<!-- headlesslaw {"release":{"id":"c89ff15ec1240a456b40735def079beeda55a0c372be7f3da154287997367ecf","published":"2026-11-02T04:02:35Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2022-12-27","gaps":[],"covered":["NIS2 L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"c89ff15ec1240a456b40735def079beeda55a0c372be7f3da154287997367ecf","release_published":"2026-11-02T04:02:35Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/nis2/articles/40","url":"https://www.headlesslaw.com/nis2/articles/40","title":"Article 40 — Review","family":"l1_generated","work_id":"nis2","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"Consolidated version of 27 December 2022","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227","valid_from":"2022-12-27","valid_until":null,"revision":1,"content_id":"bdcd8ba37e4a5194","change_date":null,"nearest_versions":["2022-12-27"],"first_text_date":"2022-12-14","correction_applies":false,"versions":["2022-12-27"],"version_url":"https://www.headlesslaw.com/nis2/articles/40/versions/2022-12-27","revision_url":"https://www.headlesslaw.com/nis2/articles/40/versions/2022-12-27/rev/bdcd8ba37e4a5194","versions_url":"https://www.headlesslaw.com/nis2/articles/40/versions","relations_url":"https://www.headlesslaw.com/nis2/articles/40/relations","source_line":null,"attribution":null}} -->
---
title: "Article 40 — Review"
type: regulation
legal_status: in_force
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227"
source_retrieved: 2026-10-01
shortTitle: "Article 40 — Review"
instrument_type: level1_directive
authority: Commission
binding: true
binding_character: binding
mica_level2: false
legal_basis: "Directive (EU) 2022/2555"
instrument: nis2
celex: "32022L2555"
regulation: NIS2
regulation-full: "Directive (EU) 2022/2555"
article: 40
status: in_force
object_id: eu.nis2.legal_text.article.40
text_version: "Consolidated version of 27 December 2022"
source_url: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227"
check_status: matched
verified: true
last_checked: 2026-10-26
---

*In force · Consolidated version of 27 December 2022 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227)*

By 17 October 2027 and every 36 months thereafter, the Commission shall review the functioning of this Directive, and report to the European Parliament and to the Council. The report shall in particular assess the relevance of the size of the entities concerned, and the sectors, subsectors and types of [entity](https://www.headlesslaw.com/definitions/nis2/entity) referred to in Annexes I and II for the functioning of the economy and society in relation to [cybersecurity](https://www.headlesslaw.com/definitions/nis2/cybersecurity). To that end and with a view to further advancing the strategic and operational cooperation, the Commission shall take into account the reports of the Cooperation Group and the CSIRTs network on the experience gained at a strategic and operational level. The report shall be accompanied, where necessary, by a legislative proposal.

***

[Chapter IX — Final provisions](../chapters/ix.md) · [← Article 39](39.md) · [Article 41 →](41.md)