NIS2 is enforced nationally. Each Member State designates one or more competent authorities that supervise companies and impose fines, and one or more CSIRTs that receive incident reports and help respond. The EU-level bodies, the Cooperation Group, the CSIRTs network, EU-CyCLONe and ENISA, coordinate between countries. None of them supervises your company directly.
This guide covers the national bodies, incident reporting, what a CSIRT does for you, the EU bodies, the national strategy, finding your own authority, the 2026 proposal for ENISA, what the law leaves open, and a checklist.
| Body | Level | What it does | Does a company deal with it directly? |
|---|---|---|---|
| Competent authority (Art. 8) | National | Supervises, audits, enforces, fines | Yes: registration, supervision, often incident reports |
| Single point of contact (Art. 8) | National | Cross-border and cross-sector liaison | Rarely |
| Cyber crisis management authority (Art. 9) | National | Manages large-scale incidents and crises | Only in a national crisis |
| CSIRT (Arts 10 to 12) | National | Receives incident reports, responds, warns, coordinates vulnerability disclosure | Yes: incidents, warnings |
| Cooperation Group (Art. 14) | EU | Strategic cooperation, guidance, supply chain risk assessments | No; its guidance informs your authority |
| CSIRTs network (Art. 15) | EU | Operational cooperation between CSIRTs | No |
| EU-CyCLONe (Art. 16) | EU | Coordinates large-scale cross-border crises | No |
| ENISA (Arts 12, 18, 27) | EU | Vulnerability database, registry, secretariats, EU report | Indirectly: registry data goes via your authority |
Who enforces NIS2 in each country?
Competent authorities (Article 8)
Article 8(1) requires each Member State to designate or establish one or more competent authorities “responsible for cybersecurity and for the supervisory tasks referred to in Chapter VII”.
This is the body that registers you, supervises you and fines you. For essential entities, Article 32 allows inspections, random checks, regular, targeted and ad hoc audits, security scans, and requests for information and evidence of implementation. Important entities are supervised after the fact, when there is evidence or an indication of non-compliance (Article 33).
For essential entities, its enforcement powers include warnings, binding instructions, orders to bring measures into line with Article 21, a monitoring officer and administrative fines (Article 32(4)). For important entities the list is similar but has no monitoring officer (Article 33(4)). For infringements of Articles 21 and 23, fine ceilings (Article 34) must reach at least €10 million or 2% of worldwide annual turnover for essential entities, and €7 million or 1.4% for important entities, whichever is higher. See NIS2 fines and penalties.
Member States choose the model. Some name one cross-sector authority; others keep sector regulators in charge of their sectors. The choice decides who you talk to, so check it before you assume. Which Member State’s authority applies is decided by Article 26, explained in NIS2 jurisdiction and the main establishment rule.
The single point of contact (Article 8(3) and (4))
Each Member State also designates a single point of contact. Where there is only one competent authority, it is also the single point of contact. Its job is liaison: cross-border cooperation with other Member States’ authorities and, where appropriate, the Commission and ENISA, plus cross-sectoral cooperation at home.
The directive does not make it the recipient of your incident reports, although where it is also the only competent authority it may receive them in that role. The CSIRT or authority that receives your notification informs the single point of contact (Article 13(3)), which must get the relevant information in due time for cross-border or cross-sectoral incidents (Article 23(1)).
Cyber crisis management authorities (Article 9)
Each Member State designates one or more authorities to manage large-scale cybersecurity incidents and crises, with a coordinator if there are several. It adopts a national large-scale incident and crisis response plan, covering among other things exercises, the link to general national crisis management, and the public and private stakeholders and infrastructure involved.
In practice a company meets this layer only in a national crisis. If you run energy, telecoms or health services, you may be one of the stakeholders the plan names.
Who do you report a NIS2 incident to?
Your national CSIRT or, where applicable, your competent authority (Article 23(1)). National law decides which, and provides the channel. The directive sets the deadlines: an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours and a final report within one month. The stages are in the NIS2 incident reporting timeline.
Where appropriate, and in particular where a significant incident concerns two or more Member States, the CSIRT, competent authority or single point of contact informs the other affected Member States and ENISA (Article 23(6)). You report to your own CSIRT or authority, and it passes the information on.
Voluntary notifications are also possible (Article 30): entities in scope for incidents, cyber threats and near misses beyond what Article 23 requires, and any other entity for significant incidents, cyber threats and near misses.
What does a CSIRT do for a company?
Under Article 23(5), the recipient of your early warning responds without undue delay, and where possible within 24 hours, with initial feedback and, if you ask, guidance on mitigation. The CSIRT provides additional technical support on request. If the incident looks criminal, you also get guidance on reporting it to law enforcement.
Article 11(3) lists the CSIRT’s tasks. Those that touch a company directly:
- early warnings, alerts and announcements to the entities concerned;
- responding to incidents and assisting essential and important entities, where applicable;
- a proactive scan of your network and information systems, on your request;
- where applicable, acting as coordinator for coordinated vulnerability disclosure (Article 12(1)), covered in NIS2 coordinated vulnerability disclosure.
