NIS2 Authorities: Competent Authorities, Single Points of Contact, CSIRTs and EU Bodies

Member States had to adopt the national measures that set up these bodies, Articles 8 to 13 included, by 17 October 2024 and apply them from 18 October 2024 (Article 41(1)). Entities deal with the bodies through their national law, because the Directive is addressed to the Member States (Article 46), and how the law itself is built is explained under NIS2 Directive on the home page.

This page maps the five kinds of national body and the five EU bodies and registers above them, article by article. It then shows where each country's current authority is named and which changes are pending as of 23 October 2026.

What Is a NIS2 Competent Authority?

A NIS2 competent authority is the national body that a Member State designates under Article 8(1) of Directive (EU) 2022/2555 to be responsible for cybersecurity and for supervising essential and important entities, and each Member State has one or more of them. Each Member State makes the identity of its competent authority public (Article 8(6)).

Competent authorities hold appropriate powers with operational independence vis-à-vis the public administration entities they supervise (Article 31(4)). Member States may also allow them to prioritise supervisory tasks on a risk basis (Article 31(2) and recital 124).

Supervision differs by entity category. Essential entities are supervised ex ante and ex post (Article 32), important entities ex post only, when the authority is provided with evidence, an indication or information of non-compliance (Article 33(1)). Where an entity provides services in more than one Member State, competent authorities assist each other through information requests, on-site inspections, off-site supervision and targeted audits, and may agree on joint supervisory actions (Article 37(1) and (2)); audits, inspections and orders are set out under NIS2 supervision and enforcement.

The Single Point of Contact: The Liaison Between Member States

The single point of contact is the one body per Member State that exercises the liaison function for cross-border cooperation with other Member States, the Commission and ENISA and for cross-sectoral cooperation at home (Article 8(3) and (4)); where a Member State has only one competent authority, that authority is also the single point of contact.

The Commission makes the list of single points of contact publicly available (Article 8(6)). Single points of contact also carry incident information across borders: where an incident affects other Member States, they forward the notifications so that the authorities of those Member States learn of it (Article 23(6) and (8)).

Every three months, the single point of contact sends ENISA a summary report with anonymised and aggregated data on significant incidents, incidents, cyber threats and near misses (Article 23(9)), and ENISA reports its findings to the Cooperation Group and the CSIRTs network every six months. The single point of contact also forwards to ENISA, without undue delay, the registry data that the 11 types of Article 26(1)(b) submitted to the competent authority by 17 January 2025 (Article 27(2)), except the IP ranges (Article 27(4)). Entities never register with ENISA directly; the national steps are covered under NIS2 registration.

How the National Bodies Work Together

Five kinds of national body work together under Chapter II of Directive (EU) 2022/2555: the competent authorities, the single point of contact, the CSIRTs, the CSIRT that coordinates vulnerability disclosure, and the cyber crisis management authorities, all bound to cooperate by Article 13. The five national bodies and what each does for an entity are listed below.

The national bodies work within a national cybersecurity strategy. Each Member State notifies its strategy to the Commission within three months of adoption (Article 7(3)) and assesses it at least every five years (Article 7(4)). The cyber crisis management authority is likewise notified to the Commission within three months of its designation (Article 9(5)).

CSIRTs or, where applicable, competent authorities receive the mandatory notifications of Article 23 and the voluntary notifications of Article 30 (Article 13(2)). The CSIRT gives initial feedback without undue delay and where possible within 24 hours of the early warning (Article 23(5)). The national bodies also cooperate with the data protection authorities and with the authorities under DORA (Regulation (EU) 2022/2554), the CER Directive, the European Electronic Communications Code, eIDAS and the aviation Regulations 300/2008 and 2018/1139 (Article 13(4) and (5)). Reports go to the CSIRT or the authority, never to ENISA, and the 24-hour, 72-hour and one-month stages are explained under NIS2 incident reporting.

The EU Bodies: Strategic, Operational and Crisis Cooperation

Directive (EU) 2022/2555 sets up three EU networks, the Cooperation Group for strategic cooperation (Article 14), the CSIRTs network for operational cooperation (Article 15) and EU-CyCLONe for crisis management (Article 16), and gives ENISA tasks that include the European vulnerability database (Article 12(2)). Each network has its own members and secretariat. EU-CyCLONe acts on large-scale cybersecurity incidents, meaning incidents that exceed a Member State's capacity to respond or significantly affect at least two Member States (Article 6(7)). The five EU bodies and registers, with their legal basis, members and role, are listed below.

The three networks report on cycles that the Directive fixes, listed below.

