NIS2 in Greece

Key facts at a glance

These ceilings come from the directive — see how NIS2 fines are calculated, recent enforcement cases and director personal liability.

Is your company in scope? Common Greece scenarios

Two worked examples of how NIS2 scoping plays out in Greece. Not sure where you land? Run the free NIS2 scope checker.

What Greece businesses need to know

• Greece transposed NIS2 with Law 5160/2024, published in ΦΕΚ Α΄ 195 on 27 November 2024 and in force from that day (Art. 45(1)). It repealed Arts. 1 to 16 of Law 4577/2018, the NIS1 transposition, and its implementing Decision 1027/2019 (Art. 32).

• The Εθνική Αρχή Κυβερνοασφάλειας, the National Cybersecurity Authority (NCSA), is a legal person of public law supervised by the Minister of Digital Governance (Law 5086/2024, Art. 3(1)) and the supervisory and audit authority for NIS2 (Art. 23(1)). It is also the CSIRT for the entities in scope; for the public-sector bodies of Art. 3(2)(στ) the CSIRT is the National CERT of the National Intelligence Service (Art. 10(1)).

• Scope follows Recommendation 2003/361/EC: entities of the types in Annexes I and II that are medium-sized or larger and established or active in Greece (Art. 3(1)). Public e-communications providers, trust service providers, TLD registries, DNS providers, central government, first- and second-tier local authorities, critical entities and domain name registration services are in scope at any size (Art. 3(2) to (4)); first-tier local authorities only from 27 November 2026.

• Essential entities (βασικές) are Annex I entities above the medium-sized ceilings, qualified trust service providers, TLD registries and DNS providers of any size, public e-communications providers that are medium-sized, central government, entities identified as essential under Art. 3(2)(β) to (ε), critical entities and the operators of essential services identified under Law 4577/2018 before 16 January 2023 (Art. 4(1)). Every other entity of Annex I or II in scope is important (σημαντική) (Art. 4(2)).

• Registration: entities submit their name, contact details, IP ranges, domain names, sector and the other Member States where they provide services within scope (Art. 4(3)) on nis2register.cyber.gov.gr, reached through gov.gr with TAXISnet credentials (ΚΥΑ 1381/2025); the form names their security officer, the Υ.Α.Σ.Π.Ε. (ΚΥΑ 1990/2025). The window, extended three times, closed on 30 September 2025, and changes are notified within two weeks (Art. 4(4)).

• Significant incidents are notified to the Authority's CSIRT. From the moment the entity becomes aware of the incident: a warning (προειδοποίηση) within 24 hours, an incident notification (κοινοποίηση περιστατικού) within 72 hours, an interim report if the Authority asks, and a final report (τελική έκθεση) at the latest one month after the notification (Art. 16(4)). Trust service providers inform the Authority within 24 hours. The Authority's incident page takes its two report forms by e-mail at [email protected].

• Every essential and important entity appoints a Υ.Α.Σ.Π.Ε., an executive of its own, who handles all contact with the Authority (Art. 15(5)(α)); under ΥΑ 1899/2025 the role may go to an executive of another company of the same group, never to the DPO or to the entity's ICT manager. Essential entities file a single cybersecurity policy (ενιαία πολιτική κυβερνοασφάλειας) for approval at least once a year (Art. 15(5)(β)); no standard template under Art. 30(14) appeared on the Authority's site on 29 October 2026.

• ΚΥΑ 1689/2025 sets out the measures in 22 requirement articles (Arts. 4 to 25) binding both classes, with additional measures for essential entities and no maturity levels. Both classes run external penetration tests at least once a year and an annual self-assessment whose results go to the Authority with a corrective action plan (Art. 18(1)).

NIS2 in Greece: frequently asked questions

Is NIS2 in force in Greece?

Yes. Law 5160/2024 was published in ΦΕΚ Α΄ 195 on 27 November 2024 and applies from that day (Art. 45(1)); ΚΥΑ 1689/2025, the National Cybersecurity Requirements Framework, applies since 6 May 2025. One part of the scope starts later: first-tier local authorities come in on 27 November 2026 (ΚΥΑ 2267/2025).

Who supervises NIS2 in Greece, and where do incidents go?

The National Cybersecurity Authority (Εθνική Αρχή Κυβερνοασφάλειας) is the supervisory and audit authority (Art. 23(1)) and the CSIRT for the entities in scope (Art. 10(1)). Significant incidents go to its CSIRT: its incident page asks for the 24-hour form and the 72-hour and final-report form by e-mail at [email protected]. Public-sector bodies notify the National CERT of the National Intelligence Service instead and inform the Authority at the same time (Art. 16(1)).

How did Greek entities have to register, and by when?

On the Authority's platform, nis2register.cyber.gov.gr, reached through gov.gr with the entity's TAXISnet credentials; ΚΥΑ 1381/2025 also provides an e-mail route, [email protected]. The law gave two months from entry into force (Art. 4(3)), and three joint ministerial decisions extended that window, last to 30 September 2025 (ΚΥΑ 1990/2025). The form names the entity's Υ.Α.Σ.Π.Ε. and its linked and partner enterprises, and changes are notified within two weeks (Art. 4(4)).

What is a Υ.Α.Σ.Π.Ε. and who can hold the role?

The Υπεύθυνος Ασφάλειας Συστημάτων Πληροφορικής και Επικοινωνιών is the security officer every essential and important entity appoints from its own executives, and handles all contact with the Authority (Art. 15(5)(α)). ΥΑ 1899/2025 allows an executive of another company of the same group; requires a relevant degree, five years of expertise, or certified knowledge with two years of expertise, plus a criminal-record extract and background checks; and makes the role incompatible with the DPO and with the entity's ICT manager. The Υ.Α.Σ.Π.Ε. reports directly to top management.

How high are NIS2 fines in Greece?

For breaches of the risk-management or incident-reporting duties (Arts. 15 and 16), up to EUR 10 million or 2% of total worldwide annual turnover for essential entities and up to EUR 7 million or 1.4% for important entities, whichever is higher (Art. 26(4) and (5)). The law adds a tariff per obligation, for instance up to EUR 200,000 for the management body's duty to approve the measures and up to EUR 100,000 for the training duty (Art. 26(9)); public-sector bodies face fines from EUR 20,000 to EUR 500,000 (Art. 26(8)). The Administrator decides after a hearing, and fines are published on the Authority's website (Art. 26(2) and (3)).

What does ΚΥΑ 1689/2025 add to the NIS2 measures in Greece?

It sets out the measures of Art. 15(2) of Law 5160/2024 in 22 requirement articles (Arts. 4 to 25) binding both classes, with additional measures for essential entities and no maturity levels. It requires at least eleven thematic policies, external penetration tests at least once a year, and an annual self-assessment, using a Guide the Authority issues, whose results are sent to the Authority with a corrective action plan (Art. 18(1)). On 29 October 2026 none of the self-assessment tools on the Authority's site was presented as that Guide.