Article 4 NIS2 sector-specific laws: requirements and evidence

When does a sector-specific EU law replace NIS2 for your entity?

If your entity is a bank, insurer, payment institution or other financial entity, NIS2 may still apply to you, but only in part. The short answer is that a sector-specific EU act replaces NIS2 for you only where that act requires cybersecurity risk-management measures or significant incident notification with at least equivalent effect. DORA, Regulation (EU) 2022/2554, is the main example for financial entities, and under Article 4(1) its ICT risk, incident reporting and resilience testing rules take the place of NIS2's Chapter VII supervision and enforcement for the entities it covers. Start by asking whether the sector act really reaches your entity, not whether the sector sounds familiar.

Article 4(2) sets the equivalence test in two alternative ways. The sector act must either impose risk-management measures at least as demanding as the Article 21(1) and (2) measures, or impose incident notification at least as demanding as Article 23(1) to (6), and in the second case it must give NIS2 CSIRTs, competent authorities or single points of contact immediate access to the notifications. Equivalence is judged on substance, so a shorter timeline or a narrower scope in the sector act can leave a gap. The partial-coverage rule in Article 4(1) matters too: where a sector act covers only some entities in a sector, NIS2 keeps applying to the entities it does not cover, so a group may have some entities under DORA and others under NIS2.

The analysis is hard in practice because the equivalence comparison is not a box-ticking exercise. Map each Article 21 and Article 23 requirement against the sector act, note where the sector act is stricter, looser or silent, and record the reasoning. Confirm with your national competent authority how it reads the rule, and check the Commission's guidelines on applying Article 4(1) and (2), which are linked below. Our implementation work can prepare that mapping and the evidence behind it, but the decision on whether NIS2 applies to a given entity belongs to the entity, its legal advisers and its supervisor.

Which entities and sector laws the Article 4 test touches

Article 4 is decided entity by entity and act by act, not sector by sector. The cards below cover the scoping decisions that change the workload: financial entities under DORA, partial coverage by a sector act, sectors without an equivalent act, and group structures that mix several legal acts. Each one needs a documented answer before any gap work starts.

Financial entities under DORA

Recital 28 treats DORA as the sector-specific act for financial entities, so DORA's ICT risk management, incident reporting, resilience testing, information-sharing and ICT third-party risk rules apply in place of NIS2's. The check is whether the entity is a financial entity within DORA's scope and whether its DORA obligations are at least equivalent to Article 21(1) and (2) and Article 23(1) to (6). Confirm the supervisor and the reporting channel with your national competent authority, because a DORA entity that also falls under NIS2 may still need a clear record of which rules govern each obligation.

Entities covered only in part

Article 4(1) states that where a sector-specific act covers only some entities in a sector, NIS2 continues to apply to the entities it does not cover. Two entities in the same sector can therefore land under different regimes. Map each legal entity in the group against the sector act's scope test, not against the sector name, and record the result per entity so that the NIS2 program covers exactly the entities that remain in scope.

Sectors without an equivalent act

Where no sector-specific Union act imposes equivalent cybersecurity risk-management or incident notification rules, NIS2 applies in full to the entity. Equivalence is a test of substance: risk-management measures must be at least equivalent to Article 21(1) and (2), and notification must give NIS2 CSIRTs, competent authorities or single points of contact immediate access. Check the sector act's requirements line by line before concluding that it displaces NIS2 for any entity.

Group structures across several legal acts

A group may contain a bank subsidiary under DORA, a logistics arm under NIS2 and a shared IT company that supplies both. Each legal entity needs its own Article 4 determination, but the group usually runs one control set, one incident process and one supplier register. Decide early which controls are shared, which obligations each subsidiary must evidence separately, and how a single incident is reported to more than one authority, so the duplicated reporting obligations do not produce conflicting filings.

Commission guidelines as the reference

The Commission published its guidelines on applying Article 4(1) and (2) on 14 September 2023, after the Article 4(3) deadline of 17 July 2023. They are the reference point a competent authority is likely to use when it reviews a displacement claim. Keep a written determination for each entity that cites the guidelines, the sector act and the equivalence comparison, and ask your legal adviser whether the national transposition law adds any condition.

