Article 4Sector-specific Union legal acts
1. Where sector-specific Union legal acts require essential or important entities to adopt cybersecurity risk-management measures or to notify significant incidents and where those requirements are at least equivalent in effect to the obligations laid down in this Directive, the relevant provisions of this Directive, including the provisions on supervision and enforcement laid down in Chapter VII, shall not apply to such entities. Where sector-specific Union legal acts do not cover all entities in a specific sector falling within the scope of this Directive, the relevant provisions of this Directive shall continue to apply to the entities not covered by those sector-specific Union legal acts.
2. The requirements referred to in paragraph 1 of this Article shall be considered to be equivalent in effect to the obligations laid down in this Directive where:
(a) cybersecurity risk-management measures are at least equivalent in effect to those laid down in Article 21(1) and (2); or
(b) the sector-specific Union legal act provides for immediate access, where appropriate automatic and direct, to the incident notifications by the CSIRTs, the competent authorities or the single points of contact under this Directive and where requirements to notify significant incidents are at least equivalent in effect to those laid down in Article 23(1) to (6) of this Directive.
3. The Commission shall, by 17 July 2023, provide guidelines clarifying the application of paragraphs 1 and 2. The Commission shall review those guidelines on a regular basis. When preparing those guidelines, the Commission shall take into account any observations of the Cooperation Group and ENISA.
NIS2, the European Union directive on network and information security, Article 4
A carve-out for entities already covered by other Union law. Where a sector-specific Union act requires essential or important entities to adopt cybersecurity risk-management measures or to notify significant incidents, and those requirements are at least equivalent in effect to this Directive’s, the relevant provisions of the Directive, including supervision and enforcement under Chapter VII, do not apply to them.
Equivalence has a defined test. Either the risk-management measures are at least equivalent in effect to Article 21(1) and (2), or the sector act gives CSIRTs, competent authorities or single points of contact immediate access (where appropriate automatic and direct) to incident notifications and its notification requirements are at least equivalent to Article 23(1) to (6).
Two points. The disapplication is of “relevant provisions”, not of the whole Directive. And a sector act that does not cover every entity of a sector leaves this Directive applying to those it misses. Article 4(3) required the Commission to provide guidelines clarifying paragraphs 1 and 2 by 17 July 2023.
For financial entities, DORA Article 1(2) provides that DORA is a sector-specific Union legal act for the purposes of this Article, and recital 28 of this Directive states that DORA’s rules apply instead of its own on risk management, incident reporting, supervision and enforcement for financial entities covered by DORA.
What is in the packs for this
Each one helps with this requirement.
NIS2 Scope & Entity Classification AssessmentExcel
in NIS2 Implementation & Readiness
Question SQ-09 asks whether a sector-specific EU act, such as DORA for financial entities, sets duties at least equivalent to NIS2's, and the Result records the answer.
Security Incident Management PolicyWord
in Security Incident Management
The regulated-entity tailoring explains that for a financial entity DORA's reporting replaces NIS2's, and the reporting screen IM-06 is where the choice is made.
EU Incident Notification Timeline Matrix (NIS2, DORA, GDPR)Excel
in Regulatory Incident Notification & Reporting
The instructions for financial entities show where DORA's reporting takes the place of NIS2's, and the matrix sets the two timelines side by side.
DORA Proportionality & Scope AssessmentExcel
in DORA ICT Risk & Resilience Readiness
The Result sheet notes that, for a financial entity NIS2 also covers, DORA is treated as the sector-specific act for the purposes of this Article, and sends the reader to counsel for what that means.
Text: Directive (EU) 2022/2555, OJ L 333, 27.12.2022, p. 80, as corrected by Corrigendum OJ L, 2023/90206, 22.12.2023 (Article 19(1): “by 17 January 2025”, replacing “on”), from EUR-Lex. Only the Official Journal text is authentic.