Source: OJ L, 2024/2690, 18.10.2024

Article premier Objet

Summary What does Article 1 of the Cybersecurity measures and significant incidents for relevant entities say?

This is the foundational scoping article of the Regulation.

It identifies the specific categories of digital and ICT service providers that fall within its scope, collectively referred to as "relevant entities", and sets out the Regulation's two core purposes: establishing technical and methodological requirements for cybersecurity risk-management measures, and defining when an incident must be considered significant.

Both purposes directly implement obligations under NIS2 (Directive (EU) 2022/2555), meaning this Regulation acts as a technical implementing act that gives concrete shape to the broader requirements laid down in that Directive.

Important points:

Understand whether your organisation falls within one of the listed categories of relevant entities, as this determines whether the Regulation applies to you.
The Regulation serves two distinct functions: specifying cybersecurity risk-management requirements and defining the threshold for a significant incident.
Both functions derive their legal basis from NIS2, specifically Articles 21(2) and 23(3) of Directive (EU) 2022/2555.

Springlex's summary of the article, a reading aid, not a substitute for the legal text.

Le présent règlement établit, en ce qui concerne les fournisseurs de services DNS, les registres des noms de domaines de premier niveau, les fournisseurs de services d’informatique en nuage, les fournisseurs de services de centres de données, les fournisseurs de réseaux de diffusion de contenu, les fournisseurs de services gérés, les fournisseurs de services de sécurité gérés, les fournisseurs de places de marché en ligne, de moteurs de recherche en ligne et de plateformes de services de réseaux sociaux et les fournisseurs de services de confiance (ci-après les «entités concernées»), les exigences techniques et méthodologiques liées aux mesures visées à l’article 21, paragraphe 2, de la directive (UE) 2022/2555 et précise plus en détail les cas dans lesquels un incident devrait être considéré comme important au sens de l’article 23, paragraphe 3, de la directive (UE) 2022/2555.

Table of contents

Springlex and this text is meant purely as a documentation tool and has no legal effect. No liability is assumed for its content. The authentic version of this act is the one published in the Official Journal of the European Union.

Relevant recitals