NIS2 Directive (EU) 2022/2555: cybersecurity for data centre service providers
Lists data centre service providers among the digital infrastructure entities that must manage cybersecurity risk, report significant incidents quickly, and answer to management-level accountability; each Member State sets the exact law, authority and fines.
- 14requirementsin our own words
- 1edition Directive (EU) 2022/2555
- 17places where it is a duty of 30 assessed
- 18 Oct 2026last checkedat the sources below
Where it applies
It is a duty in 17 of 30 places, and 13 need a closer read. The outcome holds under the conditions shown and says nothing about any one site.
| Where | Outcome | Basis | Conditions | Authority and route |
|---|---|---|---|---|
| Belgium | Applies | Required by law In force | Entity: data centre service provider (Annex I, digital infrastructure) WhyNational law found on EUR-Lex national transposition list: Belgian law of 26 April 2024 (loi NIS2), Belgisch Staatsblad 2024-05-17. Commission page (7 Jul 2025): Transposed. | single point of contact (Commission page): Centre for Cybersecurity Belgium |
| Bulgaria | Applies | Required by law Adopted, not yet in force | Entity: data centre service provider (Annex I, digital infrastructure) WhyNational law found on EUR-Lex national transposition list: Bulgarian amendment to the Cybersecurity Act, State Gazette 17 of 2026-02-13. Commission page (7 Jul 2025): On 7 May 2025 the Commission sent a reasoned opinion for failure to notify full transposition. | single point of contact (Commission page): State "E-gov" Agency |
| Cyprus | Applies | Required by law Adopted, not yet in force | Entity: data centre service provider (Annex I, digital infrastructure) WhyNational law found on EUR-Lex national transposition list: Cypriot amending law of 2025, Gazette 5036 (2025-04-25). Commission page (7 Jul 2025): On 7 May 2025 the Commission sent a reasoned opinion for failure to notify full transposition. | single point of contact (Commission page): Digital Security Authority (DSA) |
| Germany | Applies | Required by law In force | Entity: data centre service provider (Annex I, digital infrastructure) WhyGerman BSI Act (new version) covers 'besonders wichtige Einrichtungen' and 'wichtige Einrichtungen'; the BSI is the authority. | BSI (Bundesamt für Sicherheit in der Informationstechnik) Filed with: BSI reporting and registration portals |
| Greece | Applies | Required by law In force | Entity: data centre service provider (Annex I, digital infrastructure) WhyCommission page (7 Jul 2025) records transposition; national act not identified in this pass. | single point of contact (Commission page): National Cyber Security Authority (General Secretariat of Telecommunications and Post, Ministry of Digital Governance) |
| Croatia | Applies | Required by law In force | Entity: data centre service provider (Annex I, digital infrastructure) WhyNational law found on EUR-Lex national transposition list: Croatian Cybersecurity Act, Narodne Novine 14/2024 (2024-02-07). Commission page (7 Jul 2025): Transposed. | single point of contact (Commission page): The Office of the National Security Council |
| Italy | Applies | Required by law In force | Entity: data centre service provider (Annex I, digital infrastructure) WhyNational law found on EUR-Lex national transposition list: Italian Legislative Decree 138 of 4 Sept 2024, GU n. 230 of 1 Oct 2024. Commission page (7 Jul 2025): Transposed. | single point of contact (Commission page): National Cybersecurity Agency (ACN) |
| Lithuania | Applies | Required by law In force | Entity: data centre service provider (Annex I, digital infrastructure) WhyCommission page (7 Jul 2025) records transposition; national act not identified in this pass. | single point of contact (Commission page): National Cyber Security Centre (NCSC/CERT-LT) |
| Luxembourg | Applies | Required by law Adopted, not yet in force | Entity: data centre service provider (Annex I, digital infrastructure) WhyNational law found on EUR-Lex national transposition list: Luxembourg law of 5 May 2026, Mémorial A 2026-05-06. Commission page (7 Jul 2025): On 7 May 2025 the Commission sent a reasoned opinion for failure to notify full transposition. | single point of contact (Commission page): Institut Luxembourgeois de Régulation |