• Cooperation Group: a work programme by 1 February 2024, then every two years (Article 14(7)).
• CSIRTs network: a report to the Cooperation Group by 17 January 2025, then every two years (Article 15(4)).
• EU-CyCLONe: a report to the European Parliament and the Council by 17 July 2024, then every 18 months (Article 16(7)).

ENISA adds a biennial report on the state of cybersecurity in the Union (Article 18(1)). Peer reviews are voluntary, and the experts come from at least two Member States other than the one reviewed (Article 19(1)).

Who Is the Competent Authority in a Given Member State?

Each Member State names its own competent authorities, single point of contact and CSIRTs in its national NIS2 law, so the authority for a given entity follows from that law and from the jurisdiction rule of Article 26. The Commission's per-country NIS2 pages were last updated on 7 and 8 July 2025 and still show the NIS1 structure, so they are no source for current designations. In Sweden, the Commission page names the Swedish Civil Contingencies Agency (MSB), while Försvarets radioanstalt (FRA) with its national cybersecurity centre has been the single point of contact and CSIRT since 1 July 2026 (§§ 23 and 31 of the Cybersäkerhetsförordning (2025:1507), as amended by SFS 2026:623). In Romania, the Commission page shows CERT-RO, while the Directoratul Național de Securitate Cibernetică (DNSC) is the competent authority, the national CSIRT and CVD coordinator (Articles 24(2) and 36(1)) and the single point of contact (Article 40(1)) under OUG No. 155/2024.

For the other 25 Member States, the designations are those of each national NIS2 law, not those of the Commission listing. Each country's authority and its status as of 23 October 2026 are listed in the NIS2 transposition tracker.

Pending Changes to the Authority Framework as of 2026-10-23

As of 23 October 2026, the Commission's proposal COM(2026) 13 of 20 January 2026 (procedure 2026/0012(COD)) is pending and would make ENISA a member of the CSIRTs network, extend ENISA's registry to all essential and important entities and give ENISA a cross-border cybersecurity risk analysis within 15 months after entry into force, updated annually. The proposal would also add a policy for the transition to post-quantum cryptography to the national cybersecurity strategies.

In the European Parliament procedure, the lead committee ITRE lists the proposal as "Awaiting committee decision" as of 23 October 2026, with a draft report dated 24 September 2026 and amendments dated 13 October 2026. None of these proposed changes is law.

The Digital Omnibus, COM(2025) 837 of 19 November 2025 (procedure 2025/0360(COD)), proposes a single-entry point for incident reports that ENISA would develop and maintain. It is also pending: the Council's Permanent Representatives Committee (Coreper) agreed a mandate for negotiations with the European Parliament on 21 October 2026, and both proposals are tracked under NIS2 amendments and review.

What NIS2 Authorities Do Not Do

NIS2 authorities do not certify entities, approve providers or decide scope by registration: national competent authorities supervise and enforce, and the EU bodies coordinate Member States, not companies. An entity's duties come from its national law, whether or not it appears on a national list, and the competent authority checks them through the supervisory measures of Articles 32 and 33.

Does ENISA Supervise or Fine Entities?

No: ENISA has no supervisory or fining powers over entities under NIS2, because supervision and enforcement sit with the national competent authorities (Articles 31 to 33). ENISA operates under Regulation (EU) 2019/881 (OJ L 151, 7.6.2019, p. 15), and its NIS2 contact with entity data runs through three channels, listed below.

• Summary reports: the three-monthly, anonymised summaries from the single points of contact (Article 23(9)).
• Registry: the Article 27 registry of the 11 types of Article 26(1)(b), fed by the single points of contact.
• Vulnerability database: the EUVD, where registration of publicly known vulnerabilities is voluntary (Article 12(2)).

Can an Entity Choose Which Authority Supervises It?

No: jurisdiction follows Article 26, which places an entity under the Member State where it is established, telecoms providers under each Member State where they provide services, the 11 types of Article 26(1)(b) under their main establishment and public administration entities under the Member State that established them. An entity established or providing services in more than one Member State can fall under separate and concurrent jurisdictions, with the ne bis in idem principle applying (recital 113). The law decides the supervisor, and the main-establishment test is set out under NIS2 jurisdiction.

How Does the EU Cooperate with Third Countries?

The Union may conclude international agreements with third countries or international organisations under Article 218 TFEU, as Article 17 of Directive (EU) 2022/2555 provides (recital 72). At operational level, CSIRTs may cooperate with the national CSIRTs of third countries and use information-sharing protocols for that exchange, including the traffic light protocol (Article 10(7) and (8)).