Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive) (Text with EEA relevance)

Type Directive
Publication 2022-12-27
State In force
Department Council of the European Union, European Parliament
Source EUR-Lex
articles 47
Reform history JSON API
Directive (EU) 2016/1148 This Directive
Article 1(1) Article 1(1)
Article 1(2) Article 1(2)
Article 1(3) -
Article 1(4) Article 2(12)
Article 1(5) Article 2(13)
Article 1(6) Article 2(6) and (11)
Article 1(7) Article 4
Article 2 Article 2(14)
Article 3 Article 5
Article 4 Article 6
Article 5 –
Article 6 –
Article 7(1) Article 7(1) and (2)
Article 7(2) Article 7(4)
Article 7(3) Article 7(3)
Article 8(1) to (5) Article 8(1) to (5)
Article 8(6) Article 13(4)
Article 8(7) Article 8(6)
Article 9(1), (2) and (3) Article 10(1), (2) and (3)
Article 9(4) Article 10(9)
Article 9(5) Article 10(10)
Article 10(1), (2) and (3), first subparagraph Article 13(1), (2) and (3)
Article 10(3), second subparagraph Article 23(9)
Article 11(1) Article 14(1) and (2)
Article 11(2) Article 14(3)
Article 11(3) Article 14(4), first subparagraph, points (a) to (q) and (s), and paragraph (7)
Article 11(4) Article 14(4), first subparagraph, point (r), and second subparagraph
Article 11(5) Article 14(8)
Article 12(1) to (5) Article 15(1) to (5)
Article 13 Article 17
Article 14(1) and (2) Article 21(1) to (4)
Article 14(3) Article 23(1)
Article 14(4) Article 23(3)
Article 14(5) Article 23(5), (6) and (8)
Article 14(6) Article 23(7)
Article 14(7) Article 23(11)
Article 15(1) Article 31(1)
Article 15(2), first subparagraph, point (a) Article 32(2), point (e)
Article 15(2), first subparagraph, point (b) Article 32(2), point (g)
Article 15(2), second subparagraph Article 32(3)
Article 15(3) Article 32(4), point (b)
Article 15(4) Article 31(3)
Article 16(1) and (2) Article 21(1) to (4)
Article 16(3) Article 23(1)
Article 16(4) Article 23(3)
Article 16(5) –
Article 16(6) Article 23(6)
Article 16(7) Article 23(7)
Article 16(8) and (9) Article 21(5) and Article 23(11)
Article 16(10) –
Article 16(11) Article 2(1), (2) and (3)
Article 17(1) Article 33(1)
Article 17(2), point (a) Article 32(2), point (e)
Article 17(2), point (b) Article 32(4), point (b)
Article 17(3) Article 37(1), points (a) and (b)
Article 18(1) Article 26(1), point (b), and paragraph (2)
Article 18(2) Article 26(3)
Article 18(3) Article 26(4)
Article 19 Article 25
Article 20 Article 30
Article 21 Article 36
Article 22 Article 39
Article 23 Article 40
Article 24 –
Article 25 Article 41
Article 26 Article 45
Article 27 Article 46
Annex I, point (1) Article 11(1)
Annex I, points (2)(a)(i) to (iv) Article 11(2), points (a) to (d)
Annex I, point (2)(a)(v) Article 11(2), point (f)
Annex I, point (2)(b) Article 11(4)
Annex I, points (2)(c)(i) and (ii) Article 11(5), point (a)
Annex II Annex I
Annex III, points (1) and (2) Annex II, point (6)
Annex III, point (3) Annex I, point (8)

[^E0001]: Directive 2011/93/EU of the European Parliament and of the Council of 13 December 2011 on combating the sexual abuse and sexual exploitation of children and child pornography, and replacing Council Framework Decision 2004/68/JHA (OJ L 335, 17.12.2011, p. 1).

[^E0002]: Directive 2013/40/EU of the European Parliament and of the Council of 12 August 2013 on attacks against information systems and replacing Council Framework Decision 2005/222/JHA (OJ L 218, 14.8.2013, p. 8).

[^E0003]: Regulation (EU) No 1025/2012 of the European Parliament and of the Council of 25 October 2012 on European standardisation, amending Council Directives 89/686/EEC and 93/15/EEC and Directives 94/9/EC, 94/25/EC, 95/16/EC, 97/23/EC, 98/34/EC, 2004/22/EC, 2007/23/EC, 2009/23/EC and 2009/105/EC of the European Parliament and of the Council and repealing Council decision 87/95/EEC and Decision No 1673/2006/EC of the European Parliament and of the Council (OJ L 316, 14.11.2012, p. 12).

[^E0004]: Directive (EU) 2015/1535 of the European Parliament and of the Council of 9 September 2015 laying down a procedure for the provision of information in the field of technical regulations and of rules on Information Society services (OJ L 241, 17.9.2015, p. 1).

[^E0005]: Directive 2005/29/EC of the European Parliament and of the Council of 11 May 2005 concerning unfair business-to-consumer commercial practices in the internal market and amending Council Directive 84/450/EEC, Directives 97/7/EC, 98/27/EC and 2002/65/EC of the European Parliament and of the Council and Regulation (EC) No 2006/2004 of the European Parliament and of the Council (‘Unfair Commercial Practices Directive’) (OJ L 149, 11.6.2005, p. 22).

[^E0006]: Regulation (EU) 2019/1150 of the European Parliament and of the Council of 20 June 2019 on promoting fairness and transparency for business users of online intermediation services (OJ L 186, 11.7.2019, p. 57).

Reading this document does not replace reading the official text published in the Official Journal of the European Union. We assume no responsibility for any inaccuracies arising from the conversion of the original to this format.

This text is published under EUR-Lex's own terms of reuse, not a Legalize or public-domain licence. EUR-Lex
Creative Commons Attribution 4.0 International (CC BY 4.0)
© European Union, https://eur-lex.europa.eu — Source: EUR-Lex (Publications Office of the European Union). Reused under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence. Only EU legislation published in the printed Official Journal of the European Union is deemed authentic; consolidated texts are reproduced here for documentation purposes and have been reformatted to Markdown.