Article 13Cooperation at national level
1. Where they are separate, the competent authorities, the single point of contact and the CSIRTs of the same Member State shall cooperate with each other with regard to the fulfilment of the obligations laid down in this Directive.
2. Member States shall ensure that their CSIRTs or, where applicable, their competent authorities, receive notifications of significant incidents pursuant to Article 23, and incidents, cyber threats and near misses pursuant to Article 30.
3. Member States shall ensure that their CSIRTs or, where applicable, their competent authorities inform their single points of contact of notifications of incidents, cyber threats and near misses submitted pursuant to this Directive.
4. In order to ensure that the tasks and obligations of the competent authorities, the single points of contact and the CSIRTs are carried out effectively, Member States shall, to the extent possible, ensure appropriate cooperation between those bodies and law enforcement authorities, data protection authorities, the national authorities under Regulations (EC) No 300/2008 and (EU) 2018/1139, the supervisory bodies under Regulation (EU) No 910/2014, the competent authorities under Regulation (EU) 2022/2554, the national regulatory authorities under Directive (EU) 2018/1972, the competent authorities under Directive (EU) 2022/2557, as well as the competent authorities under other sector-specific Union legal acts, within that Member State.
5. Member States shall ensure that their competent authorities under this Directive and their competent authorities under Directive (EU) 2022/2557 cooperate and exchange information on a regular basis with regard to the identification of critical entities, on risks, cyber threats, and incidents as well as on non-cyber risks, threats and incidents affecting entities identified as critical entities under Directive (EU) 2022/2557, and the measures taken in response to such risks, threats and incidents. Member States shall also ensure that their competent authorities under this Directive and their competent authorities under Regulation (EU) No 910/2014, Regulation (EU) 2022/2554 and Directive (EU) 2018/1972 exchange relevant information on a regular basis, including with regard to relevant incidents and cyber threats.
6. Member States shall simplify the reporting through technical means for notifications referred to in Articles 23 and 30.
NIS2, the European Union directive on network and information security, Article 13
Cooperation inside a Member State. Where they are separate bodies, the competent authorities, the single point of contact and the CSIRTs must cooperate on the obligations in this Directive. CSIRTs, or competent authorities where applicable, receive significant-incident notifications under Article 23 and incident, cyber threat and near-miss notifications under Article 30, and inform the single point of contact of notifications submitted under the Directive. Member States must, to the extent possible, ensure cooperation with law enforcement, data protection authorities, aviation security and trust-service supervisory bodies, DORA and CER Directive authorities, communications regulators and other sector authorities. Competent authorities under NIS2 and under the CER Directive, and those under eIDAS, DORA and the Electronic Communications Code, exchange information regularly.
Paragraph 6 requires Member States to simplify reporting through technical means for Article 23 and 30 notifications, so national reporting portals matter in practice.
The consequence for an entity: a notification is not private to the body that receives it. It is shared by design with other authorities, such as the single point of contact, and, for critical entities, the CER Directive authorities (Article 23(10)). Whether a personal data breach triggers separate GDPR duties is a separate question. Article 35 covers only the supervisory side: competent authorities that find an infringement of Articles 21 and 23 may entail a personal data breach inform the data protection authorities, and do not fine under Article 34 for conduct already fined under the GDPR.
Text: Directive (EU) 2022/2555, OJ L 333, 27.12.2022, p. 80, as corrected by Corrigendum OJ L, 2023/90206, 22.12.2023 (Article 19(1): “by 17 January 2025”, replacing “on”), from EUR-Lex. Only the Official Journal text is authentic.