<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2022-12-27","gaps":[],"covered":["NIS2 L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-11-01","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/nis2/recitals/137","url":"https://www.headlesslaw.com/nis2/recitals/137","title":"Recital 137","family":"l1_recital_view","work_id":"nis2","view_of":"/nis2/recitals","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"Directive (EU) 2022/2555, OJ L 333, 27.12.2022","check":{"against":"EUR-Lex","on":"2026-11-01"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022L2555","valid_from":"2022-12-27","valid_until":null,"content_id":"b5f29fb3e51694d8","versions":["2022-12-27"],"version_url":"https://www.headlesslaw.com/nis2/recitals/137/versions/2022-12-27","revision_url":"https://www.headlesslaw.com/nis2/recitals/137/versions/2022-12-27/rev/b5f29fb3e51694d8","versions_url":"https://www.headlesslaw.com/nis2/recitals/137/versions","relations_url":"https://www.headlesslaw.com/nis2/recitals/137/relations","act_url":"https://www.headlesslaw.com/nis2/recitals","source_line":null,"attribution":null,"context":{"act":{"work_id":"nis2","path":"/nis2/recitals","name":"NIS2","number":"Directive (EU) 2022/2555","celex":"32022L2555","title_official":null,"document_date":null},"position":{"kind":"recital","key":"137","index":137,"articles":144,"annexes":0},"prev":{"path":"/nis2/recitals/136","key":"136","title":"Recital 136"},"next":{"path":"/nis2/recitals/138","key":"138","title":"Recital 138"},"act_anchor":""}}} -->
# Recital 137

*In force · Directive (EU) 2022/2555, OJ L 333, 27.12.2022 · Checked against EUR-Lex on 1 Nov 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022L2555)*

This Directive should aim to ensure a high level of responsibility for the cybersecurity risk-management measures and reporting obligations at the level of the essential and important entities. Therefore, the management bodies of the essential and important entities should approve the cybersecurity risk-management measures and oversee their implementation.