My favourites

Chapter VII – Supervision and enforcement (Art. 31-37)

Art. 31 NIS2 - General aspects concerning supervision and enforcement arrow_right_alt

Art. 32 NIS2 - Supervisory and enforcement measures in relation to essential entities arrow_right_alt

Art. 33 NIS2 - Supervisory and enforcement measures in relation to important entities arrow_right_alt

Art. 34 NIS2 - General conditions for imposing administrative fines on essential and important entities arrow_right_alt

Art. 35 NIS2 - Infringements entailing a personal data breach arrow_right_alt

Art. 36 NIS2 - Penalties arrow_right_alt

Art. 37 NIS2 - Mutual assistance arrow_right_alt

  1. Where an entity provides services in more than one Member State, or provides services in one or more Member States and its network and information systems are located in one or more other Member States, the competent authorities of the Member States concerned shall cooperate with and assist each other as necessary. That cooperation shall entail, at least, that:
    1. the competent authorities applying supervisory or enforcement measures in a Member State shall, via the single point of contact, inform and consult the competent authorities in the other Member States concerned on the supervisory and enforcement measures taken;
    2. a competent authority may request another competent authority to take supervisory or enforcement measures;
    3. a competent authority shall, upon receipt of a substantiated request from another competent authority, provide the other competent authority with mutual assistance proportionate to its own resources so that the supervisory or enforcement measures can be implemented in an effective, efficient and consistent manner.

The mutual assistance referred to in the first subparagraph, point (c), may cover information requests and supervisory measures, including requests to carry out on-site inspections or off-site supervision or targeted security audits. A competent authority to which a request for assistance is addressed shall not refuse that request unless it is established that it does not have the competence to provide the requested assistance, the requested assistance is not proportionate to the supervisory tasks of the competent authority, or the request concerns information or entails activities which, if disclosed or carried out, would be contrary to the essential interests of the Member State’s national security, public security or defence. Before refusing such a request, the competent authority shall consult the other competent authorities concerned as well as, upon the request of one of the Member States concerned, the Commission and ENISA.

  1. Where appropriate and with common agreement, the competent authorities of various Member States may carry out joint supervisory actions.
Close tabsclose
  • 134
  • 135

Recital 134

For the purpose of ensuring entities’ compliance with their obligations laid down in this Directive, Member States should cooperate with and assist each other with regard to supervisory and enforcement measures, in particular where an entity provides services in more than one Member State or where its network and information systems are located in a Member State other than that where it provides services. When providing assistance, the requested competent authority should take supervisory or enforcement measures in accordance with national law. In order to ensure the smooth functioning of mutual assistance under this Directive, the competent authorities should use the Cooperation Group as a forum to discuss cases and particular requests for assistance.

Recital 135

In order to ensure effective supervision and enforcement, in particular in a situation with a cross-border dimension, a Member State that has received a request for mutual assistance should, within the limits of that request, take appropriate supervisory and enforcement measures in relation to the entity that is the subject of that request, and that provides services or has a network and information system on the territory of that Member State.