Digital Omnibus tracker

Critical Entities Resilience Directive · Directive (EU) 2022/2557

Article 15

Compare the available Commission, Council and Parliament texts and amendments affecting this article.

Article total: 2 parts · 4 Council drafts · 5 Parliament amendments

Removed wording is struck through; added or replacement wording is highlighted.

Institutional text

The wording proposed by the Commission at the start of this legislative file.

Full article with Commission changes

Article with proposed changes

Official consolidated text dated 14 December 2022, with all 2 Commission proposal changes affecting this article applied.

Article 15

Incident notification

  1. 1.

    Member States shall ensure that critical entities notify via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 the competent authority, without undue delay, of incidents that significantly disrupt or have the potential to significantly disrupt the provision of essential services. Member States shall ensure that, unless operationally unable to do so, critical entities submit an initial notification no later than 24 hours after becoming aware of an incident, followed, where relevant, by a detailed report no later than one month thereafter. In order to determine the significance of a disruption, the following parameters shall, in particular, be taken into account:

    Where an incident has or might have a significant impact on the continuity of the provision of essential services to or in six or more Member States, the competent authorities of the Member States affected by the incident shall notify the Commission of that incident.

    1. (a)

      the number and proportion of users affected by the disruption;

    2. (b)

      the duration of the disruption;

    3. (c)

      the geographical area affected by the disruption, taking into account whether the area is geographically isolated.

  2. 2.

    Notifications as referred to in paragraph 1, first subparagraph, shall include any available information necessary to enable the competent authority to understand the nature, cause and possible consequences of the incident, including any available information necessary to determine any cross-border impact of the incident. Such notifications shall not subject critical entities to increased liability.

    The Commission may adopt implementing acts further specifying the type and format of information notified pursuant to Article 15(1). Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 24(2).

  3. 3.

    On the basis of the information provided by a critical entity in a notification as referred to in paragraph 1, the relevant competent authority, via the single point of contact, shall inform the single point of contact of other affected Member States where the incident has or might have a significant impact on critical entities and the continuity of the provision of essential services to or in one or more other Member States.

    Single points of contact sending and receiving information pursuant to the first subparagraph shall, in accordance with Union or national law, treat that information in a way that respects its confidentiality and protects the security and commercial interest of the critical entity concerned.

  4. 4.

    As soon as possible following a notification as referred to in paragraph 1, the competent authority concerned shall provide the critical entity concerned with relevant follow-up information, including information that could support that critical entity’s effective response to the incident in question. Member States shall inform the public where they determine that it would be in the public interest to do so.

Commission source wording and instructions

Article 15(1), first sentence

Commission proposal

Member States shall ensure that critical entities notify via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 the competent authority, without undue delay, of incidents that significantly disrupt or have the potential to significantly disrupt the provision of essential services.

Article 15(2), additional subparagraph

Commission proposal

The Commission may adopt implementing acts further specifying the type and format of information notified pursuant to Article 15(1). Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 24(2).

Institutional text

Council Presidency texts

Successive Presidency compromise texts. Their inclusion does not imply agreement or adoption.

Article 15(1), first sentence

May Presidency compromise

Council wording reconstructed for this provision from the official operation

Member States shall ensure that critical entities notify via the national entry point established pursuant to Article 23b of Directive (EU) 2022/2555 the competent authority, without undue delay, of incidents that significantly disrupt or have the potential to significantly disrupt the provision of essential services.

Article 15(2), additional subparagraph

May Presidency compromise

The Commission may adopt implementing acts further specifying the type and format of information notified pursuant to Article 15(1). Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 24(2).

Competing proposals

European Parliament amendments

These are alternative tabled amendments. An amendment affecting several tracked parts appears once here, with each target identified.

More filters

Alternative wording Amendment 291 · Daniel Buda JURI
‘Member States shall ensure that critical entities notify via the single-entryreporting channel designated by the competent Member State, including through a national contact point, through a national interface or, where the competent Member State has so decided, through the interoperable European framework established pursuant to Article 23a of Directive (EU) 2022/2555 the competent authority, without undue delay, of incidents that significantly disrupt or have the potential to significantly disrupt the provision of essential services.’;
Preview
against:
Source identification

Header printed in the source: Article 9 – paragraph 1 – point 1 / Directive (EU) 2022/2557 / Article 15 – paragraph 1

Alternative wording Amendment 292 · Daniel Buda JURI
The Commission may adopt implementing acts further specifying the type and format of information notified pursuant to Article 15(1), after consulting the Member States, the CSIRT network, the competent authorities under this Directive and ENISA, and in accordance with the national reporting channels designated by the Member States. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 24(2).’
Preview
against:
Source identification

Header printed in the source: Article 9 – paragraph 1 – point 2 / Directive (EU) 2022/2557 / Article 15 – paragraph 2

Remove proposed wording Amendment 1819 · Markus Buchheit ITRE · LIBE

The source names this article, but its precise target scope has not been resolved. Related tracker provisions are not asserted as direct targets.

Article 15

Article 9 Amendments to Directive (EU) 2022/2557 Article 15 of Directive (EU) 2022/2557 is amended as follows: 1. in paragraph 1, the first sentence is replaced as follows: ‘Member States shall ensure that critical entities notify via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 the competent authority, without undue delay, of incidents that significantly disrupt or have the potential to significantly disrupt the provision of essential services.; ‘The Commission may adopt implementing acts further specifying the type and format of information notified pursuant to Article 15(1). Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 24(2).
Source identification

Header printed in the source: Article 9 / Regulation (EU) 2022/2557 / Article 15

Deletion marker printed in the source: deleted

Alternative wording Amendment 1820 · Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay ITRE · LIBE
Member States shall ensure that critical entities notify viaby the national single-entry points to the EU single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555, through the competent authority, without undue delay, of incidents that significantly disrupt or have the potential to significantly disrupt the provision of essential services.;
Preview
against:
Source identification

Header printed in the source: Article 9 – paragraph 1 – point 1 / Directive (EU) 2022/2557 / Article 15 – paragraph 1 – first sentence

Remove proposed wording Amendment 1821 · Damian Boeselager on behalf of the Verts/ALE Group ITRE · LIBE
The Commission may adopt implementing acts further specifying the type and format of information notified pursuant to Article 15(1). Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 24(2).
Preview
against:
Source identification

Header printed in the source: Article 9 – paragraph 1 – point 2 / Directive (EU) 2022/2557 / Article 15 – paragraph 2 – subparagraph

Deletion marker printed in the source: deleted