforcement
      - security
      - risk_assessment
    keywords:
      - SCA
      - liability
      - authorisation
      - supervision
      - POS
      - security
      - data
      - access
      - RTS
      - ITS
      - reporting
      - cybersecurity
      - incident
      - risk
      - cyber threat
      - significant cyber threat
      - representative
      - entity
    contains:
      obligations: true
      prohibitions: true
      permissions: true
      definitions: false
      penalties: true
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 27
      - target: Article 21
      - target: Article 23
      - target: Article 34
    external_references:
      - instrument_type: directive
        reference: "2022/2557"
      - instrument_type: regulation
        reference: "2022/2554"
      - instrument_type: regulation
        reference: "2022/2554"
    recitals: []

  - article_number: 33
    article_title: Supervisory and enforcement measures in relation to important entities
    chunk_file: /nis2/chunks/nis2_t07_supervision_and_enforcement.md
    path: "Title 7 > Article 33"
    applies_to_entities:
      - member_states
      - competent_authorities
      - ict_third_party_providers
    topics:
      - operational_resilience
      - ict_risk
      - supervision
      - competent_authorities
      - enforcement
      - security
      - risk_assessment
    keywords:
      - SCA
      - supervision
      - POS
      - security
      - data
      - access
      - RTS
      - ITS
      - reporting
      - cybersecurity
      - risk
      - cyber threat
      - significant cyber threat
      - entity
    contains:
      obligations: true
      prohibitions: false
      permissions: false
      definitions: false
      penalties: true
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 21
      - target: Article 23
      - target: Article 27
      - target: Article 34
      - target: Article 32
        paragraph: "6"
      - target: Article 32
        paragraph: "7"
      - target: Article 32
        paragraph: "8"
    external_references:
      - instrument_type: regulation
        reference: "2022/2554"
      - instrument_type: regulation
        reference: "2022/2554"
    recitals:
      - 140

  - article_number: 34
    article_title: General conditions for imposing administrative fines on essential and important entities
    chunk_file: /nis2/chunks/nis2_t07_supervision_and_enforcement.md
    path: "Title 7 > Article 34"
    applies_to_entities:
      - member_states
      - competent_authorities
      - european_commission
    topics:
      - operational_resilience
      - ict_risk
      - supervision
      - competent_authorities
      - enforcement
    keywords:
      - penalty
      - POS
      - system
      - RTS
      - ITS
      - entity
    contains:
      obligations: true
      prohibitions: false
      permissions: true
      definitions: false
      penalties: true
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 32
        paragraph: "4"
      - target: Article 32
        paragraph: "5"
      - target: Article 33
        paragraph: "4"
      - target: Article 32
        paragraph: "7"
      - target: Article 21
      - target: Article 32
      - target: Article 33
    external_references: []
    recitals: []

  - article_number: 35
    article_title: Infringements entailing a personal data breach
    chunk_file: /nis2/chunks/nis2_t07_supervision_and_enforcement.md
    path: "Title 7 > Article 35"
    applies_to_entities:
      - member_states
      - competent_authorities
    topics:
      - operational_resilience
      - ict_risk
      - supervision
      - data_protection
      - competent_authorities
      - enforcement
    keywords:
      - supervision
      - POS
      - data
      - ITS
      - entity
    contains:
      obligations: true
      prohibitions: true
      permissions: true
      definitions: false
      penalties: true
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 21
      - target: Article 23
      - target: Article 34
      - target: Article 32
        paragraph: "4"
      - target: Article 32
        paragraph: "5"
      - target: Article 33
        paragraph: "4"
    external_references:
      - instrument_type: regulation
        reference: "2016/679"
      - instrument_type: regulation
        reference: "2016/679"
      - instrument_type: regulation
        reference: "2016/679"
      - instrument_type: regulation
        reference: "2016/679"
    recitals: []

  - article_number: 36
    article_title: Penalties
    chunk_file: /nis2/chunks/nis2_t07_supervision_and_enforcement.md
    path: "Title 7 > Article 36"
    applies_to_entities:
      - member_states
      - european_commission
    topics:
      - operational_resilience
      - ict_risk
      - supervision
      - enforcement
    keywords: []
    contains:
      obligations: true
      prohibitions: false
      permissions: false
      definitions: false
      penalties: true
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references: []
    external_references: []
    recitals: []

  - article_number: 37
    article_title: Mutual assistance
    chunk_file: /nis2/chunks/nis2_t07_supervision_and_enforcement.md
    path: "Title 7 > Article 37"
    applies_to_entities:
      - member_states
      - competent_authorities
      - european_commission
    topics:
      - operational_resilience
      - ict_risk
      - supervision
      - competent_authorities
    keywords:
      - supervision
      - security
      - system
      - network
      - ITS
      - network and information system
      - entity
    contains:
      obligations: true
      prohibitions: true
      permissions: true
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references: []
    external_references: []
    recitals: []

