Obligations due by this deadline
For all in-scope entities
- Art 3 — Member States shall establish a list of essential and important entities as well as entities providing domain name registration services.
- Art 3 — Competent authorities shall notify the Commission and the Cooperation Group of the number of essential and important entities listed for each sector and subsector.
- Art 3 — Competent authorities shall notify the Commission of relevant information about the number of essential and important entities identified pursuant to Article 2(2), including sector, subsector, service type, and identification provision.
Checklist — what you need to have done
- Art 3: establish
- Art 3: notify
What should already be in place — audit framing
17 April 2025 is 409 days behind us. The obligations on this page have been in force since then; treat any gap as an audit finding, not a planning question. The expected baseline under NIS2 Directive:
- entity registration with the competent authority — should be done already
- incident-reporting playbook update — should be done already
- management-body cybersecurity training — should be done already
If any of these are missing, the right next step is a gap assessment plus a documented remediation plan — not a re-design of the underlying programme.
Related Fontvera pages
- nis2 directive art 14 cooperation group obligations
- nis2 directive art 32 competent authorities obligations
- nis2 directive art 33 competent authorities obligations
- nis2 directive art 7 member state obligations
Check your full compliance exposure with the 5-minute Fontvera diagnostic →