Applies from milestone
Adoption of the Directive by the European Parliament and the Council.
Entry into force on the twentieth day following publication in the Official Journal of 27 December 2022.
Deadline for Member States to adopt and publish the national transposing measures.
Deadline for the Commission to adopt the implementing acts laying down the technical and methodological requirements for the risk-management measures. The implementing act has been adopted — Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024 (OJ L, 2024/2690, 18.10.2024). It lays down the technical and methodological requirements for the providers listed in the first subparagraph of Article 21(5) and, under the second subparagraph of Article 23(11), also specifies when an incident is to be considered significant for those providers.
From this date the Member States apply the transposing provisions and the obligations bind the entities.
Repeal of the predecessor Directive (EU) 2016/1148 (NIS 1).
Deadline for the digital service providers listed in Article 27(1) to submit their registration data to the competent authority.
Deadline for Member States to establish the list of essential and important entities; reviewed at least every two years thereafter.
First Commission review of the application of the Directive, every 36 months thereafter.
Expires at milestone
Adoption of the Directive by the European Parliament and the Council.
Entry into force on the twentieth day following publication in the Official Journal of 27 December 2022.
Deadline for Member States to adopt and publish the national transposing measures.
Deadline for the Commission to adopt the implementing acts laying down the technical and methodological requirements for the risk-management measures. The implementing act has been adopted — Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024 (OJ L, 2024/2690, 18.10.2024). It lays down the technical and methodological requirements for the providers listed in the first subparagraph of Article 21(5) and, under the second subparagraph of Article 23(11), also specifies when an incident is to be considered significant for those providers.
From this date the Member States apply the transposing provisions and the obligations bind the entities.
Repeal of the predecessor Directive (EU) 2016/1148 (NIS 1).
Deadline for the digital service providers listed in Article 27(1) to submit their registration data to the competent authority.
Deadline for Member States to establish the list of essential and important entities; reviewed at least every two years thereafter.
First Commission review of the application of the Directive, every 36 months thereafter.
Emtract Ingest