{"release":{"id":"c89ff15ec1240a456b40735def079beeda55a0c372be7f3da154287997367ecf","published":"2026-11-02T04:02:35Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2022-12-27","gaps":[],"covered":["NIS2 L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"c89ff15ec1240a456b40735def079beeda55a0c372be7f3da154287997367ecf","release_published":"2026-11-02T04:02:35Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/nis2/articles/1","url":"https://www.headlesslaw.com/nis2/articles/1","title":"Article 1 — Subject matter","family":"l1_generated","work_id":"nis2","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"Consolidated version of 27 December 2022","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227","valid_from":"2022-12-27","valid_until":null,"revision":1,"content_id":"7822700dd9718b7e","change_date":null,"nearest_versions":["2022-12-27"],"first_text_date":"2022-12-14","correction_applies":false,"versions":["2022-12-27"],"version_url":"https://www.headlesslaw.com/nis2/articles/1/versions/2022-12-27","revision_url":"https://www.headlesslaw.com/nis2/articles/1/versions/2022-12-27/rev/7822700dd9718b7e","versions_url":"https://www.headlesslaw.com/nis2/articles/1/versions","relations_url":"https://www.headlesslaw.com/nis2/articles/1/relations","source_line":null,"attribution":null},"provenance":{"official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/nis2/articles/1.md","body_sha256":"79d99ff9aab097c4bc4752b5e6435471c7dab1ea827c36b54a4f8e1519afef2d"},"units":[{"locator":"nis2/art/1","kind":"article","status":"in_force","label":null,"heading":"Subject matter","text":"","marks":[],"revision":1,"text_hash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","reason":null},{"locator":"nis2/art/1/para/1","kind":"paragraph","status":"in_force","label":"1.","heading":null,"text":"This Directive lays down measures that aim to achieve a high common level of cybersecurity across the Union, with a view to improving the functioning of the internal market.","marks":[],"revision":1,"text_hash":"ab9299002d799da83137bce14684ed36ee40ceae7cf73b780fafa7b77b035293","reason":null},{"locator":"nis2/art/1/para/2","kind":"paragraph","status":"in_force","label":"2.","heading":null,"text":"To that end, this Directive lays down:","marks":[],"revision":1,"text_hash":"fea3992cea615b5742fd764dadab59f77af871a55598c6e85a0e3cd802ab2164","reason":null},{"locator":"nis2/art/1/para/2/pt/a","kind":"point","status":"in_force","label":"(a)","heading":null,"text":"obligations that require Member States to adopt national cybersecurity strategies and to designate or establish competent authorities, cyber crisis management authorities, single points of contact on cybersecurity (single points of contact) and computer security incident response teams (CSIRTs);","marks":[],"revision":1,"text_hash":"8bc0569e53d30309183042a9095029c7101d8b49b42d396e714b8c6bf251bcf0","reason":null},{"locator":"nis2/art/1/para/2/pt/b","kind":"point","status":"in_force","label":"(b)","heading":null,"text":"cybersecurity risk-management measures and reporting obligations for entities of a type referred to in Annex I or II as well as for entities identified as critical entities under Directive (EU) 2022/2557;","marks":[],"revision":1,"text_hash":"9a8eba62d4c03af83ab074e2b37a59b26342e59f9fd293d01016a2c563685bb9","reason":null},{"locator":"nis2/art/1/para/2/pt/c","kind":"point","status":"in_force","label":"(c)","heading":null,"text":"rules and obligations on cybersecurity information sharing;","marks":[],"revision":1,"text_hash":"b56f0ebc97306cd0a1916f8fb08ac387e7f0f905aa4d119d8c0866b2792b5deb","reason":null},{"locator":"nis2/art/1/para/2/pt/d","kind":"point","status":"in_force","label":"(d)","heading":null,"text":"supervisory and enforcement obligations on Member States.","marks":[],"revision":1,"text_hash":"638281eba90897c5cf58de4b8a9f5640e269e36acc30898fa17cebbd082b87d5","reason":null}],"markdown":"---\ntitle: \"Article 1 — Subject matter\"\ntype: regulation\nlegal_status: in_force\nsource: \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227\"\nsource_retrieved: 2026-10-01\nshortTitle: \"Article 1 — Subject matter\"\ninstrument_type: level1_directive\nauthority: Commission\nbinding: true\nbinding_character: binding\nmica_level2: false\nlegal_basis: \"Directive (EU) 2022/2555\"\ninstrument: nis2\ncelex: \"32022L2555\"\nregulation: NIS2\nregulation-full: \"Directive (EU) 2022/2555\"\narticle: 1\nstatus: in_force\nobject_id: eu.nis2.legal_text.article.1\ntext_version: \"Consolidated version of 27 December 2022\"\nsource_url: \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\n---\n\n*In force · Consolidated version of 27 December 2022 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227)*\n\n1. <a id=\"p-1\"></a>This Directive lays down measures that aim to achieve a high common level of [cybersecurity](https://www.headlesslaw.com/definitions/nis2/cybersecurity) across the Union, with a view to improving the functioning of the internal market.\n2. <a id=\"p-2\"></a>To that end, this Directive lays down:\n\n    <a id=\"p-2-a\"></a>**(a)** obligations that require Member States to adopt national cybersecurity strategies and to designate or establish competent authorities, cyber crisis management authorities, single points of contact on cybersecurity (single points of contact) and computer security [incident](https://www.headlesslaw.com/definitions/nis2/incident) response teams (CSIRTs);\n\n    <a id=\"p-2-b\"></a>**(b)** cybersecurity risk-management measures and reporting obligations for entities of a type referred to in Annex I or II as well as for entities identified as critical entities under Directive (EU) 2022/2557;\n\n    <a id=\"p-2-c\"></a>**(c)** rules and obligations on cybersecurity information sharing;\n\n    <a id=\"p-2-d\"></a>**(d)** supervisory and enforcement obligations on Member States.\n\n***\n\n[Chapter I — General provisions](../chapters/i.md) · [Article 2 →](2.md)\n"}