{"release":{"id":"c89ff15ec1240a456b40735def079beeda55a0c372be7f3da154287997367ecf","published":"2026-11-02T04:02:35Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2022-12-27","gaps":[],"covered":["NIS2 L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"c89ff15ec1240a456b40735def079beeda55a0c372be7f3da154287997367ecf","release_published":"2026-11-02T04:02:35Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/nis2/articles/16","url":"https://www.headlesslaw.com/nis2/articles/16","title":"Article 16 — European cyber crisis liaison organisation network (EU-CyCLONe)","family":"l1_generated","work_id":"nis2","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"Consolidated version of 27 December 2022","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227","valid_from":"2022-12-27","valid_until":null,"revision":1,"content_id":"5080815241330243","change_date":null,"nearest_versions":["2022-12-27"],"first_text_date":"2022-12-14","correction_applies":false,"versions":["2022-12-27"],"version_url":"https://www.headlesslaw.com/nis2/articles/16/versions/2022-12-27","revision_url":"https://www.headlesslaw.com/nis2/articles/16/versions/2022-12-27/rev/5080815241330243","versions_url":"https://www.headlesslaw.com/nis2/articles/16/versions","relations_url":"https://www.headlesslaw.com/nis2/articles/16/relations","source_line":null,"attribution":null},"provenance":{"official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/nis2/articles/16.md","body_sha256":"fedf14da8342af1290777a588a4870b8a733eadef0cb0587e8e2383fb0fa7220"},"units":[{"locator":"nis2/art/16","kind":"article","status":"in_force","label":null,"heading":"European cyber crisis liaison organisation network (EU-CyCLONe)","text":"","marks":[],"revision":1,"text_hash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","reason":null},{"locator":"nis2/art/16/para/1","kind":"paragraph","status":"in_force","label":"1.","heading":null,"text":"EU-CyCLONe is established to support the coordinated management of large-scale cybersecurity incidents and crises at operational level and to ensure the regular exchange of relevant information among Member States and Union institutions, bodies, offices and agencies.","marks":[],"revision":1,"text_hash":"61b7a82de91f7c3d46bc55518d26b69e43f1fc84f294a50ab050f97c44d8986c","reason":null},{"locator":"nis2/art/16/para/2","kind":"paragraph","status":"in_force","label":"2.","heading":null,"text":"EU-CyCLONe shall be composed of the representatives of Member States’ cyber crisis management authorities as well as, in cases where a potential or ongoing large-scale cybersecurity incident has or is likely to have a significant impact on services and activities falling within the scope of this Directive, the Commission. In other cases, the Commission shall participate in the activities of EU-CyCLONe as an observer.","marks":[],"revision":1,"text_hash":"9dfe74f3672250ff956114530a1132b85da80625152282cb050c9c1e326020cc","reason":null},{"locator":"nis2/art/16/para/2/cont/1","kind":"continuation","status":"in_force","label":null,"heading":null,"text":"ENISA shall provide the secretariat of EU-CyCLONe and support the secure exchange of information as well as provide necessary tools to support cooperation between Member States ensuring secure exchange of information.","marks":[],"revision":1,"text_hash":"5fc396fa18150fa2a52a8aef4bfdba37c033df45d60ee1dc7d79c0ea17097b04","reason":null},{"locator":"nis2/art/16/para/2/cont/2","kind":"continuation","status":"in_force","label":null,"heading":null,"text":"Where appropriate, EU-CyCLONe may invite representatives of relevant stakeholders to participate in its work as observers.","marks":[],"revision":1,"text_hash":"e55000767e105fdec6b38857220cd14c61a3c0b5f2aaae1d69d42d5ceaf2fe66","reason":null},{"locator":"nis2/art/16/para/3","kind":"paragraph","status":"in_force","label":"3.","heading":null,"text":"EU-CyCLONe shall have the following tasks:","marks":[],"revision":1,"text_hash":"edf31a5e71f85cc242b3699d718232e9da5ba462c9834422db2968e97c675acc","reason":null},{"locator":"nis2/art/16/para/3/pt/a","kind":"point","status":"in_force","label":"(a)","heading":null,"text":"to increase the level of preparedness of the management of large-scale cybersecurity incidents and crises;","marks":[],"revision":1,"text_hash":"f47f5a1a3237fe11e660f0b1c86f87e9dc7c2172e5ae59dc94969a6f56515f32","reason":null},{"locator":"nis2/art/16/para/3/pt/b","kind":"point","status":"in_force","label":"(b)","heading":null,"text":"to develop a shared situational awareness for large-scale cybersecurity incidents and crises;","marks":[],"revision":1,"text_hash":"a4bb85ea752b0df0ded69b4f24c80402eb8f594f7a1b878cf5388e2b9702d59d","reason":null},{"locator":"nis2/art/16/para/3/pt/c","kind":"point","status":"in_force","label":"(c)","heading":null,"text":"to assess the consequences and impact of relevant large-scale cybersecurity incidents and crises and propose possible mitigation measures;","marks":[],"revision":1,"text_hash":"9a1c3cb02a666d10e4e7ea47c9891c4559a46017638ce9bc812c7903b24113c0","reason":null},{"locator":"nis2/art/16/para/3/pt/d","kind":"point","status":"in_force","label":"(d)","heading":null,"text":"to coordinate the management of large-scale cybersecurity incidents and crises and support decision-making at political level in relation to such incidents and crises;","marks":[],"revision":1,"text_hash":"3ab9c5ef545a4ff8073b37c1fd6fa87dc4b7578c33a744d0da1393479fb5fcfe","reason":null},{"locator":"nis2/art/16/para/3/pt/e","kind":"point","status":"in_force","label":"(e)","heading":null,"text":"to discuss, upon