What NIS2 Article 33 asks of important entities
If your organization is an important entity under NIS2, Article 33 is the ex post regime: national competent authorities generally do not inspect you on a fixed schedule. They act when they receive evidence, indications or information that you allegedly do not comply, in particular with the risk-management duties in Article 21 and the reporting duties in Article 23. The absence of an inspection date does not mean you are outside supervision. It means the trigger is a signal, and that signal can come from an incident report, a complaint, a supplier, a market observation or another authority. Your job is to be able to answer a supervisor's questions with records you already hold, without a scramble.
The same Article 21 and Article 23 duties apply to essential and important entities alike. The difference lies in when authorities look. Essential entities face ex ante supervision, with routine inspections and audits before any problem is alleged. Important entities face ex post supervision, so the authority can open a case on indications alone. That makes the risk for an important entity less about a planned audit and more about a sudden request for evidence on a short timeline. Confirm with your national competent authority how it receives signals, what it expects in a first information request, and whether it publishes guidance on the form of evidence it accepts.
The regime is hard in practice because you must prove compliance from records that already exist, and those records are often scattered. Policies may live in a wiki, risk assessments in a spreadsheet, patch evidence in a ticketing tool and supplier reviews in email. A supervisor will test whether the evidence is current, traceable to a named owner and consistent with what was actually done. Start by mapping each Article 21 measure to the artifact that proves it, the owner who keeps it current and the date it was last reviewed. Then decide in advance whether you can produce that bundle yourself or whether an independent body will be needed, because for targeted audits the important entity may bear the cost of that independent body.
Which important entities face NIS2 Article 33 supervision
Article 33 applies only after an entity is classified as important, so the classification decision comes first. The cards below cover the scoping questions that determine whether an entity falls under ex post supervision, which authority holds jurisdiction, and which rules apply in practice.
Classification as important under Article 3
Article 3 sorts in-scope entities into essential and important categories. An entity that is in scope but not essential is important, and it then faces the ex post regime in Article 33 rather than the ex ante regime in Article 32. Confirm the classification in writing with your national competent authority or your legal counsel, because the category drives which inspection powers, audit rights and enforcement tools can be used against you. Record the reasoning, including the size and sector tests that placed you in the category, so the file can be produced if an authority asks.
Annex I or Annex II sector
NIS2 covers 18 sectors, split between 11 sectors of high criticality in Annex I and 7 other critical sectors in Annex II. The sector an entity sits in shapes which entity types are covered and how authorities expect risk to be managed. Map each business line to a sector and subsector separately, because a group can have entities in both annexes. Mapping errors at this stage often carry forward into the evidence an authority will request during an information request or inspection.
Member State jurisdiction
NIS2 is a directive, so the national transposition law of a Member State determines which authority supervises you. Jurisdiction usually follows where the entity is established, with specific rules for some digital providers and for entities that operate in several countries. Organizations with group structures across borders need a written jurisdiction analysis that names the lead authority and any others that may request information. Confirm the current national law and its effective date with the authority, since transposition details differ between countries.
Sector-specific laws that displace NIS2
Some sectors already have EU rules with equivalent cybersecurity and incident reporting duties. Where a sector-specific act applies, it may displace parts of NIS2 for that entity, which changes both the supervisor and the evidence you need to produce. Identify every sector law that touches your operations, including financial sector rules, and check whether it names the authority that supervises the cybersecurity obligations. Document the outcome so it is clear which regime governs each system and each report.
Status of the January 2026 proposal
On 20 January 2026 the Commission proposed targeted amendments to NIS2 (COM(2026) 13), including a new small mid-cap category. The proposal still needs approval by the European Parliament and the Council, so it does not change your obligations today. Track the proposal, but base current planning on your national transposition law. Ask your authority which text applies to you and whether any amendment would move your entity between the essential and important categories.
