--- title: "Article 4 — Sector-specific Union legal acts" type: regulation legal_status: in_force source: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227" source_retrieved: 2026-10-01 shortTitle: "Article 4 — Sector-specific Union legal acts" instrument_type: level1_directive authority: Commission binding: true binding_character: binding mica_level2: false legal_basis: "Directive (EU) 2022/2555" instrument: nis2 celex: "32022L2555" regulation: NIS2 regulation-full: "Directive (EU) 2022/2555" article: 4 status: in_force object_id: eu.nis2.legal_text.article.4 text_version: "Consolidated version of 27 December 2022" source_url: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227" check_status: matched verified: true last_checked: 2026-11-02 --- *In force · Consolidated version of 27 December 2022 · Checked against EUR-Lex on 2 Nov 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227)* 1. Where sector-specific Union legal acts require essential or important entities to adopt cybersecurity risk-management measures or to notify significant incidents and where those requirements are at least equivalent in effect to the obligations laid down in this Directive, the relevant provisions of this Directive, including the provisions on supervision and enforcement laid down in Chapter VII, shall not apply to such entities. Where sector-specific Union legal acts do not cover all entities in a specific sector falling within the scope of this Directive, the relevant provisions of this Directive shall continue to apply to the entities not covered by those sector-specific Union legal acts. 2. The requirements referred to in paragraph 1 of this Article shall be considered to be equivalent in effect to the obligations laid down in this Directive where: **(a)** cybersecurity risk-management measures are at least equivalent in effect to those laid down in [Article 21(1)](21.md) and (2); or **(b)** the sector-specific Union legal act provides for immediate access, where appropriate automatic and direct, to the [incident](https://www.headlesslaw.com/definitions/nis2/incident) notifications by the CSIRTs, the competent authorities or the single points of contact under this Directive and where requirements to notify significant incidents are at least equivalent in effect to those laid down in [Article 23(1)](23.md) to (6) of this Directive. 3. The Commission shall, by 17 July 2023, provide guidelines clarifying the application of paragraphs 1 and 2. The Commission shall review those guidelines on a regular basis. When preparing those guidelines, the Commission shall take into account any observations of the Cooperation Group and ENISA. ## Related Level 2 and Level 3 ### Guidance and Q&A - [C(2023) 6068 — Guideline — Sector-specific acts \[final\]](../level-3/guidelines/commission-c-2023-6068-article-4-sector-specific-acts.md) *** [Chapter I — General provisions](../chapters/i.md) · [← Article 3](3.md) · [Article 5 →](5.md)