Article 8Competent authorities and single points of contact
1. Each Member State shall designate or establish one or more competent authorities responsible for cybersecurity and for the supervisory tasks referred to in Chapter VII (competent authorities).
2. The competent authorities referred to in paragraph 1 shall monitor the implementation of this Directive at national level.
3. Each Member State shall designate or establish a single point of contact. Where a Member State designates or establishes only one competent authority pursuant to paragraph 1, that competent authority shall also be the single point of contact for that Member State.
4. Each single point of contact shall exercise a liaison function to ensure cross-border cooperation of its Member State’s authorities with the relevant authorities of other Member States, and, where appropriate, with the Commission and ENISA, as well as to ensure cross-sectoral cooperation with other competent authorities within its Member State.
5. Member States shall ensure that their competent authorities and single points of contact have adequate resources to carry out, in an effective and efficient manner, the tasks assigned to them and thereby to fulfil the objectives of this Directive.
6. Each Member State shall notify the Commission without undue delay of the identity of the competent authority referred to in paragraph 1 and of the single point of contact referred to in paragraph 3, of the tasks of those authorities, and of any subsequent changes thereto. Each Member State shall make public the identity of its competent authority. The Commission shall make a list of the single points of contact publicly available.
NIS2, the European Union directive on network and information security, Article 8
Each Member State designates or establishes one or more competent authorities responsible for cybersecurity and for the supervisory tasks in Chapter VII, and a single point of contact. Those authorities monitor implementation of the Directive nationally. Where there is only one competent authority, it is also the single point of contact. Member States must give both adequate resources and notify the Commission of their identity and tasks. The identity of the competent authority is made public, and the Commission publishes a list of the single points of contact.
The single point of contact is a liaison function: it supports cross-border cooperation with other Member States’ authorities and, where appropriate, the Commission and ENISA, and cross-sectoral cooperation at home.
For an entity this is the article behind the question of which authority is its own. The Directive only requires one or more competent authorities, so how supervision is divided, by sector or otherwise, is set by national law. The single point of contact is not a help desk for entities. It is one of the bodies through which information on a cross-border or cross-sectoral incident can move between authorities (Article 23(1), (6) and (8)), and Article 26 decides which Member State has jurisdiction over an entity.
Text: Directive (EU) 2022/2555, OJ L 333, 27.12.2022, p. 80, as corrected by Corrigendum OJ L, 2023/90206, 22.12.2023 (Article 19(1): “by 17 January 2025”, replacing “on”), from EUR-Lex. Only the Official Journal text is authentic.