How an authority tests an important entity after a trigger
This table compares the Article 33(2) supervisory powers by test approach, the evidence an authority typically requests and the findings that tend to follow. Read it as the sequence an authority can use once it holds evidence or information that an important entity may not comply with Articles 21 or 23, and note the three powers the regime leaves out.
| Supervisory power | Test approach | Evidence requested and common findings |
|---|---|---|
| On-site inspection | Authority staff visit premises after a trigger and examine systems, processes and records in person | Asset inventories, access records and incident logs; common findings include undocumented controls and policies that do not match practice |
| Off-site ex post supervision | Authority reviews submitted material remotely without visiting the entity | Risk management policies, board approvals and training records; common findings include gaps between written policy and operated controls |
| Targeted security audit | Audit focused on the specific Article 21 or 23 concern behind the trigger, performed by a qualified independent body | Auditor reports, test results and remediation plans; the important entity usually pays unless the authority decides otherwise in substantiated cases |
| Security scan | Objective, non-intrusive scanning of exposed systems to identify known weaknesses | Scan output and patch status; common findings include unpatched public-facing services and outdated configurations |
| Information and document requests | Authority asks for specific records, data or explanations tied to the alleged non-compliance | Policies, risk assessments, incident reports and supplier contracts; common findings include missing or late documents |
| Request for qualified auditor results | Authority asks for evidence from an earlier security audit carried out by a qualified auditor | Audit reports and evidence of remediation; confirm with the authority which auditor qualifications it accepts |
| Absent: random checks | Not available for important entities under Article 33(2), unlike essential entities under Article 32(2) | No routine unannounced checks; authorities act on evidence, indications or information of non-compliance |
| Absent: regular security audits | Not available for important entities under Article 33(2), unlike essential entities under Article 32(2) | Ex post audits follow a trigger rather than a fixed cycle, so readiness depends on maintaining current evidence |
| Absent: ad hoc audits | Not listed for important entities under Article 33(2), unlike essential entities under Article 32(2) | Targeted audits remain available, so keep evidence for Articles 21 and 23 current, not only for the moment of inspection |
What responding to NIS2 Article 33 supervision costs
This table compares the main cost components of answering an ex post supervisory request under Article 33 and marks each as one-time or recurring. Read the recurring rows as the cost of keeping evidence ready, since that upkeep is what keeps a response fast when an authority acts on indications of non-compliance. The key takeaway is that the largest variable cost is the independent targeted audit, which the important entity pays for unless the authority decides otherwise in duly substantiated cases.
| Cost component | Who is paid or who carries it | One-time or recurring | What drives it up or down |
|---|---|---|---|
| Staff time to assemble evidence on request | Internal security, IT and compliance staff | Recurring, incurred each time a request arrives | Number of in-scope systems, quality of indexed records, how many documents the authority asks for |
| Legal and compliance review of responses | Internal legal counsel or an external adviser paid by the hour | Recurring, incurred per request or inspection | Scope of the authority's request, whether the information touches incident reporting or other proceedings |
| Remediation engineering | Internal engineers or an implementation partner under a written scope | One-time per finding, sometimes recurring if controls need re-testing | Number and severity of gaps the authority identifies, state of existing configurations and documentation |
| Independent targeted audit by a qualified body | Paid by the important entity under Article 33(2), unless the authority decides otherwise in duly substantiated cases | Recurring whenever the authority orders a targeted audit | Size of the audited scope, depth of the audit, and whether the authority's justification for shifting cost applies |
| Ongoing evidence upkeep | Internal owners, with optional support from an implementation partner | Recurring, budgeted across the year | Estate size, change rate, whether evidence is produced automatically or collected by hand each time |
| Management time for oversight | Management body and accountable executives | Recurring during any active supervisory matter | Number of open findings and whether the matter escalates to enforcement measures |
Self-hosted open-source tools that hold the evidence
Article 33 supervision turns on what an authority can see when it asks for documents, audit results or proof of past controls. The three tools below can hold that evidence inside your own infrastructure, each covering a different layer: compliance mapping, the written record of policies and procedures, and access control over who can read or change them. Each one needs a license and fit check before deployment.