| Latvia | Applies | Required by law Adopted, not yet in force | Entity: data centre service provider (Annex I, digital infrastructure) WhyNational law found on EUR-Lex national transposition list: Latvian National Cybersecurity Law (2024-07-04). Commission page (7 Jul 2025): On 7 May 2025 the Commission sent a reasoned opinion for failure to notify full transposition. | single point of contact (Commission page): Ministry of Defence |
| Malta | Applies | Required by law Adopted, not yet in force | Entity: data centre service provider (Annex I, digital infrastructure) WhyNational law found on EUR-Lex national transposition list: Maltese Order of 2025, Government Gazette 21,418 (2025-04-08). Commission page (7 Jul 2025): Not yet transposed. | single point of contact (Commission page): Critical Information Infrastructure Protection Unit |
| Netherlands | Applies | Required by law Adopted, not yet in force | Entity: data centre service provider (Annex I, digital infrastructure) WhyNational law found on EUR-Lex national transposition list: Dutch act of 8 July 2026 (Staatsblad 2026, 187, published 2026-07-10); entry into force not checked. Commission page (7 Jul 2025): On 7 May 2025 the Commission sent a reasoned opinion for failure to notify full transposition. | single point of contact (Commission page): National Cyber Security Centre (NCSC) E-mail: [email protected] |
| Portugal | Applies | Required by law Adopted, not yet in force | Entity: data centre service provider (Annex I, digital infrastructure) WhyNational law found on EUR-Lex national transposition list: Portuguese Decree-Law 125/2025 of 4 Dec 2025. Commission page (7 Jul 2025): On 7 May 2025 the Commission sent a reasoned opinion for failure to notify full transposition. | single point of contact (Commission page): Portuguese National Cybersecurity Centre |
| Romania | Applies | Required by law In force | Entity: data centre service provider (Annex I, digital infrastructure) WhyCommission page (7 Jul 2025) records transposition; national act not identified in this pass. | single point of contact (Commission page): Romanian National Computer Security Incident Response Team (CERT-RO) E-mail: [email protected] |
| Sweden | Applies | Required by law Adopted, not yet in force | Entity: data centre service provider (Annex I, digital infrastructure) WhyNational law found on EUR-Lex national transposition list: Swedish Cybersecurity Act 2025:1506 (2025-12-17). Commission page (7 Jul 2025): On 7 May 2025 the Commission sent a reasoned opinion for failure to notify full transposition. | single point of contact (Commission page): Myndigheten för samhällsskydd och beredskap Swedish Civil Contingencies Agency (MSB) |
| Slovenia | Applies | Required by law Adopted, not yet in force | Entity: data centre service provider (Annex I, digital infrastructure) WhyNational law found on EUR-Lex national transposition list: Slovenian Information Security Act ZInfV-1, Uradni list RS 40/2025. Commission page (7 Jul 2025): On 7 May 2025 the Commission sent a reasoned opinion for failure to notify full transposition. | single point of contact (Commission page): Information Security Administration |
| Slovakia | Applies | Required by law In force | Entity: data centre service provider (Annex I, digital infrastructure) WhyCommission page (7 Jul 2025) records transposition; national act not identified in this pass. | single point of contact (Commission page): National Security Authority |
| Austria | Needs review | Required by law Status not confirmed | Entity: data centre service provider (Annex I, digital infrastructure) WhyDirective binds the Member State; Commission page (7 Jul 2025) shows transposition incomplete and no later national act was confirmed from an official gazette in this pass. | single point of contact (Commission page): Federal Ministry of the Interior |
| Switzerland | Needs review | Required by law Status not confirmed | Entity: data centre service provider (Annex I, digital infrastructure) WhySwitzerland is not bound by NIS2; national cyber rules not read in this pass (Swiss federal sites blocked or moved). | Not stated |
