<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2026-10-26","gaps":[],"covered":["2024/2690 — Implementing act — Cybersecurity risk-management measures [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/articles/11","url":"https://www.headlesslaw.com/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/articles/11","title":"Article 11 — Significant incidents with regard to providers of online marketplaces","family":"l2_unit_view","work_id":"spaces/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures","view_of":"/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Commission Implementing Regulation (EU) 2024/2690, OJ L, 2024/2690, 18.10.2024","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/reg_impl/2024/2690/oj/eng","valid_from":"2024-11-07","valid_until":null,"content_id":"0d29d1382b680e6b","versions":["2024-11-07"],"version_url":"https://www.headlesslaw.com/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/articles/11/versions/2026-10-26","revision_url":"https://www.headlesslaw.com/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/articles/11/versions/2026-10-26/rev/0d29d1382b680e6b","versions_url":"https://www.headlesslaw.com/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/articles/11/versions","relations_url":"https://www.headlesslaw.com/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/articles/11/relations","act_url":"https://www.headlesslaw.com/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures#art-11","source_line":"Commission Implementing Regulation (EU) 2024/2690 · binding · OJ L, 2024/2690, 18.10.2024 · dated 17 Oct 2024 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"implementing_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2024-10-17","published_on":"2024-10-18","entry_into_force":"2024-11-07","locators":{"document_date":"CELLAR 32024R2690 work_date_document","published_on":"CELLAR 32024R2690 official-journal-act_date_publication","entry_into_force":"CELLAR 32024R2690 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures","path":"/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures","name":"Commission Implementing Regulation (EU) 2024/2690","number":"2024/2690","celex":"32024R2690","title_official":"COMMISSION IMPLEMENTING REGULATION (EU) 2024/2690 of 17 October 2024 laying down rules for the application of Directive (EU) 2022/2555 as regards technical and methodological requirements of cybersecurity risk-management measures and further specification of the cases in which an incident is considered to be significant with regard to DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, providers of online market places, of online search engines and of social networking services platforms, and trust service providers (Text with EEA relevance)","document_date":"2024-10-17"},"position":{"kind":"article","key":"11","index":11,"articles":16,"annexes":1},"prev":{"path":"/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/articles/10","key":"10","title":"Article 10 — Significant incidents with regard to managed service providers and managed security service providers"},"next":{"path":"/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/articles/12","key":"12","title":"Article 12 — Significant incidents with regard to providers of online search engines"},"act_anchor":"#art-11"}}} -->
# Article 11 — Significant incidents with regard to providers of online marketplaces

**Commission Implementing Regulation (EU) 2024/2690 · binding · OJ L, 2024/2690, 18.10.2024 · dated 17 Oct 2024 [in force]**

*In force · Commission Implementing Regulation (EU) 2024/2690, OJ L, 2024/2690, 18.10.2024 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/eli/reg_impl/2024/2690/oj/eng)*

With regard to providers of online marketplaces, an incident shall be considered significant under Article 3(1)(g) where it fulfils one or more of the following criteria:

<a id="art-11-p-a"></a>**(a)** an online marketplace is completely unavailable for more than 5 % of an online marketplace’s users in the Union, or for more than 1 million of an online marketplace’s users in the Union, whichever number is smaller;

<a id="art-11-p-b"></a>**(b)** more than 5 % of an online marketplace’s users in the Union, or more than 1 million of an online marketplace’s users in the Union, whichever number is smaller, are impacted by limited availability of that online marketplace;

<a id="art-11-p-c"></a>**(c)** the integrity, confidentiality or authenticity of stored, transmitted or processed data related to the provision of an online marketplace is compromised as a result of a suspectedly malicious action;

<a id="art-11-p-d"></a>**(d)** the integrity, confidentiality or authenticity of stored, transmitted or processed data related to the provision of an online marketplace is compromised with an impact on more than 5 % of that online marketplace’s users in the Union, or on more than 1 million of that online marketplace’s users in the Union, whichever number is smaller.
