الصفحة الرئيسية › مكتبة القوانين › NIS2
EU
NIS2
Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2 Directive)
مؤكَّد من مصدرين. آخر تحقق 10 أكتوبر 2026
موعد المراجعة الكاملة التالية: . نتابع أخبار الجهات الرقابية شهريًا، وتُسجَّل التغييرات في سجل التغييرات.
الاستشهاد بهذه الصفحة: GlanceDesk Jurisdiction, “NIS2 (European Union)”, glancedeskjurisdiction.com/laws/eu-nis2, last verified 10 October 2026.
European Union الأمن السيبراني
- الحالة
- In force since 16 Jan 2023; transposition deadline 17 Oct 2024 (NIS1 repealed 18 Oct 2024). Applies via national laws.✓
- على من ينطبق
- Medium and large public/private entities in Annex I (high-criticality) and Annex II (other critical) sectors providing services in the EU; some (e.g. DNS, TLD registries, trust services, telecoms) regardless of size. Non-EU digital providers must appoint an EU representative.✓
- حدود الحجم
- Size-cap rule: medium or large enterprises under Recommendation 2003/361/EC — 50+ staff, or annual turnover and balance-sheet total both above EUR 10m (partner and linked enterprises aggregated). Large entities in Annex I are usually 'essential'; others 'important'. Some sectors (e.g. DNS, trust services, public administration) are covered regardless of size.✓
- الجهة الرقابية
- National competent authorities and CSIRTs in each Member State; ENISA and the NIS Cooperation Group at EU level✓
- الإبلاغ عن الخروقات أو الحوادث
- Significant incidents to CSIRT/authority: early warning within 24h, incident notification within 72h, final report within 1 month of the notification. Inform service recipients where relevant.✓
- مسؤول حماية البيانات
- No named officer, but management bodies must approve and oversee cybersecurity measures, take training, and can be held personally liable.✓
- الممثل المحلي
- Certain non-EU digital providers (e.g. cloud, DNS, online marketplaces, search, social platforms) offering services in the EU must designate an EU representative by written mandate.✓
- أقصى عقوبة
- Essential entities: maximum of at least EUR 10m or 2% of worldwide turnover; important entities: at least EUR 7m or 1.4% (whichever higher). National caps may be higher.✓
المعلومات الموسومة بعبارة «قيد التحقق» لا تزال قيد التأكيد ولا تُقدَّم كإجابات.
ما يجب عليك فعله✓
- Check whether your sector (Annex I/II) and size bring you into scope; register with the national authority.
- Have management approve cybersecurity risk measures and complete training.
- Implement Art 21 measures: risk analysis, incident handling, backups, MFA, encryption, supply-chain security.
- Set up a process to send 24h early warnings and 72h notifications of significant incidents.
- Assess security of suppliers and service providers.
- Follow the national transposition law in each country where you operate.
التغييرات الأخيرة
On 8 Jul 2026 the Commission referred Ireland, Spain, France and the Netherlands to the CJEU for late transposition; the Netherlands' law then took effect on 15 Aug 2026. Commission proposed targeted NIS2 simplifications on 20 Jan 2026 (pending).✓
المصادر
- المصدر الأساسي: https://digital-strategy.ec.europa.eu/en/policies/nis2-directive
- المصدر الثاني: https://www.twobirds.com/en/insights/2025/understanding-key-eu-cybersecurity-legislative-acts-nis2,-cer,-and-cra
- الجهة الرقابية: National competent authorities and CSIRTs in each Member State; ENISA and the NIS Cooperation Group at EU level
المصادر المستخدمة في التحقق المستقل (16)
- https://digital-strategy.ec.europa.eu/en/policies/nis2-directive
- https://oeil.europarl.europa.eu/oeil/en/document-summary?id=1728967
- https://cm.twobirds.com/-/media/new-website-content/pdfs/trending-topics/nis2-flyer.pdf
- https://ncsc.gov.ie/pdfs/NIS2_NCSC_Conference_2024_Slides.pdf
- https://rgpd.com/nis2-directive/chapter-1-general-provisions/article-3-essential-and-important-entities
- https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022L2555
- https://www.insideprivacy.com/data-security/cybersecurity/european-commission-proposes-targeted-amendments-to-nis2-to-simplify-compliance-and-align-with-proposed-cybersecurity-act-2/
- https://www.ncsc.gov.ie/pdfs/NCSC_NIS2_4_INCIDENT.pdf
- https://www.williamfry.com/knowledge/nis2-understanding-cybersecurity-incident-notifications/
- https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32022L2555
- https://rgpd.com/nis2-directive/chapter-5-jurisdiction-and-registration/article-26-jurisdiction-and-territoriality
- https://www.ncsc.gov.ie/pdfs/NCSC_NIS2_7_ENFORCEMENT.pdf
- https://rgpd.com/nis2-directive/chapter-7-supervision-and-enforcement/article-34-general-conditions-for-imposing-administrative-fines-on-essential-and-important-entities
- https://digital-strategy.ec.europa.eu/en/news/commission-refers-ireland-spain-france-and-netherlands-court-justice-failing-transpose-rules
- https://www.rijksoverheid.nl/actueel/nieuws/2026/08/15/cyberbeveiligingswet-en-wet-weerbaarheid-kritieke-entiteiten-vanaf-vandaag-van-kracht
- https://nisd2.eu/en/wiki/timelines-and-status/nis2-eu-tracker
= مؤكَّد من مصدرين مستقلين، أحدهما على الأقل رسمي. كيف نتحقق
معلومات فقط، وليست استشارة قانونية. القوانين تتغير؛ تحقّق مع الجهة الرقابية أو محامٍ مؤهل قبل الاعتماد على هذه الصفحة. هل لاحظت خطأ؟ راسلنا على contact@