Sector act changes over time

A displacement decision made today can change when the sector act is amended, repealed or supplemented by delegated or implementing acts. Assign an owner to track changes to each sector act your entities rely on, and reassess the Article 4 determination on each change. Record the date of each assessment so that the file shows which version of the sector act was applied at the time.

How an assessor or supervisor tests the displacement claim

This table walks through the questions a national competent authority or auditor asks when an entity says a sector-specific act displaces NIS2. Read each row as a test step, the evidence it expects, and the point where claims most often fail.

Test step	What the assessor checks	Evidence requested	Where claims usually fail
Scope check	Whether the sector act covers the entity itself, as an essential or important entity under that act, and whether it covers every entity in the NIS2 sector or only some	Legal entity list, licence or authorisation status, and the sector act's scope provisions mapped to each entity	Scope mapping is incomplete, so some entities or subsidiaries fall outside the sector act and remain under NIS2
Partial coverage	Whether the sector act covers only some entities in a sector, which leaves NIS2 applicable to the rest	Written split of covered and uncovered entities, with reasons for each	Entities assume full displacement when the sector act reaches only a subset
Risk-management equivalence	Whether the sector act's cybersecurity risk-management requirements are at least equivalent to Article 21(1) and (2)	Side-by-side comparison of each Article 21(2) measure against the sector act's controls, with the governing article cited	Comparison covers high-level principles but skips specific measures such as supply chain security, vulnerability handling or cryptography
Incident reporting equivalence	Whether incident notification is at least equivalent to Article 23(1) to (6), including timing, content and stages	Reporting matrix showing each NIS2 reporting stage and its counterpart in the sector act, with deadlines	Sector act reporting triggers, thresholds or deadlines differ from Article 23, and the gap is not recorded
Immediate access condition	Whether NIS2 CSIRTs, competent authorities or single points of contact get immediate access to the notifications	Documented notification routing, access arrangements with the relevant authorities, and test records	Notifications go only to the sector supervisor, with no arrangement giving NIS2 bodies immediate access
Supervision and enforcement	Whether the displacement also removes NIS2 Chapter VII supervision and enforcement for the covered entity	Confirmation of the supervising authority under the sector act and its enforcement powers	Entity assumes NIS2 supervision ends without confirming which authority now supervises it
Current guidance check	Whether the entity applied the Commission's guidelines on Article 4(1) and (2) when it made its equivalence analysis	Analysis memo referencing the guidelines and the date of the assessment	Analysis predates or ignores the guidelines and is not updated after changes to the sector act
Ongoing validity	Whether the displacement still holds after changes to the sector act, the entity's structure or its NIS2 national transposition	Periodic review record, change log and sign-off by the management body	Displacement is assumed once and never re-tested after amendments or group restructuring

How to document the Article 4 analysis step by step

This sequence turns Article 4 from a legal question into a documented, signed-off position that states which NIS2 obligations apply to each entity, which sector-specific act displaces them, and what remains in force. The output is a file a supervisor can read without needing your legal team to explain it.

