{"release":{"id":"c89ff15ec1240a456b40735def079beeda55a0c372be7f3da154287997367ecf","published":"2026-11-02T04:02:35Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2022-12-27","gaps":[],"covered":["NIS2 L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"c89ff15ec1240a456b40735def079beeda55a0c372be7f3da154287997367ecf","release_published":"2026-11-02T04:02:35Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/nis2/articles/22","url":"https://www.headlesslaw.com/nis2/articles/22","title":"Article 22 — Union level coordinated security risk assessments of critical supply chains","family":"l1_generated","work_id":"nis2","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"Consolidated version of 27 December 2022","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227","valid_from":"2022-12-27","valid_until":null,"revision":1,"content_id":"37e55755031e1c74","change_date":null,"nearest_versions":["2022-12-27"],"first_text_date":"2022-12-14","correction_applies":false,"versions":["2022-12-27"],"version_url":"https://www.headlesslaw.com/nis2/articles/22/versions/2022-12-27","revision_url":"https://www.headlesslaw.com/nis2/articles/22/versions/2022-12-27/rev/37e55755031e1c74","versions_url":"https://www.headlesslaw.com/nis2/articles/22/versions","relations_url":"https://www.headlesslaw.com/nis2/articles/22/relations","source_line":null,"attribution":null},"provenance":{"official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/nis2/articles/22.md","body_sha256":"d09044bdf777f20b4b3e8b07f16d7ccc97a7da4a23af5d044e4da3e0f96ce65a"},"units":[{"locator":"nis2/art/22","kind":"article","status":"in_force","label":null,"heading":"Union level coordinated security risk assessments of critical supply chains","text":"","marks":[],"revision":1,"text_hash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","reason":null},{"locator":"nis2/art/22/para/1","kind":"paragraph","status":"in_force","label":"1.","heading":null,"text":"The Cooperation Group, in cooperation with the Commission and ENISA, may carry out coordinated security risk assessments of specific critical ICT services, ICT systems or ICT products supply chains, taking into account technical and, where relevant, non-technical risk factors.","marks":[],"revision":1,"text_hash":"c8e601755c23634eab259db3792ed1eb6b83208b96ad1360a371ef8e24b8c542","reason":null},{"locator":"nis2/art/22/para/2","kind":"paragraph","status":"in_force","label":"2.","heading":null,"text":"The Commission, after consulting the Cooperation Group and ENISA, and, where necessary, relevant stakeholders, shall identify the specific critical ICT services, ICT systems or ICT products that may be subject to the coordinated security risk assessment referred to in paragraph 1.","marks":[],"revision":1,"text_hash":"28eb85db3bff6b76b887e1a4127aeff2ea6b6acebf0a0198cd72fa93c2c4e6a3","reason":null}],"markdown":"---\ntitle: \"Article 22 — Union level coordinated security risk assessments of critical supply chains\"\ntype: regulation\nlegal_status: in_force\nsource: \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227\"\nsource_retrieved: 2026-10-01\nshortTitle: \"Article 22 — Union level coordinated security risk assessments of critical supply chains\"\ninstrument_type: level1_directive\nauthority: Commission\nbinding: true\nbinding_character: binding\nmica_level2: false\nlegal_basis: \"Directive (EU) 2022/2555\"\ninstrument: nis2\ncelex: \"32022L2555\"\nregulation: NIS2\nregulation-full: \"Directive (EU) 2022/2555\"\narticle: 22\nstatus: in_force\nobject_id: eu.nis2.legal_text.article.22\ntext_version: \"Consolidated version of 27 December 2022\"\nsource_url: \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\n---\n\n*In force · Consolidated version of 27 December 2022 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227)*\n\n1. <a id=\"p-1\"></a>The Cooperation Group, in cooperation with the Commission and ENISA, may carry out coordinated security risk assessments of specific critical ICT services, ICT systems or ICT products supply chains, taking into account technical and, where relevant, non-technical risk factors.\n2. <a id=\"p-2\"></a>The Commission, after consulting the Cooperation Group and ENISA, and, where necessary, relevant stakeholders, shall identify the specific critical ICT services, ICT systems or ICT products that may be subject to the coordinated security risk assessment referred to in paragraph 1.\n\n***\n\n[Chapter IV — Cybersecurity risk-management measures and reporting obligations](../chapters/iv.md) · [← Article 21](21.md) · [Article 23 →](23.md)\n"}