EdLaw
NIS2 Directive (Directive (EU) 2022/2555)
The EU's horizontal cybersecurity law for critical and important sectors, published in the Official Journal on 27 December 2022 (OJ L 333, 27.12.2022, p. 80), in force since 16 January 2023, with Member State transposition due by 17 October 2024 (Art. 41, not extracted; see Sources). It replaced the original NIS Directive (EU) 2016/1148. This folder reproduces the consolidated text 02022L2555-20221227.
Scope is sector-plus-size: entities in the Annex I/II sectors that meet or exceed the medium-sized-enterprise ceiling (Art. 2(1)), plus categorical inclusions regardless of size (Art. 2(2)–(4)), split into essential and important entities (Art. 3).
Applicability to EdTech
- Education is not a listed sector — schools and EdTech vendors are typically not NIS2 entities as such. The realistic routes in are Annex I point 8 (digital infrastructure), point 9 (ICT service management, B2B) and Annex II point 6 (digital providers) — read the actual entry definitions before assuming cloud-hosted EdTech qualifies (e.g. "cloud computing service" is defined at Art. 6(30)).
- NIS2 reaches suppliers through customers: in-scope entities must address "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers" (Art. 21(2)(d)) — which is why NIS2-derived security schedules now appear in school-ministry and public-sector procurement even where the school itself is out of scope. The ten-point minimum measure list of Art. 21(2) is the checklist those schedules copy.
- Incident-reporting ladder (Art. 23(4)): early warning within 24 hours, incident notification within 72 hours, final report within one month — timings that flow down contractually to subprocessors.
- Public administration entities are in scope (Art. 2(2)(f), Annex I point 10 public administration), so ministries and regional education authorities running national platforms may themselves be NIS2 entities imposing flow-down terms.
Contents
| Document | Covers |
|---|---|
| SCOPE-AND-ENTITIES.md | Arts. 1–3 — subject matter, scope and size-cap, essential vs important entities |
| DEFINITIONS.md | Art. 6 — definitions |
| RISK-MANAGEMENT-AND-REPORTING.md | Arts. 21, 23 — the minimum measures and the reporting ladder |
| SECTORS.md | Annexes I–II — sectors of high criticality and other critical sectors |
Scope note: governance (Art. 20), registration (Art. 27), jurisdiction (Art. 26), supervision and the fine regimes for essential/important entities (Arts. 31–37) and the cooperation machinery can be added with the same tooling when needed.
Key obligations at a glance
- In-scope entities take "appropriate and proportionate technical, operational and organisational measures" on an all-hazards basis (Art. 21(1)), covering at minimum the ten Art. 21(2) areas.
- Significant incidents: 24h early warning → 72h notification → one-month final report (Art. 23(4)); recipients also notified where appropriate (Art. 23(1)–(2)).
Enforcement
National competent authorities; supervision is ex ante + ex post for essential entities and ex post for important entities, with administrative fines whose national maxima must be at least EUR 10m or 2% of total worldwide annual turnover, whichever is higher (essential entities, Art. 34(4)) and at least EUR 7m or 1,4% (important entities, Art. 34(5)) for Art. 21/23 infringements — Art. 34 is not extracted; wording verified against the consolidated text 2026-09-06.
Licence
The corpus reproduces the EUR-Lex consolidated text of Directive (EU) 2022/2555 (CELEX 02022L2555-20221227).
The EUR-Lex legal notice (eur-lex.europa.eu/content/legal-notice/legal-notice.html, read 2026-10-01 in the Internet Archive copy captured that day, because EUR-Lex refuses non-browser clients) says: "© European Union, 1998-2026 The Commission’s document reuse policy is based on Decision 2011/833/EU. Unless otherwise specified, you can re-use the legal documents published in EUR-Lex for commercial or non-commercial purposes." For consolidated texts it adds: "The copyright for the editorial content of this website, the summaries of EU legislation and the consolidated texts, which is owned by the EU, is licensed under the Creative Commons Attribution 4.0 International licence. This means that you can re-use the content provided you acknowledge the source and indicate any changes you have made."
Commission Decision 2011/833/EU on the reuse of Commission documents (OJ L 330, 14.12.2011, p. 39, read in the Publications Office Cellar copy on 2026-10-01) provides in Article 4 that "All documents shall be available for reuse: (a) for commercial or non-commercial purposes under the conditions laid down in Article 6", and Article 6(2) lists the conditions that may be attached: "(a) the obligation for the reuser to acknowledge the source of the documents; (b) the obligation not to distort the original meaning or message of the documents; (c) the non-liability of the Commission for any consequence stemming from the reuse."
Conditions, and how this corpus meets them:
- Acknowledge the source: each extracted provision carries a
{.meta}provenance line naming EUR-Lex and the CELEX number, and Sources links the EUR-Lex text. - Indicate changes (CC BY 4.0, for the consolidated text): the provision text is unchanged; the changes are the selection of provisions, the Markdown layout and the added anchors, all described in Meta.
- Do not distort the meaning: the text is reproduced verbatim and checked mechanically against the source (see Meta).
- No endorsement or liability: the corpus does not claim that the EU or the Publications Office endorses it, and only the Official Journal text is authentic.
The ENISA page listed in Sources is cited, not reproduced.
Related
- EU GDPR — parallel breach-notification duties; NIS2 incident reporting does not displace personal-data-breach notification
- EU AI Act — Art. 21-style security schedules increasingly reference both in procurement