--- title: "Article 22 — Union level coordinated security risk assessments of critical supply chains" type: regulation legal_status: in_force source: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227" source_retrieved: 2026-10-01 shortTitle: "Article 22 — Union level coordinated security risk assessments of critical supply chains" instrument_type: level1_directive authority: Commission binding: true binding_character: binding mica_level2: false legal_basis: "Directive (EU) 2022/2555" instrument: nis2 celex: "32022L2555" regulation: NIS2 regulation-full: "Directive (EU) 2022/2555" article: 22 status: in_force object_id: eu.nis2.legal_text.article.22 text_version: "Consolidated version of 27 December 2022" source_url: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227" check_status: matched verified: true last_checked: 2026-10-26 --- *In force · Consolidated version of 27 December 2022 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227)* 1. The Cooperation Group, in cooperation with the Commission and ENISA, may carry out coordinated security risk assessments of specific critical ICT services, ICT systems or ICT products supply chains, taking into account technical and, where relevant, non-technical risk factors. 2. The Commission, after consulting the Cooperation Group and ENISA, and, where necessary, relevant stakeholders, shall identify the specific critical ICT services, ICT systems or ICT products that may be subject to the coordinated security risk assessment referred to in paragraph 1. *** [Chapter IV — Cybersecurity risk-management measures and reporting obligations](../chapters/iv.md) · [← Article 21](21.md) · [Article 23 →](23.md)