Compliance mapping and assessments
CISO Assistant ships more than 200 frameworks, including NIS2, and runs audits and compliance assessments against them with automatic mapping between frameworks. For an important entity, this is the place to record which Article 21 measures are implemented, which evidence supports each one, and which gaps remain before an authority's information request arrives. Check the AGPL-3.0-only license with your legal team, since running a modified copy as a network service can trigger source disclosure duties. Confirm that the NIS2 framework content matches the version your counsel uses for scoping.
Version-controlled policy records
XWiki keeps every change to a page under version control, recording what changed, when and by whom. Users can compare any two versions and roll back to an earlier one. When a supervisor asks which incident response procedure was in force on a given date, this history answers the question without reconstruction from memory. Confirm the LGPL-2.1-or-later terms against how you plan to link or extend the platform, and test that restored versions still render correctly with your access rules.
Role-based access to documentation
BookStack gives each user abilities derived from assigned roles, and permissions can be overridden per role at the shelf, book, chapter or page level. For Article 33, this lets you restrict sensitive material such as incident records or supplier audit reports to named staff, while the wider organization reads the general policies. Document who holds each role and why, because an authority reviewing access will ask. Verify the MIT license terms are acceptable to your procurement team and check that overrides are set at the level you intend.
Who does what when an authority opens a case
Your organization remains the regulated entity. Under Article 33, the authority acts on evidence, indications or information that you allegedly do not comply with Articles 21 and 23, so the case is built around your own controls, records and decisions. Management is accountable for the response, and no partner or auditor can answer the authority on your behalf.
- Owning the controls: The Article 21 measures, their design and their operation remain your responsibility, including the risk assessment behind them.
- Answering information requests: Your team decides what is provided, when and in what form, and signs off on the explanation given to the authority.
- Deciding what to disclose: Choices about incident details, disclosure to affected parties and public statements stay with management and counsel.
- Keeping the evidence trail: Logs, approvals, policy versions and records of past incidents must be retrievable on request.
- Paying for targeted audits: Unless the authority decides otherwise in duly substantiated cases, the important entity bears the cost of a targeted audit by an independent body. Ask counsel to confirm how this applies in your Member State.
Before a case opens, confirm with counsel which national authority supervises you and what its procedures require.
An implementation partner such as DeployOpen can prepare the systems and evidence an authority or auditor will ask for. The work happens inside your own cloud accounts, data centers or air-gapped networks, and it is scoped and agreed in writing before it starts. The partner does not issue reports, attestations or certificates, and it does not speak for the independent auditor.
- Preparing evidence packs: Assembling configuration records, access reviews, backup results and change logs in a form that matches the control being examined.
- Running targeted security testing: Application, infrastructure and API testing performed in your environment, with findings delivered to your team.
- Hardening and documenting systems: Remediating gaps identified in the readiness review and keeping the system documentation current.
- Supporting the response: Helping your staff locate records and reproduce the state of a system at a past date.
- Respecting auditor independence: The partner may fix a finding, but it cannot edit an auditor's conclusions, rewrite a finding after the fact or select only favorable evidence.
Ask any partner to state in writing which outputs it prepares and which outputs only an independent body may issue.
The independent body performs the targeted security audit or qualified auditor review that the authority may require. Its independence is what gives the result weight, so it sets its own method, sample and conclusions. The authority decides whether an audit is needed, and the body reports its results under its own name.
- Performing targeted audits: The body tests the areas the authority has named, using its own procedures and sampling.
- Issuing the audit result: Findings, ratings and conclusions come from the body and are not edited by the entity or its partner.
- Reviewing evidence independently: Qualified auditor results supplied to the authority reflect the body's own testing, not a summary prepared by the entity.
- Setting scope within the request: The body works within the scope the authority defines, and changes to scope go back through that authority.
- Being selected under the rules: Confirm with your national authority which bodies are accepted and how they are appointed, since the rules vary by Member State.
