Directive (EU) 2022/2555 (NIS2): Full Text, Structure, Annexes and How to Read It

The English text, its PDF and the other language versions sit on one EUR-Lex document page.

The Directive has been in force since 16 January 2023 (Article 45) and is addressed to the Member States (Article 46), so an organisation meets its duties through the national law that transposes it. The text sets what every national law must contain, and what the law requires in plain terms is explained under NIS2 Directive on the home page.

This page gives the identity of the act, the official access points with the corrigenda, the structure by chapter and addressee, the three annexes, a six-step method for reading a provision, and the status of the text as of 23 October 2026.

What Is Directive (EU) 2022/2555?

Directive (EU) 2022/2555 is the Directive of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, which amends Regulation (EU) No 910/2014 and Directive (EU) 2018/1972 and repeals Directive (EU) 2016/1148. Its own short title, given in brackets at the end of the full title, is "NIS 2 Directive". The act is a directive, not a regulation: it binds the Member States, sets the transposition dates in Article 41(1), and leaves companies bound by the national law that transposes it. Table 1 collects the identifiers that the Official Journal and EUR-Lex give for the act.

How the Text Was Proposed, Signed and Published

The Commission proposed the text as COM(2020) 823 on 16 December 2020 under procedure 2020/0359(COD), on the legal basis of Article 114 TFEU. The Presidents of the European Parliament and of the Council signed the Directive in Strasbourg on 14 December 2022, and the Directive was published in OJ L 333 on 27 December 2022. Publication started the clock of Article 45: the Directive entered into force on the twentieth day after publication, 16 January 2023, the same date from which Article 38(2) runs the Commission's five-year delegation.

The preamble cites three advisory steps: the opinion of the European Central Bank (OJ C 233, 16.6.2022, p. 22), the opinion of the European Economic and Social Committee (OJ C 286, 16.7.2021, p. 170) and the opinion of the European Data Protection Supervisor of 11 March 2021. The heading of the act carries the mention "Text with EEA relevance". As of 23 October 2026, NIS2 is under scrutiny for incorporation into the EEA Agreement, and there is no EEA Joint Committee Decision.

Where to Read and Download the Official Text

The official text of Directive (EU) 2022/2555 is on EUR-Lex under CELEX 32022L2555 and the ELI http://data.europa.eu/eli/dir/2022/2555/oj, as HTML and as a PDF of the Official Journal in each language version. The EUR-Lex document page bundles the language versions with the procedure and the linked acts, while the ELI is the stable identifier of the act itself.

The text published in the Official Journal is the official version. Mirror sites and vendor PDFs are copies without official status, so a citation in a policy, a contract or an audit report points to EUR-Lex. Table 2 lists the five official access points, from the document page to the English corrigendum.

Language Versions and Their Official Short Names

Each language version of Directive (EU) 2022/2555 carries its own short name, and the French and Spanish versions do not use the letters NIS. The six short names below come from the Official Journal text of each version.

• German: "NIS-2-Richtlinie"
• French: "directive SRI 2"
• Italian: "direttiva NIS 2"
• Spanish: "Directiva SRI 2"
• Dutch: "NIS 2-richtlijn"
• Polish: "dyrektywa NIS 2"

The act's English short title is "NIS 2 Directive". "Network and Information Security Directive" is a common expansion of the abbreviation, not the official title: the full English title ends with the short form "(NIS 2 Directive)" and spells out no abbreviation.

Corrigenda and the Consolidated Version

A corrigendum corrects an error in a published language version and is not an amendment: the English corrigendum OJ L, 2023/90206 of 22 December 2023 changes "on 17 January 2025" in Article 19(1) to "by 17 January 2025". Article 19(1) concerns the methodology for peer reviews, so the corrected wording sets a deadline rather than a fixed day. The corrigendum has its own ELI, http://data.europa.eu/eli/dir/2022/2555/corrigendum/2023-12-22/oj.

An earlier corrigendum, 32022L2555R(01) in OJ L 112, 27.4.2023, concerns the Italian and Dutch versions. A corrigendum leaves the act unamended, so EUR-Lex holds a single consolidated version, 02022L2555-20221227, which carries the publication date in its number and the original wording, because no amending act has been adopted as of 23 October 2026.

How the Text Is Built: 144 Recitals, 46 Articles, 9 Chapters, 3 Annexes

Directive (EU) 2022/2555 opens with 144 recitals, sets out its rules in 46 articles grouped in 9 chapters, and closes with 3 annexes: two sector annexes and a correlation table. Chapter IV (Articles 20 to 25) holds the obligations most entities look for: governance, risk-management measures and reporting. Chapter VII (Articles 31 to 37) holds supervision, enforcement and fines. Article 6 in Chapter I gives 41 numbered definitions, and 16 of them are defined by reference to other Union acts, such as Regulation (EU) 2019/881 and Directive (EU) 2018/1972. "Significant incident" is not one of the 41, because Article 23(1) and 23(3) define it. Table 3 lists the nine chapters with their article ranges and the main addressee.