Inventory entities and services in scope
Start by listing every legal entity in the group, the regulated services each one provides, and the sector each service falls under. Include subsidiaries and entities that may be covered by a sector-specific act only in part. Compliance leads and business owners usually compile this with input from legal and finance. The step is complete when each entity and service has a row with its sector, its Annex reference and a named owner, and nothing is left unassigned.
Identify the sector-specific act and its supervisor
For each row, establish whether a sector-specific Union act requires essential or important entities to adopt cybersecurity risk-management measures or notify significant incidents. Record the act, the article that imposes the duty, and the authority that supervises it. Legal counsel should confirm the reading, and the Commission guidelines on applying Article 4(1) and (2) should be cited for the interpretation. The output is a register entry per service stating either that a sector act applies or that it does not.
Confirm whether the act covers the whole entity
Article 4(1) applies only to the entities a sector-specific act covers. Where the act reaches only some entities in a sector, the rest remain under NIS2. Check each entity individually against the scope wording of the sector act, not the sector label alone. The output is a coverage note for each entity that states whether it is fully covered, partly covered or not covered, with the reasoning in one or two sentences.
Map equivalent requirements against Article 21 and Article 23
For each entity the sector act covers, compare its risk-management duties with Article 21(1) and (2) and its incident notification duties with Article 23(1) to (6). Equivalence is a substantive test, so record the specific provision of the sector act that meets each point, and flag any point it does not address. Note also whether the act gives NIS2 CSIRTs, competent authorities or single points of contact immediate access to notifications, since Article 4(2) requires it. The output is a mapping table with a clear verdict for each Article 21 and 23 element.
Record gaps and residual NIS2 obligations
Where the mapping shows a gap, or where an entity is not covered by a sector act, write down the NIS2 obligations that still apply and the national transposition law that implements them. Include the obligations for uncovered entities, such as governance under Article 20 and reporting to the national authority. Assign an owner and a remediation route for each gap. The output is a gap and residual obligations log that makes clear which duties the organization must still meet under NIS2 and which it meets under the sector act.
Confirm the national transposition and supervisor
Because NIS2 is a directive, the obligations that remain are set by the law of the Member State where the entity is established or where jurisdiction sits under the Article 26 rules. Confirm the transposition law, the competent authority and any national rules stricter than NIS2 under Article 5. Ask the national authority or local counsel to confirm where the register is incomplete. The output is a short jurisdiction note for each entity that names the law and the supervisor.
Obtain documented sign-off from management
Present the register, mapping, gap log and jurisdiction notes to the management body and the accountable executive. Record the decision on each entity, including the date and the people who approved it. The management body holds the accountability under Article 20, so the sign-off must come from them rather than from the project team. The output is a signed, dated analysis file with a version number, stored where it can be produced to a supervisor on request and reviewed when the entity structure or sector law changes.

What DORA takes over and what NIS2 still covers

Recital 28 of NIS2 treats DORA, Regulation (EU) 2022/2554, as the sector-specific act for financial entities. For those entities, DORA's ICT risk management, incident reporting, resilience testing, information sharing and ICT third-party risk rules replace the corresponding NIS2 duties, and the NIS2 supervision and enforcement provisions for the matching obligations do not apply. In practice, a bank or insurer should not build a separate NIS2 Article 21 and Article 23 program on top of its DORA program. It should map each NIS2 obligation to the DORA provision that covers it and confirm, in writing, that the DORA controls are at least equivalent in scope and reporting speed.

Partly covered groups need more care. Under Article 4(1), where a sector-specific act covers only some entities in a sector, NIS2 continues to apply to the entities it does not cover. A financial group may therefore have a regulated bank under DORA and an unregulated IT services subsidiary, or a non-financial affiliate, that still falls under NIS2 and its national law. Each legal entity in the group needs its own determination, and the boundary between DORA-covered ICT functions and NIS2-covered functions should be documented rather than assumed.

Confirm these boundaries with your competent authority and legal counsel before relying on them. The Commission's guidelines on applying Article 4(1) and (2) describe how the equivalence test is read, but national transposition laws and supervisors may take positions the guidelines leave open. Ask in writing which authority supervises each entity, which incident reporting channel applies, and whether any shared ICT service is treated under DORA, NIS2 or both. Record the answers in the compliance file so that an assessor can see how the decision was reached.

Evidence that supports a displacement position

A displacement position under Article 4 is only as strong as the paper behind it. The artifacts below show which entities are covered by a sector act, why that act is equivalent, and how the position stays accurate as laws and group structures change.

Entity scope register

A register listing each legal entity in the group, its sector, the sector-specific Union act that applies to it, and any entity the sector act does not cover. Article 4(1) allows NIS2 to continue for entities a sector act does not reach, so partial coverage is common in groups with mixed businesses. Ask each business unit to confirm its entity list annually and after any acquisition or reorganization. Record the owner and the date of each review.

Mapping memo against NIS2

A written memo comparing the sector act's risk-management and incident-reporting provisions with Article 21(1) and (2) and Article 23(1) to (6). The memo should show each NIS2 obligation, the matching provision in the sector act, and any gap that remains. Equivalence is tested on effect, not wording, so a gap must be addressed or the displacement position weakens. Have counsel review the memo before relying on it.

Supervisor confirmation of regime

Where a competent authority or a financial supervisor has confirmed in writing that the sector act governs the entity, keep that letter with the scope register. Where no such confirmation exists, record that fact and the reasoning behind the position. Ask the supervisor which regime it applies, and whether a national authority expects a separate NIS2 registration. Treat a verbal answer as a note, not as evidence.

