Skip to the text
Text as of 16 Jan 2023 · Consolidated version of 27 December 2022 · Same wording as today’s text.Today’s text

Article 4 — Sector-specific Union legal acts

Digital & dataLevel 1DirectiveNIS2In forceOfficial source

4(1)

1.Where sector-specific Union legal acts require essential or important entities to adopt cybersecurity risk-management measures or to notify significant incidents and where those requirements are at least equivalent in effect to the obligations laid down in this Directive, the relevant provisions of this Directive, including the provisions on supervision and enforcement laid down in Chapter VII, shall not apply to such entities. Where sector-specific Union legal acts do not cover all entities in a specific sector falling within the scope of this Directive, the relevant provisions of this Directive shall continue to apply to the entities not covered by those sector-specific Union legal acts.

Copy link
4(2)

2.The requirements referred to in paragraph 1 of this Article shall be considered to be equivalent in effect to the obligations laid down in this Directive where:

Copy link
4(2)(a)
(a)cybersecurity risk-management measures are at least equivalent in effect to those laid down in Article 21(1) and (2); or
Copy link
4(2)(b)
(b)the sector-specific Union legal act provides for immediate access, where appropriate automatic and direct, to the incident notifications by the CSIRTs, the competent authorities or the single points of contact under this Directive and where requirements to notify significant incidents are at least equivalent in effect to those laid down in Article 23(1) to (6) of this Directive.
Copy link
4(3)

3.The Commission shall, by 17 July 2023, provide guidelines clarifying the application of paragraphs 1 and 2. The Commission shall review those guidelines on a regular basis. When preparing those guidelines, the Commission shall take into account any observations of the Cooperation Group and ENISA.

Copy link