{
  "attribution": {
    "source": "legal.exploreworldai.com",
    "canonical": "https://legal.exploreworldai.com/api/public/v1/nis2-agent/art-20-21",
    "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/nis2-agent/art-20-21)",
    "license": "https://legal.exploreworldai.com/revision",
    "version": "legal-2026-10-13",
    "fingerprint": "ewai:se:c958a4",
    "proof": "sha256:2da4da2a276ff843efdc0774d9b78a904815313c1b6c91875b02b52dcb98cacd",
    "jurisdiction": "se",
    "lang": "en"
  },
  "brand_source": "Source: NovaCopilot",
  "status": "ok",
  "agent_id": "agent:eu:nis2:agent-nis2-art-20-21",
  "agent_version": "1",
  "schema_version": "1",
  "graph_version": "2026-10-10.1",
  "section": "NIS2 art. 20 och 21, direktiv (EU) 2022/2555",
  "title": "NIS2 Art. 20–21 Governance and Cybersecurity Risk Measures Agent",
  "question": "What must our management body and security programme do under NIS2?",
  "applies_from": "2024-10-18",
  "requirements": [
    {
      "id": "requirement:eu:nis2:art-20-1",
      "provision": "Art. 20(1)",
      "title": "Management body approves and oversees risk measures and can be held liable (summary)",
      "verbatim": false
    },
    {
      "id": "requirement:eu:nis2:art-20-2",
      "provision": "Art. 20(2)",
      "title": "Mandatory cybersecurity training for the management body (summary)",
      "verbatim": false
    },
    {
      "id": "requirement:eu:nis2:art-21-1",
      "provision": "Art. 21(1)",
      "title": "Appropriate and proportionate risk-management measures (summary)",
      "verbatim": false
    },
    {
      "id": "requirement:eu:nis2:art-21-2",
      "provision": "Art. 21(2)(a)–(j)",
      "title": "Ten minimum security measures (summary)",
      "verbatim": false
    },
    {
      "id": "requirement:eu:nis2:art-21-2-d",
      "provision": "Art. 21(2)(d) and 21(3)",
      "title": "Supply chain security and supplier assessment (summary)",
      "verbatim": false
    }
  ],
  "deadlines": {
    "applies_from": "2024-10-18",
    "transposition": "national law",
    "provision": "Art. 41"
  },
  "sanctions": [
    {
      "key": "art-34-4-essential",
      "label": "Fines for essential entities (Art. 34(4))",
      "provision": "Art. 34(4)",
      "authority": "National competent authorities",
      "max_eur_at_least": 10000000,
      "max_share_of_worldwide_turnover_at_least": 0.02,
      "rule": "maximum of at least the higher of the two, set in national law",
      "id": "sanction:eu:nis2:art-34-4-essential"
    },
    {
      "key": "art-34-5-important",
      "label": "Fines for important entities (Art. 34(5))",
      "provision": "Art. 34(5)",
      "authority": "National competent authorities",
      "max_eur_at_least": 7000000,
      "max_share_of_worldwide_turnover_at_least": 0.014,
      "rule": "maximum of at least the higher of the two, set in national law",
      "id": "sanction:eu:nis2:art-34-5-important"
    },
    {
      "key": "art-32-5-management-ban",
      "label": "Temporary ban on management functions for essential entities (Art. 32(5))",
      "provision": "Art. 32(5)(b)",
      "authority": "National competent authorities",
      "measure": "temporary prohibition of a natural person discharging managerial responsibilities at CEO or legal representative level",
      "id": "sanction:eu:nis2:art-32-5-management-ban"
    }
  ],
  "cases": [],
  "counts": {
    "requirements": 5,
    "controls": 3,
    "cases": 0
  },
  "deterministic": true,
  "agent_hash": "e98c76e5a419c1a31420aabf4c0869b459ab612d2c191ea0c2a2013e25e05af5",
  "hash": "sha256:2da4da2a276ff843efdc0774d9b78a904815313c1b6c91875b02b52dcb98cacd",
  "case_note": "No NIS2 sanction decision with an official public source is in the register yet; status not_in_register. Decisions are linked automatically at /api/public/v1/act-decisions/nis2 once they are read in.",
  "scope": {
    "entities": [
      "energy",
      "transport",
      "banking",
      "financial market infrastructures",
      "health",
      "drinking water",
      "waste water",
      "digital infrastructure",
      "ICT service management (B2B)",
      "public administration",
      "space",
      "postal and courier services",
      "waste management",
      "chemicals",
      "food",
      "manufacturing",
      "digital providers",
      "research"
    ],
    "provision": "Art. 2, Annex I and II",
    "note": "Medium-sized and large entities in Annex I and II sectors. For financial entities DORA applies as sector-specific law (Art. 4); national transposition decides the exact thresholds and fines."
  },
  "endpoints": {
    "self": "https://legal.exploreworldai.com/api/public/v1/nis2-agent/art-20-21",
    "node": "https://legal.exploreworldai.com/api/public/v1/node/agent/agent%3Aeu%3Anis2%3Aagent-nis2-art-20-21",
    "page": "https://legal.exploreworldai.com/agent/nis2/art-20-21",
    "nodes": "https://legal.exploreworldai.com/graf/nis2",
    "decisions": "https://legal.exploreworldai.com/api/public/v1/act-decisions/nis2",
    "regulation": "https://eur-lex.europa.eu/eli/dir/2022/2555/oj"
  },
  "not_covered": {
    "other_articles": "Art. 24 certification schemes, Art. 27 registry and Art. 31–33 supervision are not_in_register for these agents."
  },
  "provenance": {
    "primary_source": "https://eur-lex.europa.eu/eli/dir/2022/2555/oj",
    "read_at": "2026-10-10",
    "method": "verbatim EUR-Lex text where verbatim = true; editorial control and cross-framework mapping (unreviewed)"
  },
  "source": "Source: NovaCopilot",
  "version": "legal-2026-10-13",
  "expires": "2026-10-14T00:00:00.000Z",
  "dependency": {
    "index_version": "legal-2026-10-13+legal-2026-10-13+2026-10-13T09:02:41",
    "content_hash": "sha256:2da4da2a276ff843efdc0774d9b78a904815313c1b6c91875b02b52dcb98cacd",
    "revalidate_after": "2026-10-13T10:10:55.445Z",
    "max_copy_age_seconds": 3600,
    "policy": "revalidate-required; attribution-preferred",
    "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency",
    "verify": "https://legal.exploreworldai.com/api/public/v1/verify",
    "stale_copy_invalid": true
  },
  "canonical": "https://legal.exploreworldai.com/api/public/v1/nis2-agent/art-20-21",
  "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.",
  "content_notice": {
    "legal_advice": false,
    "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.",
    "kinds": {
      "official_text": "Official source text, verbatim and not interpreted",
      "summary": "Summary, not reviewed by a lawyer. Always read the source text",
      "classification": "Automatic label from the source's own text, not reviewed by a lawyer"
    },
    "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.",
    "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections",
    "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"
  },
  "usageInfo": "https://legal.exploreworldai.com/citering",
  "withheld": {
    "control_mappings": 3
  },
  "access": {
    "status": "partner_key_required",
    "header": "x-partner-key",
    "contact": "https://legal.exploreworldai.com/kontakt",
    "note": "Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."
  },
  "access_class": "decision",
  "access_view": "public"
}