Incident reporting equivalence procedure

A procedure showing that the sector act's incident reporting reaches the same bodies NIS2 would reach, with immediate access to notifications for the relevant CSIRT, competent authority or single point of contact. Map each reporting step, its deadline and its recipient. Test it with a tabletop exercise so the team can show the timelines are met in practice. Where the sector act's reporting is narrower, document the extra notification NIS2 would require.

Risk-management evidence set

The control records that show the sector act's risk-management requirements are being met, such as risk assessments, ICT third-party registers, resilience test reports and board-approved policies. Store each record with its owner, the requirement it satisfies and the review date. An assessor testing a displacement position will ask for these records, so keep them in the same location as the mapping memo.

Review log for law and structure changes

A dated log of every change that affects the position, including amendments to the sector act, Commission guidance, changes to the NIS2 text and changes to group structure. The Commission's guidelines and proposed NIS2 amendments can alter a position, so set a fixed review cycle and record who approved each outcome. Note any pending proposal, such as COM(2026) 13, as unconfirmed until adopted.

What the Article 4 analysis costs in money and effort

This table breaks the Article 4 analysis into its cost components, showing who is paid for each, whether it is one-time or recurring, and what drives it up. No fees or durations are published for this work, so use the questions in the final column when comparing written quotes. The main takeaway is that the scope of sector acts and entities matters more than the size of the document set.

Cost component	Who is paid or who does the work	One-time or recurring	What drives it and what to ask for in a quote
Legal review of sector acts	External counsel or in-house legal, sometimes with a national regulator's guidance	One-time, with periodic refresh	Number of sector-specific Union acts and national transpositions. Ask which acts and Member States the quote covers.
Internal analysis time	Compliance, security and business unit staff, paid internally	One-time, plus updates	Number of legal entities and business lines in scope. Ask the partner to name the staff roles and hours assumed.
Entity-by-entity mapping	Consultant or implementation partner preparing the mapping workbook	One-time per entity group	Count of entities and of overlapping obligations between NIS2 and the sector act. Ask for the mapping unit and what counts as one entity.
Supervisor engagement	Internal lead, with external counsel if a national authority is consulted	Often one-time, occasionally recurring	Number of competent authorities involved. Ask who attends meetings and who writes the position papers.
Evidence gathering for equivalence	Internal control owners, with partner support for evidence formatting	One-time, then recurring as controls change	Breadth of the sector act's requirements versus Article 21 and Article 23. Ask which equivalence tests are included.
Periodic review	Internal compliance function, optionally a retainer partner	Recurring	Changes to sector acts, national law, and the pending NIS2 amendments proposed in January 2026. Ask how updates are triggered and billed.
Tooling and records	Internal IT, or licensed or self-hosted tools deployed by a partner	Mostly one-time setup, recurring operation	Need to store mapping evidence and track changes. Ask whether tooling is included or charged separately.
Fixed-scope versus retainer terms	Written contract with the implementation partner	Set in the agreement	Whether scope, deliverables and timelines are fixed in writing before work starts. Ask for the exclusions list.

Who owns the scope decision and who can help

The management body owns the decision on whether Article 4 applies. Under NIS2, members of the management body must approve and oversee the cybersecurity risk-management measures, so a decision to rely on a sector-specific act is one they are expected to understand and sign off. The question is not whether an outside firm agrees with the reading, but whether the organization can show that its reasoning was made by the people accountable for it.

Approval of the position: Record the decision that the sector-specific act applies, with the date, the legal basis and the approving members.
Scope of the exemption: Confirm whether the sector-specific act covers all entities in the organization or only some of them, since NIS2 continues to apply to entities the act does not reach.
Ongoing oversight: Ask for periodic reporting on whether the position still holds after changes in services, group structure or supervisory guidance.
Liability awareness: Confirm that members understand their personal responsibilities under the directive's governance provisions.

Before approving, ask counsel to confirm the position against the national transposition law of each Member State where the organization operates.

Where the Article 4 position usually breaks down

Most organizations that conclude a sector act displaces NIS2 reach that conclusion too quickly. The gaps below share one root cause: the displacement applies to specific entities, specific obligations and specific conditions, and each condition must hold on its own.