CSIRTs may also carry out “proactive non-intrusive scanning of publicly accessible network and information systems” of essential and important entities, and tell them what is vulnerable or insecurely configured. Make sure such a warning would reach someone who can act on it.
CSIRTs may sit inside a competent authority (Article 10(1)), so in some countries the body that helps you and the body that supervises you are the same organisation.
What do the EU bodies in the NIS2 architecture do?
The Cooperation Group (Article 14)
Representatives of the Member States, the Commission and ENISA, with the Commission as secretariat. Its tasks include guidance to competent authorities on transposition and implementation, coordinated security risk assessments of critical supply chains under Article 22, setting the peer review methodology and regularly assessing threats such as ransomware. Two effects reach companies: its guidance shapes how your authority reads the directive, and Article 21(3) requires you to take the results of those supply chain assessments into account.
The CSIRTs network (Article 15)
Representatives of the national CSIRTs and CERT-EU, with the Commission as observer and ENISA as secretariat. It exchanges information on incidents, threats and vulnerabilities, coordinates a response to an incident where possible at a member’s request, assists Member States with cross-border incidents, and supports disclosure of vulnerabilities affecting several Member States. It reports on operational cooperation to the Cooperation Group every two years; the first report was due by 17 January 2025.
EU-CyCLONe (Article 16)
The European cyber crisis liaison organisation network supports the coordinated management of large-scale cybersecurity incidents and crises at operational level. Its members are the Member States’ cyber crisis management authorities; the Commission joins when a large-scale incident has or is likely to have a significant impact on services in scope, and observes otherwise. ENISA provides the secretariat.
Its tasks are preparedness, shared situational awareness, assessing impact and proposing mitigation, coordinating crisis management and supporting political decision-making. It reports to the European Parliament and Council every 18 months; the first report was due by 17 July 2024. It is not a threat intelligence platform, and companies cannot join it.
Peer reviews (Article 19)
Member States review each other; companies are not reviewed. Participation is voluntary. Experts designated by at least two other Member States assess, for example, how Articles 21 and 23 are implemented and how capable the competent authorities and CSIRTs are. The Commission and ENISA observe, and the reviewed Member State may publish its report.
ENISA
The EU Agency for Cybersecurity has defined tasks under NIS2, none of them supervisory:
- European vulnerability database (Article 12(2)). Launched as the EUVD on 13 May 2025. Registering vulnerabilities there is voluntary.
- Registry of digital providers (Article 27). DNS, TLD registry, domain registration, cloud, data centre, CDN, managed service, managed security service, online marketplace, search engine and social network providers gave their details to their competent authority by 17 January 2025, with changes due within three months. The single point of contact forwards the data, except IP ranges, to ENISA.
- Report on the state of cybersecurity in the Union, every two years, with the Commission and the Cooperation Group (Article 18).
What does the national cybersecurity strategy cover?
Article 7 requires each Member State to adopt a national cybersecurity strategy with objectives, governance, a risk assessment mechanism, preparedness measures and a list of the authorities involved. Article 7(2) adds ten policies: ICT supply chain security; cybersecurity requirements in public procurement; vulnerability management and coordinated disclosure; the public core of the open internet; advanced technologies; education, skills, awareness and research; support for academic and research institutions; voluntary information sharing; the cyber resilience and hygiene baseline of SMEs; and active cyber protection. Strategies are assessed at least every five years.
For a company, the strategy explains where procurement security requirements and national SME support come from. It creates no obligations for you by itself.
How do you find your competent authority and CSIRT?
Each Member State must make public the identity of its competent authority, and the Commission publishes a list of single points of contact (Article 8(6)). In practice:
- Confirm which Member State has jurisdiction over each entity in your group (Article 26).
- Read that country’s transposition law: it names the competent authority, any sector authorities and the CSIRT.
- Find the registration channel and check that you registered. Changes to your details are due without delay and within two weeks (Article 3(4)).
- Find the incident reporting channel: portal, form or address, and who needs an account.
- Note the CSIRT’s contact for technical help and the coordinator for vulnerability reports.
- Add the data protection authority, because a personal data breach is reported separately under the GDPR.
Luxembourg as an example. The ILR states that it is the competent authority for the Annex I and II sectors and for critical entities. Registration with the ILR was due by 10 July 2026, and ILR-supervised entities report incidents through the SERIMA online form. CIRCL is the CERT for the private sector, communes and non-governmental entities, and the national coordinator for vulnerability disclosure. GOVCERT.LU covers incidents affecting government systems and critical infrastructure operators. The full picture is in NIS2 in Luxembourg.
Keep the answers in one place, next to the incident plan. The time to find a portal login is before the incident, not during it.