the request of a Member State concerned, national large-scale cybersecurity incident and crisis response plans referred to in Article 9(4).","marks":[],"revision":1,"text_hash":"da0dbcfd03d9f818b13402e039c93593150aa40a89f74b37daafd5bacd8e3ee7","reason":null},{"locator":"nis2/art/16/para/4","kind":"paragraph","status":"in_force","label":"4.","heading":null,"text":"EU-CyCLONe shall adopt its rules of procedure.","marks":[],"revision":1,"text_hash":"d821e92540ed89ee6130ccc3d0e9f826ed1c3fa06f9c228e4b9bb96d95bb7837","reason":null},{"locator":"nis2/art/16/para/5","kind":"paragraph","status":"in_force","label":"5.","heading":null,"text":"EU-CyCLONe shall report on a regular basis to the Cooperation Group on the management of large-scale cybersecurity incidents and crises, as well as trends, focusing in particular on their impact on essential and important entities.","marks":[],"revision":1,"text_hash":"ea66aae30243f33d0747d322acd4b2d48fd8335057d7f24dffa359c0240f45b6","reason":null},{"locator":"nis2/art/16/para/6","kind":"paragraph","status":"in_force","label":"6.","heading":null,"text":"EU-CyCLONe shall cooperate with the CSIRTs network on the basis of agreed procedural arrangements provided for in Article 15(6).","marks":[],"revision":1,"text_hash":"f39364e422c75fb67cc4acad5bb4eb775c7ff626a4ec9d3b5f07897eea66a3fd","reason":null},{"locator":"nis2/art/16/para/7","kind":"paragraph","status":"in_force","label":"7.","heading":null,"text":"By 17 July 2024 and every 18 months thereafter, EU-CyCLONe shall submit to the European Parliament and to the Council a report assessing its work.","marks":[],"revision":1,"text_hash":"b8b1fb3dca82f2788ff9a76977b426e729ccb727cc4e1220349e75e260bfe3ef","reason":null}],"markdown":"---\ntitle: \"Article 16 — European cyber crisis liaison organisation network (EU-CyCLONe)\"\ntype: regulation\nlegal_status: in_force\nsource: \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227\"\nsource_retrieved: 2026-10-01\nshortTitle: \"Article 16 — European cyber crisis liaison organisation network (EU-CyCLONe)\"\ninstrument_type: level1_directive\nauthority: Commission\nbinding: true\nbinding_character: binding\nmica_level2: false\nlegal_basis: \"Directive (EU) 2022/2555\"\ninstrument: nis2\ncelex: \"32022L2555\"\nregulation: NIS2\nregulation-full: \"Directive (EU) 2022/2555\"\narticle: 16\nstatus: in_force\nobject_id: eu.nis2.legal_text.article.16\ntext_version: \"Consolidated version of 27 December 2022\"\nsource_url: \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\n---\n\n*In force · Consolidated version of 27 December 2022 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227)*\n\n1. <a id=\"p-1\"></a>EU-CyCLONe is established to support the coordinated management of large-scale [cybersecurity](https://www.headlesslaw.com/definitions/nis2/cybersecurity) incidents and crises at operational level and to ensure the regular exchange of relevant information among Member States and Union institutions, bodies, offices and agencies.\n2. <a id=\"p-2\"></a>EU-CyCLONe shall be composed of the representatives of Member States’ cyber crisis management authorities as well as, in cases where a potential or ongoing [large-scale cybersecurity incident](https://www.headlesslaw.com/definitions/nis2/large-scale-cybersecurity-incident) has or is likely to have a significant impact on services and activities falling within the scope of this Directive, the Commission. In other cases, the Commission shall participate in the activities of EU-CyCLONe as an observer.\n\n    ENISA shall provide the secretariat of EU-CyCLONe and support the secure exchange of information as well as provide necessary tools to support cooperation between Member States ensuring secure exchange of information.\n\n    Where appropriate, EU-CyCLONe may invite representatives of relevant stakeholders to participate in its work as observers.\n3. <a id=\"p-3\"></a>EU-CyCLONe shall have the following tasks:\n\n    <a id=\"p-3-a\"></a>**(a)** to increase the level of preparedness of the management of large-scale cybersecurity incidents and crises;\n\n    <a id=\"p-3-b\"></a>**(b)** to develop a shared situational awareness for large-scale cybersecurity incidents and crises;\n\n    <a id=\"p-3-c\"></a>**(c)** to assess the consequences and impact of relevant large-scale cybersecurity incidents and crises and propose possible mitigation measures;\n\n    <a id=\"p-3-d\"></a>**(d)** to coordinate the management of large-scale cybersecurity incidents and crises and support decision-making at political level in relation to such incidents and crises;\n\n    <a id=\"p-3-e\"></a>**(e)** to discuss, upon the request of a Member State concerned, national large-scale cybersecurity incident and crisis response plans referred to in [Article 9(4)](9.md).\n4. <a id=\"p-4\"></a>EU-CyCLONe shall adopt its rules of procedure.\n5. <a id=\"p-5\"></a>EU-CyCLONe shall report on a regular basis to the Cooperation Group on the management of large-scale cybersecurity incidents and crises, as well as trends, focusing in particular on their impact on essential and important entities.\n6. <a id=\"p-6\"></a>EU-CyCLONe shall cooperate with the CSIRTs network on the basis of agreed procedural arrangements provided for in [Article 15(6)](15.md).\n7. <a id=\"p-7\"></a>By 17 July 2024 and every 18 months thereafter, EU-CyCLONe shall submit to the European Parliament and to the Council a report assessing its work.\n\n***\n\n[Chapter III — Cooperation at Union and international level](../chapters/iii.md) · [← Article 15](15.md) · [Article 17 →](17.md)\n"}