Legal sources with official primary sources

Printed ·

Skip to main content
Skip to the answer
NovaCopilotA service from ExploreWorldAI

Source status and reading dates are reported separately. A reading date is not source verification.

Back to the act

EU regulatory register · NIS2

Article 40Review

CELEX 32022L2555 · Read on 2026-08-18 · Chapter IX

Share this page

Short answer

By 17 October 2027 and every 36 months thereafter, the Commission shall review the functioning of this Directive, and report to the European Parliament and to the Council.

Verbatim from the article. Source: NovaCopilot · https://legal.exploreworldai.com/eu/rattsakter/nis2-2022-2555/artikel-40 · Short answer as data · Official text

NIS2, cybersecurity in short

Essential and important entities must take security measures, report significant incidents within 24 hours, and management is personally accountable.

Source: NovaCopilot

Official text

Read from the EU Publications Office for this CELEX number. The wording stands as published; nothing here is rewritten or summarised.

By 17 October 2027 and every 36 months thereafter, the Commission shall review the functioning of this Directive, and report to the European Parliament and to the Council. The report shall in particular assess the relevance of the size of the entities concerned, and the sectors, subsectors and types of entity referred to in Annexes I and II for the functioning of the economy and society in relation to cybersecurity. To that end and with a view to further advancing the strategic and operational cooperation, the Commission shall take into account the reports of the Cooperation Group and the CSIRTs network on the experience gained at a strategic and operational level. The report shall be accompanied, where necessary, by a legislative proposal.

Open the article on EUR-Lex

Follow-up questions

Other articles in this chapter

The text is quoted from the official source and is not legal advice. A national court reads the language version that binds in its jurisdiction.

Verifiable trust signals

  • Source-linked answers and explicit evidence gaps
  • Obligations, controls, risks and consequences
  • Stable objects and verifiable checksums
  • Rule-based objects, optional source-linked reasoning
  • Model card, source status and audit

Model cardAudit