Article 31General aspects concerning supervision and enforcement
1. Member States shall ensure that their competent authorities effectively supervise and take the measures necessary to ensure compliance with this Directive.
2. Member States may allow their competent authorities to prioritise supervisory tasks. Such prioritisation shall be based on a risk-based approach. To that end, when exercising their supervisory tasks provided for in Articles 32 and 33, the competent authorities may establish supervisory methodologies allowing for a prioritisation of such tasks following a risk-based approach.
3. The competent authorities shall work in close cooperation with supervisory authorities under Regulation (EU) 2016/679 when addressing incidents resulting in personal data breaches, without prejudice to the competence and tasks of the supervisory authorities under that Regulation.
4. Without prejudice to national legislative and institutional frameworks, Member States shall ensure that, in the supervision of compliance of public administration entities with this Directive and the imposition of enforcement measures with regard to infringements of this Directive, the competent authorities have appropriate powers to carry out such tasks with operational independence vis-à-vis the public administration entities supervised. Member States may decide on the imposition of appropriate, proportionate and effective supervisory and enforcement measures in relation to those entities in accordance with the national legislative and institutional frameworks.
NIS2, the European Union directive on network and information security, Article 31
The frame for supervision. Member States must ensure that their competent authorities supervise effectively and take the measures needed to secure compliance with the Directive. They may allow authorities to prioritise supervisory tasks, but any prioritisation must follow a risk-based approach; authorities may build supervisory methodologies for this when using the powers in Articles 32 and 33.
Authorities must work closely with the data protection supervisory authorities under the GDPR when dealing with incidents that result in personal data breaches, without affecting those authorities’ own competence and tasks.
For public administration entities, Member States must ensure authorities have appropriate powers and operational independence from the bodies they supervise. Within their own legal and institutional frameworks, States decide which supervisory and enforcement measures apply to those entities.
Text: Directive (EU) 2022/2555, OJ L 333, 27.12.2022, p. 80, as corrected by Corrigendum OJ L, 2023/90206, 22.12.2023 (Article 19(1): “by 17 January 2025”, replacing “on”), from EUR-Lex. Only the Official Journal text is authentic.