NIS2
Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive)
Official text (opens in a new tab)Draft – legal and case law references not yet verified
In Plain Language
Cybersecurity duties for essential and important organisations in sectors like energy, health, transport and digital infrastructure. AI systems used in these settings fall under their risk-management and incident-reporting duties. As a directive, it applies through national laws.
Key Dates
- Entry into force
- Transposition deadline
Verify Dates and status last checked 29 October 2026. Applies through national transposing laws; transposition status differs by country.
Key Articles for AI
| Art. 20 | Management bodies are accountable for cybersecurity. |
|---|---|
| Art. 21 | Cybersecurity risk-management measures. |
| Art. 23 | Incident reporting obligations. |
Use Cases Citing This Law
Related Sources
No sources linked yet.