Article 40Review
By 17 October 2027 and every 36 months thereafter, the Commission shall review the functioning of this Directive, and report to the European Parliament and to the Council. The report shall in particular assess the relevance of the size of the entities concerned, and the sectors, subsectors and types of entity referred to in Annexes I and II for the functioning of the economy and society in relation to cybersecurity. To that end and with a view to further advancing the strategic and operational cooperation, the Commission shall take into account the reports of the Cooperation Group and the CSIRTs network on the experience gained at a strategic and operational level. The report shall be accompanied, where necessary, by a legislative proposal.
NIS2, the European Union directive on network and information security, Article 40
By 17 October 2027, and every 36 months after, the Commission must review how the Directive functions and report to the Parliament and the Council. The report must in particular assess the relevance of the size of the entities concerned and of the sectors, subsectors and entity types in Annexes I and II, taking into account the reports of the Cooperation Group and the CSIRTs network. It is accompanied, where necessary, by a legislative proposal.
Size thresholds and sector coverage are therefore named review subjects. But this is a reporting duty: it does not itself change who is in scope. Any change to the Directive requires a legislative act adopted by the EU legislators, and a proposal alone does not alter scope.
Text: Directive (EU) 2022/2555, OJ L 333, 27.12.2022, p. 80, as corrected by Corrigendum OJ L, 2023/90206, 22.12.2023 (Article 19(1): “by 17 January 2025”, replacing “on”), from EUR-Lex. Only the Official Journal text is authentic.