Before engaging an auditor, confirm its independence from your implementation partner, since a conflict would weaken the result.
Article 20 places oversight of the Article 21 measures with the management body, and that oversight becomes visible during a case. Management approves the response strategy, accepts the residual risk in any finding and carries liability for infringements. Delegated technical work does not transfer that responsibility.
- Approving the response strategy: Management decides whether to contest a finding, accept it or agree a remediation plan.
- Accepting residual risk: Any finding left open needs a documented decision by an accountable executive.
- Setting disclosure posture: Decisions on public statements and communication with customers are made by management with legal input.
- Keeping records of oversight: Board or committee minutes, training records and approvals show that the body actually oversaw the measures.
- Staying accountable for outsourced work: Outsourcing a task does not outsource the duty to ensure it is done.
Check with counsel which management duties apply in your Member State and whether training records are in place before any case starts.
Where important entities fall short under Article 33
Important entities face ex post supervision, so authorities act when they receive evidence or information that an entity allegedly does not comply with Articles 21 or 23. The gaps below are the ones that tend to turn a routine information request or targeted audit into a finding, and each one has a closing step that can start this quarter.
Evidence that lives in people's heads
Article 33 powers include requests for documents and evidence, and an authority will not accept a verbal explanation of how a control works. Check whether each Article 21 measure, such as access reviews, patching and backups, has a written procedure and a dated record that shows it ran. Start by picking three controls and asking the owner to produce the last two records for each. If the records cannot be found within a day, the evidence gap is real.
Policies the management body never approved
Article 20 places approval and oversight of the Article 21 measures with the management body. A policy signed only by the security team can fail when an authority asks for proof of approval. Check each cybersecurity policy for an approval date, the approving body and the minutes that record the decision. Start by putting the current policy set on the next board or management agenda and recording the approval.
Incident records that differ from what was reported
When an authority compares an incident file with the early warning, notification or final report, any mismatch in times, scope or impact invites follow-up. Check whether the incident register, the ticketing system and the reports sent to the authority share the same identifiers and timestamps. Start by reconciling the last reported incident line by line, and fix the template so every report draws its facts from the register.
No owner for information requests
An information request from a competent authority carries a deadline, and an unassigned request can miss it while the team is still searching for who holds the data. Check that a named person, with a deputy, receives supervisory correspondence and has authority to gather evidence across IT, legal and operations. Start by writing a one-page response procedure that names the owner, the deputy and the escalation path to the management body.
No budget for a targeted independent audit
Under Article 33(2), an important entity pays for a targeted audit by an independent body unless the authority decides otherwise in duly substantiated cases. Many entities learn this only after a request arrives. Check whether the budget covers an audit by a qualified independent body, the internal staff time to support it and the remediation that follows. Start by asking two or more qualified auditors for written scope and fee proposals so the cost is known before it is needed.
Questions about NIS2 Article 33 supervision
Will an important entity be inspected without warning under NIS2?
Not as a routine matter. Under Article 33, a national competent authority acts ex post, meaning after the fact, when it receives evidence, indications or information that an important entity allegedly does not comply, in particular with Article 21 (risk management) or Article 23 (incident reporting). The trigger is therefore a signal about possible non-compliance, not a fixed inspection cycle. The authority may then use on-site inspections, off-site ex post supervision, targeted security audits, security scans, information requests or requests for evidence such as results from a qualified auditor. Member States set the detailed procedure in their transposition laws, so confirm the process with the competent authority in your Member State.
Who pays for a targeted security audit of an important entity?
Under Article 33(2), the important entity pays for targeted security audits carried out by an independent body, unless the authority decides otherwise in duly substantiated cases. Cost therefore depends on the audit's scope, the number of systems and processes examined, the body's fees and how many follow-up audits are needed. Ask the authority or your national transposition law whether a specific audit may be charged to you and on what basis. If you need to prepare, budget for the independent body's fees, your internal staff time to gather evidence, and any remediation the audit findings require. Audit fees are typically one-time per audit, while the internal program to keep evidence current recurs. Request a written scope and fee basis from any provider before work starts.
