Recital 49a

To ensure that Directive (EU) 2022/2555 is applied consistently and proportionately across the Union and in line with the principle of administrative simplification and the 'report-once' policy, duplicative or unclear reporting obligations or diverging national interpretations and additional obligations should be avoided. The Commission should, in cooperation with the Cooperation Group referred to in Article 14 of Directive (EU) 2022/2555 and the European Union Agency for Cybersecurity (ENISA), issue guidance on the harmonised interpretation and application of key obligations under that Directive.

The layered single-entry points structure should not result in the centralisation, within a single body, of the storage and processing of incident notifications. In accordance with the principles of subsidiarity and proportionality, and in order to avoid creating a single point of failure that could itself become a target for cybersecurity threats, the single-entry point should be designed as a layered architecture. ENISA should provide a common interface enabling entities to submit a single notification, while the competent authorities designated under the relevant Union legal acts should remain responsible, at national level, for receiving, accessing and processing the information relating to incidents within their respective fields of competence. The EU entry point should accordingly act as a means of routing and interoperability between entities and the competent national authorities, building on the technical solutions and reporting systems already in place at national level, rather than as a centralised repository. The role of ENISA should be limited to the technical operation, routing and format check of the notifications, ENISA not being a recipient of the notifications for substantive purposes. Where ENISA receives information directly that may be relevant for the performance of the tasks of the competent national authorities, it should transmit such information without undue delay to the authorities concerned.

To ensure that Directive (EU) 2022/2555 is applied consistently and proportionately across the Union and in line with the principle of administrative simplification and the 'report-once' policy, duplicative or unclear reporting obligations or diverging national interpretations and additional obligations should be avoided. The Commission should, in cooperation with the Cooperation Group referred to in Article 14 of Directive (EU) 2022/2555 and the European Union Agency for Cybersecurity (ENISA), issue guidance on the harmonised interpretation and application of key obligations under that Directive. These guidelines shall be developed under the relevant sectorial legislation.

ENISA's role in the reporting process is limited to establishing and operating the single-entry point portal and routing reports to the competent CSIRT(s) without having access to the content of incident reports. Responsibility for the management and follow-up of incident reports remains with the national CSIRTs or competent authorities to which ENISA directs them.