NIS2 in Greece

Who supervises you

National Cybersecurity Authority is the competent authority designated by Greece. It holds the article 32 and 33 supervisory powers: inspections and audits, requests for information and evidence, binding instructions, orders to remedy deficiencies, and administrative fines. For essential entities those powers are exercised ex ante — without needing any indication of non-compliance.

Incident notifications under article 23 normally go to CSIRT-GR, though some member states route them through the competent authority instead. Confirm the channel before you need it: the 24-hour clock is not the moment to discover which portal applies.

What differs from the directive

Because NIS2 is a directive, Greece legislated its own version of it. The security baseline in article 21 is common across the Union and will not differ. What does differ:

• Registration. The portal, the information required and the deadline are national.
• Scope. Several member states extended coverage below the directive's size thresholds, or added sectors of national importance.
• Penalty calibration. The article 34 ceilings are common; how the authority calibrates within them is not.
• Reporting format. Deadlines are fixed by the directive; the form and the language are national.

If you operate in several member states

You have one security programme and several compliance relationships. Registration, supervision and reporting are per-jurisdiction, and a cross-border incident can require filings in each affected member state. Article 26 sets jurisdiction rules — generally the member state of establishment, with specific rules for digital providers.