  - article_number: 38
    article_title: Exercise of the delegation
    chunk_file: /nis2/chunks/nis2_t08_delegated_and_implementing_acts.md
    path: "Title 8 > Article 38"
    applies_to_entities:
      - member_states
      - european_commission
    topics:
      - operational_resilience
      - ict_risk
      - delegated_acts
    keywords:
      - RTS
      - notification
    contains:
      obligations: true
      prohibitions: true
      permissions: true
      definitions: false
      penalties: false
      delegated_powers: true
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 24
        paragraph: "2"
    external_references: []
    recitals: []

  - article_number: 39
    article_title: Committee procedure
    chunk_file: /nis2/chunks/nis2_t08_delegated_and_implementing_acts.md
    path: "Title 8 > Article 39"
    applies_to_entities: []
    topics:
      - operational_resilience
      - ict_risk
      - delegated_acts
      - committee_procedure
    keywords: []
    contains:
      obligations: true
      prohibitions: false
      permissions: false
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references: []
    external_references: []
    recitals: []

  - article_number: 40
    article_title: Review
    chunk_file: /nis2/chunks/nis2_t09_final_provisions.md
    path: "Title 9 > Article 40"
    applies_to_entities:
      - european_commission
    topics:
      - operational_resilience
      - ict_risk
      - final_provisions
      - security
    keywords:
      - POS
      - security
      - network
      - RTS
      - cybersecurity
      - entity
    contains:
      obligations: true
      prohibitions: false
      permissions: false
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references: []
    external_references: []
    recitals: []

  - article_number: 41
    article_title: Transposition
    chunk_file: /nis2/chunks/nis2_t09_final_provisions.md
    path: "Title 9 > Article 41"
    applies_to_entities:
      - member_states
      - european_commission
    topics:
      - operational_resilience
      - ict_risk
      - final_provisions
    keywords:
      - POS
    contains:
      obligations: true
      prohibitions: false
      permissions: false
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references: []
    external_references: []
    recitals: []

  - article_number: 42
    article_title: Amendment of Regulation (EU) No 910/2014
    chunk_file: /nis2/chunks/nis2_t09_final_provisions.md
    path: "Title 9 > Article 42"
    applies_to_entities: []
    topics:
      - operational_resilience
      - ict_risk
      - final_provisions
    keywords: []
    contains:
      obligations: false
      prohibitions: false
      permissions: false
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 19
    external_references:
      - instrument_type: regulation
        reference: "910/2014"
    recitals:
      - 144

  - article_number: 43
    article_title: Amendment of Directive (EU) 2018/1972
    chunk_file: /nis2/chunks/nis2_t09_final_provisions.md
    path: "Title 9 > Article 43"
    applies_to_entities: []
    topics:
      - operational_resilience
      - ict_risk
      - final_provisions
    keywords: []
    contains:
      obligations: false
      prohibitions: false
      permissions: false
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references:
      - target: Article 40
      - target: Article 41
    external_references:
      - instrument_type: directive
        reference: "2018/1972"
    recitals: []

  - article_number: 44
    article_title: Repeal
    chunk_file: /nis2/chunks/nis2_t09_final_provisions.md
    path: "Title 9 > Article 44"
    applies_to_entities: []
    topics:
      - operational_resilience
      - ict_risk
      - final_provisions
    keywords: []
    contains:
      obligations: true
      prohibitions: false
      permissions: false
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references: []
    external_references:
      - instrument_type: directive
        reference: "2016/1148"
    recitals: []

  - article_number: 45
    article_title: Entry into force
    chunk_file: /nis2/chunks/nis2_t09_final_provisions.md
    path: "Title 9 > Article 45"
    applies_to_entities: []
    topics:
      - operational_resilience
      - ict_risk
      - final_provisions
    keywords:
      - ITS
    contains:
      obligations: true
      prohibitions: false
      permissions: false
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: true
    internal_references: []
    external_references: []
    recitals: []

  - article_number: 46
    article_title: Addressees
    chunk_file: /nis2/chunks/nis2_t09_final_provisions.md
    path: "Title 9 > Article 46"
    applies_to_entities:
      - member_states
    topics:
      - operational_resilience
      - ict_risk
      - final_provisions
    keywords: []
    contains:
      obligations: false
      prohibitions: false
      permissions: false
      definitions: false
      penalties: false
      delegated_powers: false
      implementing_powers: false
      rts_mandate: false
      its_mandate: false
      transitional: false
    internal_references: []
    external_references: []
    recitals: []