Chapter titles as in the English Official Journal text.

Which Articles Bind Entities and Which Bind Member States

Seven provisions set duties that reach entities once the national law transposes them: Article 3(4), Articles 20, 21 and 23, Article 27(2), Article 28 and Article 29(4). Every other article binds the Member States (for example Articles 7 to 13 and 31 to 37), sets up cooperation at Union level (Articles 14 to 19) or gives the Commission powers (Articles 21(5), 23(11), 24(2), 38 and 39). Even the seven entity provisions start as instructions to the Member States, which write them into national law.

Article 5 makes the Directive a minimum-harmonisation act: Member States may adopt or maintain provisions that ensure a higher level of cybersecurity. Article 41(2) requires the national measures to contain a reference to the Directive, which is how a national provision can be traced back to its article. Table 4 groups the articles by what they set and whom they bind, with the guide that explains each group.

How the Recitals Explain the Articles

The 144 recitals state the reasons behind the articles, and Table 5 pairs 10 recitals or recital groups with the article each one explains. Recital 128 sits behind Article 34: the Directive fines the entity and creates no EU requirement of civil or criminal liability of natural persons towards third parties. Recitals 113 to 116 explain the jurisdiction rules of Article 26, and recital 113 adds that entities active in more than one Member State can fall under separate and concurrent jurisdiction. Recital 140 tells the Commission to assess, in the Article 40 review, whether to treat very large online platforms under the Digital Services Act as essential entities.

Acts the Directive Amends and Repeals

Directive (EU) 2022/2555 changes three earlier acts with effect from 18 October 2024: it deletes Article 19 of Regulation (EU) No 910/2014 (Article 42), deletes Articles 40 and 41 of Directive (EU) 2018/1972 (Article 43) and repeals Directive (EU) 2016/1148 of 6 July 2016 (Article 44). The deleted provisions held the security rules of trust service providers under eIDAS and of electronic communications providers under the European Electronic Communications Code.

Both groups of providers now fall under the digital infrastructure sector of Annex I and follow the NIS2 measures and reporting rules. References to the repealed Directive (EU) 2016/1148, published in OJ L 194, 19.7.2016, p. 1, are read as references to Directive (EU) 2022/2555 through the correlation table in Annex III.

The Three Annexes: Sectors and the Correlation Table

Annex I lists 11 sectors of high criticality, Annex II lists 7 other critical sectors, and Annex III is a correlation table between the repealed Directive (EU) 2016/1148 and Directive (EU) 2022/2555. Together the two sector annexes cover 18 sectors, and an entity type must appear in one of them before the size-cap rule of Article 2(1) is tested. All three annexes have been in force since 16 January 2023, together with the articles.

Annex I: What Its 11 Points List

Annex I, headed "Sectors of high criticality", lists 11 sectors in points 1 to 11: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business-to-business), public administration and space. Each point names subsectors and entity types, and Article 6 defines part of them by reference to other Union acts: trust service providers, for example, by reference to Regulation (EU) No 910/2014.

The Commission proposal COM(2026) 13 would change the Annex I entries on electricity producers, hydrogen, intelligent transport systems, healthcare, and digital wallets and submarine data infrastructure, and it is pending as of 23 October 2026. The current wording applies until an amending act is adopted, and the entity types of every annex point are listed under NIS2 sectors.

Annex II: What Its 7 Points List

Annex II, headed "Other critical sectors", lists 7 sectors in points 1 to 7: postal and courier services, waste management, manufacture, production and distribution of chemicals, production, processing and distribution of food, manufacturing, digital providers and research. An entity of an Annex II type is in scope under the size-cap rule when it qualifies as a medium-sized enterprise under the Annex to Recommendation 2003/361/EC or exceeds those ceilings (Article 2(1)).

COM(2026) 13 would rewrite the chemicals point by reference to the REACH Regulation. The proposal is pending as of 23 October 2026, so point 3 of Annex II keeps its 2022 wording.

Annex III: The Correlation Table to the Repealed Directive

Annex III maps each provision of Directive (EU) 2016/1148 to its counterpart in Directive (EU) 2022/2555, for example Article 25 to Article 41 and Annex II to Annex I. How scope and duties changed between the two acts is compared under NIS2 vs NIS1.

Further rows map Article 26 of the old Directive to Article 45 and Article 27 to Article 46, so the entry-into-force and addressee clauses line up as well. The table is a reading aid for national laws and contracts that still cite the old Directive: a reference to a 2016 provision is read as a reference to its row in Annex III.

How to Read a Provision of the Directive in 6 Steps

A provision of Directive (EU) 2022/2555 is read in six steps: find its chapter, check whom it addresses, read the Article 6 definitions it uses, read the recitals behind it, find the national provision that transposes it, and check the implementing acts, corrigenda and pending proposals that touch it. The six steps below follow the structure of the text, from Table 3 to the national law.

