{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Anis2%3Aart-21","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Anis2%3Aart-21)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-11-03","fingerprint":"ewai:eu:ea5c38","proof":"sha256:90120f545f3b1bc38c61d640a19e7e48c1cc375e85be36ced2592a16a8cad73e","jurisdiction":"eu"},"brand_source":"Source: NovaCopilot","object_type":"article_agent","schema_version":"1.0.0","id":"agent:eu:nis2:art-21","act":"nis2-2022-2555","article":"21","text_sha256":"efe0d2d2db42e8851dacd7c46da6d4d42fe8d54a004374f591d69c7b3575caf8","obligations":["obligation:eu:nis2-2022-2555-art-21-essential-entity"],"agent":"agent:eu:nis2","name":"NovaCopilot NIS2 Agent, Article 21","title":{"en":"Cybersecurity risk-management measures","sv":"Riskhanteringsåtgärder för cybersäkerhet","de":"Risikomanagementmaßnahmen im Bereich der Cybersicherheit"},"text":{"lang":"en","paragraphs":["1. Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems which those entities use for their operations or for the provision of their services, and to prevent or minimise the impact of incidents on recipients of their services and on other services.","Taking into account the state-of-the-art and, where applicable, relevant European and international standards, as well as the cost of implementation, the measures referred to in the first subparagraph shall ensure a level of security of network and information systems appropriate to the risks posed. …","2. The measures referred to in paragraph 1 shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following:","(a)","policies on risk analysis and information system security;","(b)","incident handling;","(c)","business continuity, such as backup management and disaster recovery, and crisis management;","(d)","supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers;","(e)","security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure;","(f)"],"source_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A32022L2555","read_at":"2026-08-18"},"sha256":"824da319b6eae53f5cb9a33195e8ea047b1e59ea9423f089b066b52e3e9ce290","duties":[{"id":"obligation:eu:nis2-2022-2555-art-21-essential-entity","role":"essential-entity","duty":"Take appropriate cybersecurity risk-management measures."}],"applies_to_role":{"status":"verified","roles":["essential-entity"],"entity_types":[]},"applies_to_industry":{"status":"not_in_register","industries":[]},"cross_industry_chains":{"status":"verified","shape":"rule → obligation → control → industry","chains":[{"id":"chain:nis2~nis2-art.-21","rule":"nis2","obligation":"Cybersecurity risk-management measures","control":"NIS2 art. 21","industries":["energy","financial-services","healthcare","industrials","technology"]}]},"revenue_exposure":{"status":"verified","sanction_article":"34","source_url":"https://eur-lex.europa.eu/eli/dir/2022/2555/oj","tiers":[{"article":"34(4)","basis":"min_of_max","percent_worldwide_turnover":2,"fixed_eur":10000000,"rule":"higher","applies_to":"essential_entities"},{"article":"34(5)","basis":"min_of_max","percent_worldwide_turnover":1.4,"fixed_eur":7000000,"rule":"higher","applies_to":"important_entities"}],"via":"article 34"},"links":{"article_page":"https://legal.exploreworldai.com/eu/rattsakter/nis2-2022-2555/artikel-21","regulation_agent":"https://legal.exploreworldai.com/api/public/v1/article-agents?reg=nis2","changes":"https://legal.exploreworldai.com/api/public/v1/intelligence-graph/change?reg=nis2"},"llm_used":false,"hash":"sha256:90120f545f3b1bc38c61d640a19e7e48c1cc375e85be36ced2592a16a8cad73e","version":"legal-2026-11-03","expires":"2026-11-04T00:00:00.000Z","dependency":{"index_version":"legal-2026-11-03+legal-2026-11-03+2026-11-03T08:46:54","content_hash":"sha256:90120f545f3b1bc38c61d640a19e7e48c1cc375e85be36ced2592a16a8cad73e","revalidate_after":"2026-11-03T09:58:01.679Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Anis2%3Aart-21","disclaimer":"Källhänvisning med officiell identifierare. Ingen juridisk rådgivning och inget efterlevnadsbeslut.","content_notice":{"legal_advice":false,"nature":"Källregister. Endast information, inte juridisk rådgivning och ingen bedömning av ett enskilt ärende.","kinds":{"official_text":"Officiell källtext, ordagrann och ej tolkad","summary":"Sammanfattning, ej juristgranskad. Läs alltid källtexten","classification":"Automatisk märkning ur källans egen text, ej juristgranskad"},"rule":"Endast fält märkta official_text är lagens egen lydelse. Allt annat pekar på den.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/article-agent","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"access_class":"public","access_view":"public","freshness":{"freshness_class":"live","as_of":"2026-11-03T08:58:02.067Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Anis2%3Aart-21","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":1743}}