Article 38Exercise of the delegation
1. The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article.
2. The power to adopt delegated acts referred to in Article 24(2) shall be conferred on the Commission for a period of five years from 16 January 2023.
3. The delegation of power referred to in Article 24(2) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.
4. Before adopting a delegated act, the Commission shall consult experts designated by each Member State in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making.
5. As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council.
6. A delegated act adopted pursuant to Article 24(2) shall enter into force only if no objection has been expressed either by the European Parliament or by the Council within a period of two months of notification of that act to the European Parliament and to the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by two months at the initiative of the European Parliament or of the Council.
NIS2, the European Union directive on network and information security, Article 38
This article sets the conditions for the Commission’s power to adopt delegated acts under Article 24(2): acts specifying which categories of essential and important entities must use certain certified ICT products, services and processes, or obtain a certificate under a European cybersecurity certification scheme. Article 24(2) adds that such acts are for cases where insufficient levels of cybersecurity have been identified, must include an implementation period, and follow an impact assessment.
The power is conferred for five years from 16 January 2023; the article contains no provision for renewing it. The Parliament or the Council may revoke it at any time, without affecting acts already in force. The Commission must consult experts designated by each Member State before adopting an act, and notify it to both institutions at once. An act enters into force only if neither objects within two months of notification (extendable by two months), or both say earlier that they will not object.
This is institutional machinery. Its practical significance is that a certification requirement for a category of entities could be set by delegated act rather than by amending the Directive.
Text: Directive (EU) 2022/2555, OJ L 333, 27.12.2022, p. 80, as corrected by Corrigendum OJ L, 2023/90206, 22.12.2023 (Article 19(1): “by 17 January 2025”, replacing “on”), from EUR-Lex. Only the Official Journal text is authentic.