As of 30 September 2026. Information only, not legal advice – see the disclaimer.
| Full title | Directive (EU) 2022/2555 (NIS2 Directive) and Directive (EU) 2022/2557 (Critical Entities Resilience Directive) |
|---|---|
| Type | EU directives |
| Adopted by | European Parliament and Council of the European Union |
| Adopted | 14 December 2022 |
| Legal status | In force since 16 January 2023; transposition deadline 17 October 2024; binding on Member States as to the result (require national transposition) |
| Official text | EUR-Lex (NIS2) · EUR-Lex (CER) |
| Subject area | Cybersecurity, cybercrime and critical infrastructure |
The NIS2 Directive sets measures for a high common level of cybersecurity across the Union. It replaces Directive (EU) 2016/1148 (NIS) and extends cybersecurity risk-management and incident-reporting obligations to “essential” and “important” entities in a wide range of sectors, including energy, transport, health, digital infrastructure and public administration. The CER Directive, adopted the same day, addresses the physical and non-cyber resilience of critical entities providing essential services. The two instruments are referred to in debates on the protection of critical infrastructure against cyber and hybrid threats.
The directives do not address attribution or State responsibility; they regulate preparedness, resilience and incident handling. They form part of the EU's internal framework alongside the external measures of the EU cyber sanctions regime and Cyber Diplomacy Toolbox.
Germany. The NIS2 Directive was transposed by the “Gesetz zur Umsetzung der NIS-2-Richtlinie und zur Regelung wesentlicher Grundzüge des Informationssicherheitsmanagements in der Bundesverwaltung” (NIS2UmsuCG) of 2 December 2025, promulgated in BGBl. 2025 I Nr. 301 on 5 December 2025; it entered into force on 6 December 2025 and substantially amends the BSI Act (BSIG). The CER Directive was transposed by the “Gesetz zur Umsetzung der Richtlinie (EU) 2022/2557 und zur Stärkung der Resilienz kritischer Anlagen” (KRITIS-Dachgesetz), of 11 March 2026, promulgated in BGBl. 2026 I Nr. 66 on 16 March 2026; according to the Federal Government it entered into force on 17 March 2026, with certain provisions applying from later dates.