Amendment 1802· NIS2 Directive Article 23a(1a) (new)
+Addition
Text of the amendment
As tabled
Wording it would add
1a.ENISA shall develop and maintain a single point of contact to provide an overview of regulatory obligations regarding incident reporting, and to direct users to the various national reporting platforms.
This incident reporting information point shall identify the applicable reporting obligations, the direction to the appropriate national entry point, and make available simplified and documented information on incident notification processes in the different Member States.
The incident reporting information point shall not collect any information allowing the identification of the notifying entity or of any incident. Member States shall endeavour to design their national entry point with a view to making the national entry points interoperable with the national entry points of other Member States, to facilitate the alignment of incident notifications with cross-border reporting obligations.
NIS2 Directive Article 23a with this amendment
Amendment 1802 applied to the Commission proposal, no other amendment
Unchanged: (1)
ENISA shall develop and maintain a single-entry point to support the obligation to report incidents and related events under the Union legal acts where those Union legal acts provide so (‘single-entry point’). Without prejudice to Article 16 of Regulation (EU) 2024/2847 of the European Parliament and of the Council, ENISA may ensure that the single-entry point builds on the single reporting platform established under that Regulation.
ENISA shall develop and maintain a single point of contact to provide an overview of regulatory obligations regarding incident reporting, and to direct users to the various national reporting platforms.
This incident reporting information point shall identify the applicable reporting obligations, the direction to the appropriate national entry point, and make available simplified and documented information on incident notification processes in the different Member States.
The incident reporting information point shall not collect any information allowing the identification of the notifying entity or of any incident. Member States shall endeavour to design their national entry point with a view to making the national entry points interoperable with the national entry points of other Member States, to facilitate the alignment of incident notifications with cross-border reporting obligations.
+NewUnchanged: (2), (3), (4), (5), (6) and (7)
ENISA shall take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of the single-entry point and the information submitted or disseminated via the single-entry point. ENISA shall take into account the sensitivity of information submitted or disseminated pursuant to the Union legal acts referred to in paragraph (1) and ensure that competent authorities under those Union legal acts have access to and process the information as required under those Union legal acts.
ENISA shall provide and implement the specifications on the technical, operational and organisational measures regarding the establishment, maintenance and secure operation of the single-entry point. ENISA shall develop the specifications in cooperation with the Commission, the CSIRTs network and the competent authorities under the Union legal acts referred to in paragraph (1). The specifications shall ensure that:
the necessary capability for interoperability with regard to other relevant reporting obligations referred to in paragraph (1) is ensured;
technical arrangements for the relevant entities and authorities under the Union legal acts referred to in paragraph (1) to access, submit, retrieve, transmit or otherwise process information from the single-entry point, are in place and, provide technical protocols and tools that allow the entities and authorities to further process the receive information within their systems;
the specificities of the incident reporting requirements set out under the Union legal acts referred to in paragraph (1) are duly taken into account;
where relevant, the single-entry point is interoperable and compatible with European Business Wallets referred to in [Proposal for a Regulation: Insert title of the proposal] and that the European Business Wallets can be used at least to identify and authenticate entities using the single-entry point;
entities using the single-entry point can retrieve and supplement information that they have previously submitted via the single-entry point;
a single notification of information submitted by an entity via the single-entry point can be used to fulfil reporting obligations as set out under any of the other Union legal acts which provide for incident reporting to the single-entry point.
Unless provided for in the Union legal acts referred to in paragraph (1) of this, ENISA shall not have access to the notifications submitted through the single-entry point.
Within [18] months from the entry into force of this Regulation, ENISA shall pilot the functioning of the single-entry point for each added Union legal act, including testing that takes into account the specificities and requirements for the notifications set out by each respective Union legal act, and after consulting the Commission and the relevant competent authorities under the respective Union legal acts. ENISA shall enable the notification of incidents under each Union legal act referred to in paragraph (1) only after piloting the functioning and after the Commission published a notice pursuant to paragraph 6.
The Commission shall, in cooperation with ENISA, assess the proper functioning, reliability, integrity and confidentiality of the single-entry point. When the Commission, after consultation of the CSIRTs network and the competent authorities under the Union legal acts referred to in paragraph 1, finds that the single-entry point ensures the proper functioning, reliability, integrity and confidentiality, it shall publish a notice to that effect in the Official Journal of the European Union.
Where the Commission finds in its assessment that the single-entry point does not ensure the proper functioning, reliability, integrity or confidentiality, ENISA shall take, in cooperation with the Commission and without undue delay, all necessary corrective measures to ensure the proper functioning, reliability, integrity or confidentiality without delay and inform the Commission of the results. Thereafter, the Commission shall reassess the proper functioning, reliability, integrity or confidentiality of the single-entry point and shall publish a notice in accordance with paragraph 6.
Target
Wording of the targeted provisionlaw in force, Commission proposal, latest Council text
No Council text amends Article 23a(1a) (new).
Cite this amendment
Amendment 1802 (François-Xavier Bellamy), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 1741–1840 to the draft report on COM(2025) 837 (CJ72-AM-791883, PE791.883v01-00, 27 July 2026), pp. 38–39
Link, short form and official text
Amendment 1802 (François-Xavier Bellamy), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 1741–1840 to the draft report on COM(2025) 837 (CJ72-AM-791883, PE791.883v01-00, 27 July 2026), pp. 38–39
ITRE–LIBE Amendment 1802 (CJ72-AM-791883), p. 38