Assuming the sector act covers the whole group

A sector-specific Union act often binds some entities in a group but not others, or covers one service line while leaving another untouched. Article 4 displaces NIS2 only for the entities the sector act actually reaches, so a group that treats every subsidiary as displaced may leave a non-financial or uncovered entity without any NIS2 program. Map each legal entity and each regulated activity against the sector act's scope before accepting the position. Closing action: produce a written entity-by-entity scope table, signed off by legal counsel, and keep it with the classification file.

Skipping the equivalence comparison

Displacement requires that the sector act impose risk-management measures at least equivalent to Article 21(1) and (2), or incident notification at least equivalent to Article 23(1) to (6). Organizations often assume that a regulated sector act is equivalent because it looks similar, then discover that a specific measure or reporting element has no counterpart. Compare each Article 21(2) measure and each Article 23 element with the sector act's text, and record where the match is partial. Closing action: complete a clause-by-clause equivalence memo and have it reviewed before relying on displacement.

Ignoring partly covered entities

Where a sector act covers only some entities in a sector, NIS2 continues to apply to the entities it does not cover. Teams sometimes read a sector label as a full exemption, which leaves uncovered entities outside both regimes. This gap is common in sectors where only certain licensed activities fall under the sector act. Identify which entities or activities sit outside the sector act and bring them into the NIS2 classification and governance process. Closing action: assign an owner to each uncovered entity and record its NIS2 status, essential or important, in the register.

Missing the immediate-access condition

Incident notification displaces NIS2 only when it is at least equivalent to Article 23(1) to (6) and gives NIS2 CSIRTs, competent authorities or single points of contact immediate access to the notifications. A sector regime that notifies a financial supervisor but gives no immediate access to the NIS2 authorities may fail this test even if its timelines look strong. Confirm with the sector regulator and your legal team how notifications reach each relevant NIS2 authority. Closing action: document the notification routing path and test it in an exercise before relying on it.

Failing to recheck after amendments

Displacement depends on the sector act as it stands, and both sector acts and NIS2 change over time. A supervisory technical standard, a delegated act or an amendment can widen, narrow or alter the equivalence analysis that justified the original position. The Commission's guidelines on applying Article 4 also need to be read alongside the current text of both instruments. Set a recurring review trigger tied to sector act amendments and to the Commission's NIS2 review cycle. Closing action: assign a named owner to monitor the EUR-Lex text of both acts and reissue the equivalence memo after each change.

Questions buyers ask about Article 4 and sector-specific laws

Does DORA remove NIS2 entirely for financial entities?

No, not automatically. Under Article 4(1), NIS2's matching provisions, including Chapter VII supervision and enforcement, stop applying to essential and important entities only where a sector-specific Union act imposes cybersecurity risk-management measures or incident notification with at least equivalent effect. Recital 28 treats DORA (Regulation (EU) 2022/2554) as such an act for financial entities, so DORA's ICT risk management, incident reporting, resilience testing, information-sharing and ICT third-party risk rules apply in place of NIS2's. The displacement has limits. Where DORA covers only some entities in a sector, NIS2 still applies to the entities it does not cover. Confirm with your competent authority how your specific entity type is treated.

How long does an Article 4 analysis take?

No researched duration is available for this analysis, so ask for a dated plan instead of relying on a general estimate. The effort depends on how many legal entities you have, how many sectors and Union acts apply to them, how group structures map to regulated activities, and how much current documentation already exists. Ask the provider for named milestones, the inputs they need from you, the people who must review each legal conclusion, and the point at which the analysis is considered final. A written timeline makes it easier to see which delays come from your own information gathering and which come from the work itself.

What does an Article 4 analysis cost and what drives the price?

The cost has four main components: internal staff time for gathering entity and service information, legal counsel review of the applicable sector acts, an external advisor's fee if you hire one, and any follow-on work to close gaps the analysis reveals. The mapping itself is usually a one-time effort, while costs recur when DORA, NIS2 or national rules change, when your group structure changes, or when you add entities or jurisdictions. The main drivers are the number of entities, the number of Member States involved, how complicated your regulated activities are, and how well your current controls are documented. When you ask for a quote, request a written scope with deliverables, stated assumptions, and a clear statement of which legal conclusions the organization must confirm itself.

Can our own team run the Article 4 analysis in-house?

