Source: OJ L 333, 27.12.2022, p. 80–152Current language: EN
- High common level of cybersecurity for entities
Basic legislative acts
- NIS 2 directive
Article 37 Mutual assistance
Summary What does Article 37 of the NIS 2 directive say?
This article addresses cross-border supervision, dealing specifically with situations where an entity operates across multiple Member States.
It establishes a mutual assistance framework between competent authorities, ensuring that when an entity's activities or systems span borders, no single authority acts in isolation.
Competent authorities are required to inform, consult, and assist one another, and can even request that another authority take supervisory or enforcement action.
The article also sets out limited, defined grounds on which a competent authority may refuse a request for assistance, and opens the door to joint supervisory actions by mutual agreement.
Important points:
- Competent authorities are required to cooperate and assist each other when an entity provides services in, or has systems located across, more than one Member State.
- A competent authority may only refuse a request for assistance on three specific grounds: lack of competence, disproportionality to its supervisory tasks, or conflict with national security, public security, or defence interests — and must consult other concerned authorities before doing so.
- Competent authorities of different Member States may carry out joint supervisory actions where appropriate and by common agreement.
Springlex's summary of the article, a reading aid, not a substitute for the legal text.
Where an entity provides services in more than one Member State, or provides services in one or more Member States and its network and information systems are located in one or more other Member States, the competent authorities of the Member States concerned shall cooperate with and assist each other as necessary. That cooperation shall entail, at least, that:
the competent authorities applying supervisory or enforcement measures in a Member State shall, via the single point of contact, inform and consult the competent authorities in the other Member States concerned on the supervisory and enforcement measures taken;
a competent authority may request another competent authority to take supervisory or enforcement measures;
a competent authority shall, upon receipt of a substantiated request from another competent authority, provide the other competent authority with mutual assistance proportionate to its own resources so that the supervisory or enforcement measures can be implemented in an effective, efficient and consistent manner.
The mutual assistance referred to in the first subparagraph, point (c), may cover information requests and supervisory measures, including requests to carry out on-site inspections or off-site supervision or targeted security audits. A competent authority to which a request for assistance is addressed shall not refuse that request unless it is established that it does not have the competence to provide the requested assistance, the requested assistance is not proportionate to the supervisory tasks of the competent authority, or the request concerns information or entails activities which, if disclosed or carried out, would be contrary to the essential interests of the Member State’s national security, public security or defence. Before refusing such a request, the competent authority shall consult the other competent authorities concerned as well as, upon the request of one of the Member States concerned, the Commission and ENISA.
Where appropriate and with common agreement, the competent authorities of various Member States may carry out joint supervisory actions.
Relevant recitals
Recital 134 Cooperation and assistance via the Cooperation Group
For the purpose of ensuring entities’ compliance with their obligations laid down in this Directive, Member States should cooperate with and assist each other with regard to supervisory and enforcement measures, in particular where an entity provides services in more than one Member State or where its network and information systems are located in a Member State other than that where it provides services. When providing assistance, the requested competent authority should take supervisory or enforcement measures in accordance with national law. In order to ensure the smooth functioning of mutual assistance under this Directive, the competent authorities should use the Cooperation Group as a forum to discuss cases and particular requests for assistance.
Recital 135 Response to requests of mutual assistance
In order to ensure effective supervision and enforcement, in particular in a situation with a cross-border dimension, a Member State that has received a request for mutual assistance should, within the limits of that request, take appropriate supervisory and enforcement measures in relation to the entity that is the subject of that request, and that provides services or has a network and information system on the territory of that Member State.
Springlex and this text is meant purely as a documentation tool and has no legal effect. No liability is assumed for its content. The authentic version of this act is the one published in the Official Journal of the European Union.
Definition
network and information system
- an electronic communications network as defined in Article 2, point (1), of Directive (EU) 2018/1972;
- any device or group of interconnected or related devices, one or more of which, pursuant to a programme, carry out automatic processing of digital data; or
- digital data stored, processed, retrieved or transmitted by elements covered under points (a) and (b) for the purposes of their operation, use, protection and maintenance;
Definition
entity