| Czechia | Needs review | Required by law Status not confirmed | Entity: data centre service provider (Annex I, digital infrastructure) WhyDirective binds the Member State; Commission page (7 Jul 2025) shows transposition incomplete and no later national act was confirmed from an official gazette in this pass. | single point of contact (Commission page): National cyber and information security agency |
| Denmark | Needs review | Required by law Status not confirmed | Entity: data centre service provider (Annex I, digital infrastructure) WhyDirective binds the Member State; Commission page (7 Jul 2025) shows transposition incomplete and no later national act was confirmed from an official gazette in this pass. | single point of contact (Commission page): The Danish Centre for Cybersecurity |
| Estonia | Needs review | Required by law Status not confirmed | Entity: data centre service provider (Annex I, digital infrastructure) WhyDirective binds the Member State; Commission page (7 Jul 2025) shows transposition incomplete and no later national act was confirmed from an official gazette in this pass. | single point of contact (Commission page): Estonian Information System Authority |
| Spain | Needs review | Required by law Status not confirmed | Entity: data centre service provider (Annex I, digital infrastructure) WhyDirective binds the Member State; Commission page (7 Jul 2025) shows transposition incomplete and no later national act was confirmed from an official gazette in this pass. | single point of contact (Commission page): National Security Council, through the National Security Department |
| Finland | Needs review | Required by law Status not confirmed | Entity: data centre service provider (Annex I, digital infrastructure) WhyDirective binds the Member State; Commission page (7 Jul 2025) shows transposition incomplete and no later national act was confirmed from an official gazette in this pass. | single point of contact (Commission page): National Cyber Security Centre, Finnish Transport and Communications Agency (Traficom) |
| France | Needs review | Required by law Status not confirmed | Entity: data centre service provider (Annex I, digital infrastructure) WhyDirective binds the Member State; Commission page (7 Jul 2025) shows transposition incomplete and no later national act was confirmed from an official gazette in this pass. | single point of contact (Commission page): Agence nationale de la sécurité des systèmes d'information (ANSSI) |
| United Kingdom | Needs review | Required by law Status not confirmed | Entity: data centre service provider (Annex I, digital infrastructure) WhyNot subject to NIS2. Network and Information Systems Regulations 2018 apply; Cyber Security and Resilience Bill introduced 12 Nov 2025 (proposal at the page's last update); whether a given data centre falls inside was not read. | sector regulators / ICO (not read) |
| Hungary | Needs review | Required by law Status not confirmed | Entity: data centre service provider (Annex I, digital infrastructure) WhyDirective binds the Member State; Commission page (7 Jul 2025) shows transposition incomplete and no later national act was confirmed from an official gazette in this pass. | single point of contact (Commission page): National Cyber Security Centre |
| Ireland | Needs review | Required by law Status not confirmed | Entity: data centre service provider (Annex I, digital infrastructure) WhyDirective binds the Member State; Commission page (7 Jul 2025) shows transposition incomplete and no later national act was confirmed from an official gazette in this pass. | single point of contact (Commission page): CSIRT-IE |
| Norway | Needs review | Required by law Status not confirmed | Entity: data centre service provider (Annex I, digital infrastructure) WhyEEA relevance; Norwegian digital security legislation not confirmed from an official source in this pass. | Not stated |
| Poland | Needs review | Required by law Status not confirmed | Entity: data centre service provider (Annex I, digital infrastructure) WhyDirective binds the Member State; Commission page (7 Jul 2025) shows transposition incomplete and no later national act was confirmed from an official gazette in this pass. | single point of contact (Commission page): Ministry of Digital Affairs, Department of cybersecurity |
What it asks for
14 requirements, each in our own words with the evidence an assessor would expect and who on a site usually owns it. Read the clause itself on the scheme owner's page.