NIS2 AUTHORITY CONTACT CARD (review every six months)
Legal entity:
Member State with jurisdiction (Art. 26):
Essential or important:
Competent authority:
Registration reference and portal:
Supervision contact:
Sector authority, if any:
Incident reports go to: CSIRT / competent authority
Channel (portal, form, email):
Account holders (two named people):
Urgent phone number:
Last test of the channel: date, result
CSIRT for technical help:
Vulnerability disclosure coordinator (Art. 12(1)):
Data protection authority (GDPR breaches):What would the January 2026 proposal change for ENISA?
On 20 January 2026 the Commission proposed targeted amendments to NIS2 (COM(2026) 13) and a revised Cybersecurity Act (COM(2026) 11). As of September 2026 both are proposals, not law, and may change before the European Parliament and the Council agree them. Under COM(2026) 13:
- ENISA’s registry would cover all essential and important entities and domain registration services, not only the listed digital providers (amended Article 27(1)).
- A new Article 37a would have ENISA help Member States with mutual assistance for entities that provide services in more than one Member State, produce an annually updated cross-border cybersecurity risk assessment, and recommend that competent authorities set up joint examination teams.
- ENISA would become a member of the CSIRTs network (amended Article 15(2)).
Under COM(2026) 11, according to the Commission, ENISA would issue early alerts on cyber threats and incidents, help with ransomware mitigation, develop a common EU vulnerability management service and operate the single entry point for incident reporting proposed in the Digital Omnibus. The Commission puts the budget increase at more than 75%.
In the proposed text, ENISA assists and recommends; the competent authorities still supervise. If you run services in several Member States, this is the part to watch.
What the law leaves open
The directive names the roles, not who in your company talks to which body, through which account, at 3 a.m. on a Sunday. In practice a company in scope usually deals with three: the competent authority, the CSIRT and the data protection authority.
Two gaps come up repeatedly. First, registration data drifts. Contacts, IP ranges and countries served change faster than anyone updates the authority, although the law requires updates without delay and within two weeks, or three months for registry entries. Second, CSIRT warnings arrive and go nowhere. A CSIRT can scan your public systems and tell you about a vulnerable service, but only a monitored mailbox and an asset inventory that maps each IP range to an owner turn that warning into a fix.
Closing both is operational work: an asset inventory reconciled against what you registered, a reporting channel tested with named people, and evidence of your measures kept current for when the authority asks under Articles 32 and 33. That is the kind of work the CloudSoul platform automates, with a person reviewing the exceptions. The wider programme is on the NIS2 compliance page.
NIS2 authorities checklist
- Confirm the Member State with jurisdiction for each entity in your group.
- Name your competent authority, CSIRT, any sector authority and the data protection authority.
- Check your registration and diarise the two-week rule for changes.
- Save the incident reporting channel and test access with two named people.
- Put the authority contact card into the incident plan.
- Route CSIRT warnings to a monitored mailbox with a named owner.
- Reconcile your registered IP ranges with your real external footprint.
- If you operate in several Member States, follow COM(2026) 13 and COM(2026) 11.
Sources
- Directive (EU) 2022/2555 (NIS2), Articles 3, 7 to 16, 18, 19, 21, 23, 26, 27, 30 and 32 to 34, EUR-Lex; article text also at nis-2-directive.com.
- Proposal for a Directive amending Directive (EU) 2022/2555, COM(2026) 13, 20 January 2026, EUR-Lex.
- European Commission, Cybersecurity Act and Cybersecurity package: questions and answers, on COM(2026) 11.
- European Commission, NIS Cooperation Group.
- ENISA, CSIRTs Network, EU-CyCLONe and European Vulnerability Database launch, 13 May 2025.
- ILR, NIS and Incident notification; CIRCL; GOVCERT.LU.
Frequently asked questions
Who enforces NIS2?
National competent authorities that each Member State designates under Article 8. They supervise essential and important entities and can issue warnings, binding instructions and administrative fines. The EU bodies coordinate between countries but do not supervise companies.
Who do you report a NIS2 incident to?
To your national CSIRT or, where applicable, your competent authority (Article 23(1)). The recipient responds without undue delay and where possible within 24 hours of the early warning, and the CSIRT provides additional technical support if you ask.
What is the NIS2 single point of contact?
A national body with a liaison function: it ensures cross-border cooperation with other Member States' authorities and, where appropriate, the Commission and ENISA, and cross-sectoral cooperation at home (Article 8(4)). If a Member State has only one competent authority, that authority is also the single point of contact.
What is EU-CyCLONe?
The European cyber crisis liaison organisation network set up by Article 16. It brings together the Member States' cyber crisis management authorities to coordinate large-scale cybersecurity incidents and crises. Companies do not join it or report to it.
Does ENISA supervise companies under NIS2?
No. ENISA keeps a registry of certain digital providers, runs the European vulnerability database and provides the secretariat for the CSIRTs network and EU-CyCLONe. A January 2026 Commission proposal would give it a larger coordinating role, but it is a proposal, not law.
