Art. 4 Sector-specific Union legal acts | NIS 2 directive | NIS 2

This article establishes a "lex specialis" carve-out, meaning that where other sector-specific EU legislation already imposes cybersecurity risk-management and incident reporting requirements on essential or important entities that are at least equivalent in effect to those in this Directive, this Directive's obligations — including its supervision and enforcement provisions — will not apply to those entities.

It effectively prevents double regulation.

The article also sets out the threshold for what counts as "equivalent," tying it directly to the core obligations on risk management and incident notification found elsewhere in the Directive, and tasks the Commission with issuing clarifying guidelines.

Important points:

If your sector is already governed by equivalent EU cybersecurity rules, this Directive's obligations do not apply to you — but only to the extent that coverage is complete.
Equivalence is measured against the cybersecurity risk-management and significant incident notification standards set out in Articles 21 and 23 of this Directive.
The Commission is required to publish guidelines clarifying how this equivalence test applies, taking into account input from the Cooperation Group and ENISA.

1. Where sector-specific Union legal acts require essential or important entities to adopt cybersecurity risk-management measures or to notify significant incidents and where those requirements are at least equivalent in effect to the obligations laid down in this Directive, the relevant provisions of this Directive, including the provisions on supervision and enforcement laid down in Chapter VII, shall not apply to such entities. Where sector-specific Union legal acts do not cover all entities in a specific sector falling within the scope of this Directive, the relevant provisions of this Directive shall continue to apply to the entities not covered by those sector-specific Union legal acts.
1. The requirements referred to in paragraph 1 of this Article shall be considered to be equivalent in effect to the obligations laid down in this Directive where:
  1. cybersecurity risk-management measures are at least equivalent in effect to those laid down in Article 21(1) and (2); or
  2. the sector-specific Union legal act provides for immediate access, where appropriate automatic and direct, to the incident notifications by the CSIRTs, the competent authorities or the single points of contact under this Directive and where requirements to notify significant incidents are at least equivalent in effect to those laid down in Article 23(1) to (6) of this Directive.
1. The Commission shall, by 17 July 2023, provide guidelines clarifying the application of paragraphs 1 and 2. The Commission shall review those guidelines on a regular basis. When preparing those guidelines, the Commission shall take into account any observations of the Cooperation Group and ENISA.