1. Locate the chapter in Table 3, because the chapter tells whether the provision concerns obligations (Chapter IV), jurisdiction (Chapter V) or supervision (Chapter VII).
2. Check the addressee in Table 4: a provision addressed to the Member States reaches an entity only through the national act.
3. Read the Article 6 definitions the provision uses, such as "incident" (point 6), "near miss" (point 5) or "managed service provider" (point 39).
4. Read the recitals behind the provision in Table 5 to see the reason the legislator gave.
5. Find the national provision that transposes it, using the reference to the Directive that Article 41(2) requires; in Germany, for example, § 32 BSIG carries the Article 23 reporting duty.
6. Check the implementing acts, the corrigenda and the pending proposals that touch the provision.

Step 6 matters most for Article 21 and Article 23. Commission Implementing Regulation (EU) 2024/2690 sets the technical requirements and the significant-incident criteria for the 11 entity types of that Regulation, such as cloud computing service providers and trust service providers, on the legal bases of Article 21(5), first subparagraph, and Article 23(11), second subparagraph; it has been in force and directly applicable since 7 November 2024. No Article 21(5) act exists for other entities as of 23 October 2026. The Commission guidelines on Article 3(4) and on Article 4(1) and (2), both published on 14 September 2023, are non-binding, and the requirements and thresholds are set out under Implementing Regulation (EU) 2024/2690.

Guides to Each Part of the Directive

Four guides take the text further: the dated timeline of the Directive, all 46 articles summarised, the 41 Article 6 definitions, and the pending amendments and the Article 40 review. Table 6 lists them in reading order, from the dates to the proposed changes.

Help can cover reading the Directive against your national law, a gap analysis or management training.

Status of the Text on 2026-10-23

As of 23 October 2026, Directive (EU) 2022/2555 stands as published on 27 December 2022, with corrigenda but no amending act, while the targeted amendment proposal COM(2026) 13 and the Digital Omnibus COM(2025) 837 are pending. The text itself is stable, and the open questions concern the national laws and the two proposals.

On the national side, the Commission sent letters of formal notice to 23 Member States on 28 November 2024 and reasoned opinions on 7 May 2025. On 8 July 2026 it decided to refer Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for failing to notify measures transposing NIS2, with a request for a lump sum and daily penalties (IP/26/1499). The national acts and their status are tracked in the NIS2 transposition tracker.

At EU level, the Commission proposed COM(2026) 13 (procedure 2026/0012(COD)) on 20 January 2026; the European Parliament procedure is at "Awaiting committee decision" as of 23 October 2026, with Markéta Gregorová (Greens/EFA) as ITRE rapporteur. The Commission estimates in press release IP/26/105 that the proposal would ease compliance for 28,700 companies, including 6,200 micro and small enterprises, but none of its changes would apply before an amending act is adopted and transposed. The Digital Omnibus COM(2025) 837 of 19 November 2025 (procedure 2025/0360(COD)) is pending as well, and Coreper agreed the Council negotiating mandate on 21 October 2026. Article 40 sets the next fixed date: the Commission reports on its review by 17 October 2027 and then every 36 months.

What the Legal Text Does Not Settle for an Organisation

The text of Directive (EU) 2022/2555 does not settle on its own whether an organisation is in scope, which authority supervises it or which national deadlines and fines apply: the national law decides each of these. The Directive gives the minimum content, and each Member State fills in the names, the channels and the amounts.

Does a Company Apply the Directive Text Directly?

No: the Directive is addressed to the Member States (Article 46) and reaches a company only through the national law that transposes it. What that national law requires step by step is set out under NIS2 compliance requirements, and a company cites the national act, not the Directive, when it documents its duties.

Which national law applies follows Article 26: as a rule the law of the Member State where the entity is established, for providers of public electronic communications networks or services the law of every Member State where they provide services, and for the 11 types of Article 26(1)(b), such as cloud computing service providers and online marketplaces, the law of the Member State of their main establishment in the Union. The one exception to national transposition is Implementing Regulation (EU) 2024/2690, which binds the 11 entity types of that Regulation directly. For every other entity, the Directive text explains the purpose of a national rule, and the national act sets the duty itself.

Which Other EU Acts Share the Same Official Journal Issue?

OJ L 333 of 27 December 2022 also carries DORA, Regulation (EU) 2022/2554, at p. 1 and the CER Directive, Directive (EU) 2022/2557, at p. 164. NIS2 and the CER Directive both entered into force on 16 January 2023, and DORA has applied since 17 January 2025.

DORA is lex specialis for financial entities under Article 4 of Directive (EU) 2022/2555: it displaces the NIS2 governance, measures, reporting and supervision rules (Articles 20, 21 and 23 and Chapter VII), while Articles 7, 9 and 16 still apply. Critical entities under the CER Directive are essential entities regardless of size (Article 3(1)(f)), and each overlap is compared under NIS2 and other laws and standards. Product security for hardware and software falls under the Cyber Resilience Act, Regulation (EU) 2024/2847, covered on cyberresilienceactguide.net.