How long does an important entity have to respond to a supervisory request?
The NIS2 facts available for this page do not set a fixed response period for information requests or audit follow-up, so do not plan around a number taken from secondary sources. The response window is set by the competent authority's request and by national law, and it may differ by Member State and by the type of measure. When a request arrives, ask the authority in writing for the deadline, the format of the evidence it expects and whether it accepts a phased response. Keeping evidence current and indexed before any request arrives is the practical way to shorten your response time.
Can an important entity prepare its own evidence for supervision?
Yes. The organization owns its controls and is responsible for showing that they operate, so an internal team can assemble policies, risk assessments, access records, change logs, incident records and training evidence. Useful practices include:
- Mapping each Article 21 measure to a named owner, a policy and the records that prove it works.
- Keeping document history so you can show what changed, when and by whom.
- Using a compliance tool to track assessments against NIS2 and related frameworks.
An implementation partner such as DeployOpen can prepare systems, controls and evidence on self-hosted open-source platforms, for example with CISO Assistant for tracking assessments or XWiki for version-controlled policy documents. Only an independent auditor or authority-appointed body issues audit reports or findings.
What does NIS2 Article 33 require from management?
Management remains accountable. Article 20 places duties on the management body to approve and oversee the Article 21 risk-management measures, and those duties apply whether or not the entity is later supervised. When an authority opens an ex post case, management needs to know the status of the case, approve the remediation plan and make resources available for evidence gathering and fixes. Practical steps include assigning a named owner for supervisory contact, setting a reporting cadence to the board, and confirming that members have received the cybersecurity training that Article 20 requires. Delegating the technical work to an advisor or service provider does not transfer the legal accountability.
How does supervision of important entities differ from essential entities?
The difference lies mainly in when the authority acts and which powers it can use. Essential entities face ex ante supervision under Article 32, including random checks, regular security audits, targeted and ad hoc audits. Important entities face ex post supervision under Article 33, which omits random checks, regular audits and ad hoc audits from the powers list. On enforcement, Article 33(4) omits the monitoring officer and the temporary suspension and management prohibition measures that apply to essential entities under Article 32(4) and (5). Both categories face the same Article 21 and Article 23 obligations and the fine ceilings in Article 34, so compliance work should not be scaled down for important status. Compare the two articles directly on EUR-Lex.
How DeployOpen prepares for NIS2 Article 33 supervision
DeployOpen works with important entities to prepare the systems, controls and evidence that a competent authority may request once it has indications of non-compliance with Articles 21 or 23. We plan and document the work inside your own infrastructure, and an independent auditor or the authority, not DeployOpen, assesses and reports on the result.
How we scope
- We agree a written, fixed scope covering which systems, sites and Article 21 measures the Article 33 evidence must reflect.
- We confirm which evidence types your authority could request, such as information, documents and qualified auditor results.
- We record the boundaries of responsibility so your management body, internal staff and any outside party know who owns each control.
How we build
- We configure self-hosted open-source platforms in your cloud accounts, data centers or air-gapped networks to generate audit-ready records.
- We run security testing and targeted checks against in-scope systems so gaps are found and documented before any authority review.
- We integrate logging, access records and change history so the evidence for each Article 21 measure can be traced back to a source.
How we hand over
- We deliver written documentation, runbooks and an evidence map that show where each control's proof is stored and how to retrieve it.
- We train your named staff to produce, update and explain evidence so the organization does not depend on DeployOpen to respond to requests.
- We agree with you the format for presenting evidence to an auditor or authority, while the organization keeps ownership of its controls.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after the fixed-scope work is complete.
- We can update the evidence set when your systems change, when Implementing Regulation (EU) 2024/2690 guidance is applied, or when national rules are adopted.
- Ask us to confirm in writing which post-handover tasks a retainer covers and how requests from your authority will be routed.