| Requirement | Evidence expected | Owner | When |
|---|---|---|---|
| Confirm that you are a data centre service provider in scope, and which Member State has jurisdiction (main establishment) and which authority supervises you. Applies to: data centre service provider offering services in the EU | Entity classification memo with the national law, authority and registration reference Record, checked by document review | Compliance manager with Security lead | On each change review yearly Governance, the organisation |
| Have the management body approve the cybersecurity risk-management measures, oversee them, and accept that its members can be held liable. | Board minutes approving the measures and the oversight reports Record, checked by interview | Compliance manager with Security lead | Every year at least yearly Governance, the organisation |
| Train management body members, and offer similar training to staff, on a regular basis. | Training records for directors and staff Record, checked by sampling | HR with Security lead | Every year regular (yearly is common practice) Governance, the organisation |
| Adopt an all-hazards approach that protects network and information systems and their physical environment, with policies on risk analysis and information system security. | Risk register, security policy and the physical-environment risk assessment Policy, checked by document review | Security lead with Site manager | Every year review at least yearly Governance, the organisation |
| Run incident handling, and report significant incidents to the CSIRT or competent authority without undue delay. Applies to: significant incident | Incident procedure, classification criteria and notification templates Record, checked by test | Security lead with IT operations | Continuous without undue delay (staged deadlines in Art. 23(4)) Filing, the organisation |
| Maintain business continuity, backup management, disaster recovery and crisis management. | Continuity plan, backup test results, recovery exercise report Test report, checked by witnessed | IT operations with Site manager | Every year exercise at least yearly (practice) Governance, the organisation |
| Manage supply chain security, including the relationships with direct suppliers and service providers. | Supplier inventory, security clauses in contracts, supplier review records Contract, checked by sampling | Procurement with Security lead | Each certification cycle review at renewal Contractual, the organisation |
| Handle security in acquisition, development and maintenance of systems, including vulnerability handling and disclosure. | Patch policy, vulnerability scan reports, disclosure procedure Test report, checked by test | IT operations with Security lead | Continuous per policy Technical limit, a system or service |
| Assess regularly whether the cybersecurity risk-management measures work. | Internal audit or control-testing reports Test report, checked by sampling | Quality with Security lead | Every year at least yearly (practice) Governance, the organisation |
| Apply basic cyber hygiene practices and cybersecurity training. | Awareness programme, phishing-test results, attendance records Record, checked by sampling | Security lead with HR | Every year regular Governance, the organisation |
| Set policies for cryptography and, where appropriate, encryption. | Cryptography policy and key inventory Policy, checked by document review | Security lead with IT operations | Every year review at least yearly (practice) Governance, a system or service |
| Cover human resources security, access control policies and asset management, and use multi-factor authentication where appropriate. | Joiner-mover-leaver records, access reviews, MFA coverage report Log, checked by sampling | Security lead with HR | Continuous review per policy Technical limit, a system or service |
| Register with the competent authority by giving the entity's name, address and contact details. Applies to: data centre service provider | Registration confirmation from the national authority Record, checked by document review | Compliance manager | Once by 17 January 2025 under Art. 27 (national dates may differ) Filing, the organisation |
| Budget for penalties: for essential entities the maximum fine is at least EUR 10 million or 2 percent of worldwide turnover, whichever is higher, for breaching the risk-management or reporting articles. | Legal register entry with national fine levels Record, checked by document review | Compliance manager with Finance | Every year review yearly Governance, the organisation |
Editions
Which text is in force, from when, and which one it replaced.
| Edition | Status | Published | In effect | Replaces |
|---|---|---|---|---|
| Directive (EU) 2022/2555 | Current Transposition deadline 17 Oct 2024 per the national-transposition page on EUR-Lex. | 27 Dec 2022 | Not stated Transition until 17 Oct 2024 | None named |
About the programme
- Scheme owner
- European Parliament and Council
- Assessed by
- A regulator or authority
- Scope
- entity (legal person) and its services
- Levels
- essential and important entities
- Validity
- Continuous duty; incident notifications as events occur.
- Regulator
- National competent authorities and CSIRTs (single point of contact per Member State)
- Official body
- European Parliament and Council
- Who asks for it
- Regulator, Public tenders, Financial-sector clients
- Where it is used
- EU27 via national law; EEA and UK handled separately
Sources
Official bodies behind this page, each with the date we last read it.
- EUR-Lex (Official Journal of the EU)read 18 Oct 2026
- European Commissionread 18 Oct 2026
- Gesetze im Internet (German federal law)read 18 Oct 2026
- GOV.UKread 18 Oct 2026
Not legal advice. Confirm each duty against the text itself.