NIS 2-direktivet artikel 26
Dansk sprogudgave pr. 2026-10-06 tier 3 Direktiv (EU) 2022/2555, CELEX 32022L2555
Jurisdiktion og territorialitet
stk. 1 Enheder, der er omfattet af dette direktivs anvendelsesområde, anses for at henhøre under jurisdiktionen i den medlemsstat, hvor de er etableret, med undtagelse af: a) udbydere af offentlige elektroniske kommunikationsnet eller af offentligt tilgængelige elektroniske kommunikationstjenester, som anses for at henhøre under jurisdiktionen i den medlemsstat, hvor de leverer deres tjenester b) DNS-tjenesteudbydere, topdomænenavneadministratorer, enheder, der leverer domænenavnsregistreringstjenester, og udbydere af cloudcomputingtjenester, af datacentertjenester, af indholdsleveringsnetværk, af administrerede tjenester, af administrerede sikkerhedstjenester, af onlinemarkedspladser, af onlinesøgemaskiner eller af platforme for sociale netværkstjenester, som anses for at henhøre under jurisdiktionen i den medlemsstat, hvor de har deres hovedforretningssted i Unionen i henhold til stk. 2 c) offentlige forvaltningsenheder, som anses for at henhøre under jurisdiktionen i den medlemsstat, der har oprettet dem.
stk. 2 Med henblik på dette direktiv anses en enhed som omhandlet i stk. 1, litra b), for at have sit hovedforretningssted i Unionen i den medlemsstat, hvor beslutningerne vedrørende foranstaltningerne til styring af cybersikkerhedsrisici overvejende træffes. Hvis en sådan medlemsstat ikke kan fastslås, eller hvis sådanne beslutninger ikke træffes i Unionen, anses hovedforretningsstedet for at være i den medlemsstat, hvor der udføres cybersikkerhedsoperationer. Hvis en sådan medlemsstat ikke kan fastslås, anses hovedforretningsstedet for at være i den medlemsstat, hvor den pågældende enheds forretningssted med det største antal ansatte i Unionen er beliggende.
stk. 3 Hvis en enhed som omhandlet i stk. 1, litra b), ikke er etableret i Unionen, men udbyder tjenester inden for Unionen, skal den udpege en repræsentant i Unionen. Repræsentanten skal være etableret i en af de medlemsstater, hvor tjenesterne tilbydes. En sådan enhed anses for at høre under den medlemsstats jurisdiktion, hvor repræsentanten er etableret. Hvis der ikke findes en repræsentant i Unionen, der er udpeget i henhold til dette stykke, kan enhver medlemsstat, hvor enheden leverer tjenester, tage retlige skridt mod enheden for overtrædelse af dette direktiv.
stk. 4 Det forhold, at en enhed som omhandlet i stk. 1, litra b), har udpeget en repræsentant, forhindrer ikke, at der kan tages retlige skridt mod enheden selv.
stk. 5 Medlemsstater, der har modtaget en anmodning om gensidig bistand vedrørende en enhed som omhandlet i stk. 1, litra b), kan inden for rammerne af denne anmodning træffe passende tilsyns- og håndhævelsesforanstaltninger over for den pågældende enhed, der leverer tjenester eller har et net- og informationssystem på deres område.
English language version pr. 2026-10-06 tier 3 Direktiv (EU) 2022/2555, CELEX 32022L2555
Jurisdiction and territoriality
stk. 1 Entities falling within the scope of this Directive shall be considered to fall under the jurisdiction of the Member State in which they are established, except in the case of: (a) providers of public electronic communications networks or providers of publicly available electronic communications services, which shall be considered to fall under the jurisdiction of the Member State in which they provide their services; (b) DNS service providers, TLD name registries, entities providing domain name registration services, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, as well as providers of online marketplaces, of online search engines or of social networking services platforms, which shall be considered to fall under the jurisdiction of the Member State in which they have their main establishment in the Union under paragraph 2; (c) public administration entities, which shall be considered to fall under the jurisdiction of the Member State which established them.
stk. 2 For the purposes of this Directive, an entity as referred to in paragraph 1, point (b), shall be considered to have its main establishment in the Union in the Member State where the decisions related to the cybersecurity risk-management measures are predominantly taken. If such a Member State cannot be determined or if such decisions are not taken in the Union, the main establishment shall be considered to be in the Member State where cybersecurity operations are carried out. If such a Member State cannot be determined, the main establishment shall be considered to be in the Member State where the entity concerned has the establishment with the highest number of employees in the Union.
stk. 3 If an entity as referred to in paragraph 1, point (b), is not established in the Union, but offers services within the Union, it shall designate a representative in the Union. The representative shall be established in one of those Member States where the services are offered. Such an entity shall be considered to fall under the jurisdiction of the Member State where the representative is established. In the absence of a representative in the Union designated under this paragraph, any Member State in which the entity provides services may take legal actions against the entity for the infringement of this Directive.
stk. 4 The designation of a representative by an entity as referred to in paragraph 1, point (b), shall be without prejudice to legal actions, which could be initiated against the entity itself.
stk. 5 Member States that have received a request for mutual assistance in relation to an entity as referred to in paragraph 1, point (b), may, within the limits of that request, take appropriate supervisory and enforcement measures in relation to the entity concerned that provides services or which has a network and information system on their territory.