Yes, many organizations prepare most of the analysis internally, and the organization is the party that must own the conclusion. Your compliance, risk and IT teams can inventory entities, services and ICT dependencies, and compare the requirements of each applicable sector act with the NIS2 provisions. Legal counsel is usually needed to confirm how a sector act applies to your entity type and jurisdiction. An implementation partner can help prepare the inventory, the mapping and the supporting evidence, but it does not decide the legal position. An independent auditor or assessor issues reports or certificates, and this analysis is not one of those outputs, so it should be documented as your own determination.

What do the Commission guidelines of 14 September 2023 add?

Article 4(3) required the Commission to issue guidelines on Article 4(1) and (2) by 17 July 2023, and the Commission published them on 14 September 2023. The guidelines explain how to apply the displacement rule and the equivalence test, which is the central question in any Article 4 analysis. Read them together with the Directive text and the sector act you are assessing, because the guidelines interpret the rule rather than replace it. Use them to structure your documented reasoning for each entity and sector, and check whether your national competent authority has published any further position on the same questions.

Must the Article 4 analysis be shared with authorities?

The sources supplied for this page do not state a general obligation to submit an Article 4 analysis to authorities, so do not assume one exists or that none exists. Check two things: your national transposition law, and any request your competent authority has made about how you determined your scope. Whether or not you submit it, keep a dated, signed record of the analysis, the sector acts considered, the equivalence reasoning and the people who approved it. That record is what you will need to answer a supervisor's information request quickly, and it shows the organization has decided deliberately which regime applies.

Does a sector law cover every entity in a sector?

No. Article 4(1) says that where a sector-specific Union act covers only some entities in a sector, NIS2 continues to apply to the entities it does not cover. A financial group, for example, may have some entities within DORA's scope and others outside it, and those outside it remain subject to NIS2 if they fall within NIS2's scope in the first place. Map each legal entity separately instead of applying one conclusion to the whole group. Record which entities fall under which regime, because supervision and reporting duties follow the regime that applies to each entity.

How do we show equivalence between DORA and NIS2 measures?

Equivalence is tested against two alternatives in Article 4(2). The first is whether the sector act's risk-management measures are at least equivalent to Article 21(1) and (2) of NIS2. The second is whether its incident notification is at least equivalent to Article 23(1) to (6), and that notification gives immediate access to notifications for the NIS2 CSIRTs, competent authorities or single points of contact. Build a table that maps each Article 21(2) measure to the corresponding DORA requirement and records the evidence for it. For incident reporting, verify the notification timing and the access arrangements separately, because equivalent content alone does not satisfy the second limb.

How DeployOpen prepares Article 4 evidence

DeployOpen's role starts with the inputs that a legal decision needs, not with the decision itself. Before any work begins, the organization's compliance or legal owner states which sector-specific Union act it relies on, which entities or business lines that act covers, and which parts of the group remain under NIS2. DeployOpen then inventories the systems, platforms and records that support those entities, including ICT assets, network segments, logging sources, incident tooling and the third-party services they depend on. The output is a written system and record register that shows where each regime's obligations land, so the legal owner can check the boundaries against the Article 4(1) and (2) analysis and the Commission guidelines before anyone relies on them.

Once the boundary is confirmed, DeployOpen prepares a mapping workbook and evidence packs for the requirements that the organization has agreed to meet. The mapping links each obligation under the chosen regime to the controls, configurations and records in the self-hosted platforms, along with the owner, the test method and the artifact that proves it. Typical artifacts include access review exports, backup restore logs, vulnerability scan reports, change tickets and detection rule inventories. Where a platform does not produce the evidence an auditor or competent authority would expect, the gap goes into the register rather than being papered over. Confirm with the organization's supervisor or assessor which format they accept, because the ENISA technical guidance is non-binding and does not replace their expectations.

For incident reporting, DeployOpen configures and tests the logging, alerting and ticketing workflows that feed the organization's reporting process, and runs a tabletop exercise against the decision points for the early warning, notification and final report. It does not decide whether an incident is significant or which authority receives a notification. Those decisions stay with the organization and, where DORA applies, with the process its own legal analysis sets out. DeployOpen does not determine legal scope, does not issue reports or attestations, and does not act as the regulator's contact. Engagements are fixed-scope: the systems, records, mapping depth and test exercises are agreed in a written quote before work starts, and ongoing support is a separate retainer.

Article 4 Sector-specific Union legal acts