Art. 40 Review | NIS 2 directive | NIS 2

This is a review clause that places an obligation on the Commission to periodically assess how the Directive is functioning in practice.

The focus of the review is notably specific: rather than a general health-check, it targets whether the scoping criteria — entity size, sectors, subsectors, and types of entity — remain appropriate for the economy and society from a cybersecurity perspective.

To inform this assessment, the Commission must draw on the outputs of the Cooperation Group and the CSIRTs network, connecting this article directly to those cooperative bodies established elsewhere in the Directive.

Important points:

The Commission is required to conduct a review by 17 October 2027 and every 36 months after that, reporting to the European Parliament and the Council.
The review must specifically assess whether the size thresholds and sectoral scope set out in Annexes I and II remain fit for purpose in relation to cybersecurity.
The report may be accompanied by a legislative proposal, meaning the Directive's scope could be revised as a result of the review.

The Commission should periodically review this Directive, after consulting stakeholders, in particular with a view to determining whether it is appropriate to propose amendments in light of changes to societal, political, technological or market conditions. As part of those reviews, the Commission should assess the relevance of the size of the entities concerned, and the sectors, subsectors and types of entity referred to in the annexes to this Directive for the functioning of the economy and society in relation to cybersecurity. The Commission should assess, inter alia, whether providers, falling within the scope of this Directive, that are designated as very large online platforms within the meaning of Article 33 of Regulation (EU) 2022/2065 of the European Parliament and of the Council(²⁴) could be identified as essential entities under this Directive.

Article 40 Review

Relevant recitals