Greece NIS2 Transposition (Law 5160/2024)

Greek law transposing NIS2 with the National Cybersecurity Authority as competent authority.

Analysis

Greek Law 5160/2024 is the primary national statute transposing the NIS2 Directive (EU) 2022/2555 in Greece and designates the National Cybersecurity Authority (NCSA / Εθνική Αρχή Κυβερνοασφάλειας) as the single competent authority, single point of contact, national CSIRT, and cyber‑crisis management body for NIS2 supervision and enforcement.NCSANIS2 page – NCSAEU NIS2 DirectiveDigital Strategy – NIS2 Greece

Key Requirements (Law 5160/2024 – Greek NIS2 Transposition)

Note: Law 5160/2024 is published in the Government Gazette A’ 195/27.11.2024 and formally titled “Incorporation of Directive (EU) 2022/2555 … on measures for a high common level of cybersecurity across the Union.”NCSA NIS2 pageEY – Law 5160/2024 overviewLexology article on Law 5160/2024 (PDF)

1. Scope: Essential & Important Entities in Critical Sectors

• Law 5160/2024 fully transposes NIS2 and applies to essential and important entities across sectors such as energy, transport, banking, health, digital infrastructure, public administration, and others defined in NIS2.NCSA NIS2 pageEU NIS2 Directive – AnnexesCybersecurity in Greece overview
• The law replaces the prior NIS1-based regime and expands the number of entities in scope (often estimated around several thousand organisations).NIS 2 in Greece – transposition summaryNIS2 Greece – NIS Solutions summary

2. Central Competent Authority: National Cybersecurity Authority (NCSA)

• NCSA (Εθνική Αρχή Κυβερνοασφάλειας / cyber.gov.gr) is designated as the competent authority, single point of contact, national CSIRT operator, and cyber‑crisis management authority for NIS2 in Greece.NCSA homepageDigital Strategy – NIS2 Greece contact detailsNIS2 Greece – NIS Solutions
• NCSA exercises supervisory powers including inspections, audits, requests for information, issuance of binding instructions, orders to remedy deficiencies, and imposition of administrative fines, in line with NIS2 Articles 32–33.Directive‑NIS2 Greece summaryEU NIS2 Directive Articles 32–33Lexology article on Law 5160/2024

3. Registration Obligation and NIS2 Platform

• Entities in scope must register with NCSA via a designated digital platform (NIS2 register), providing organisational data, description of services, systems in scope, and contact details.EY – Law 5160/2024 overviewNIS2 in Greece – NCSA platform description
• Until the NIS2 platform is fully operational, NCSA requires submission of data via email (e.g., register.ncsa@cyber.gov.gr) as an interim procedure.EY – Law 5160/2024 overviewDigital Strategy – NIS2 Greece contacts

4. Cybersecurity Risk‑Management Measures

• Law 5160/2024 incorporates NIS2 Article 21 obligations for risk‑management measures, including:
• Policies on risk analysis and information system security
• Incident handling and continuity
• Supply‑chain security and security in network and information systems
• Secure development and vulnerability handling
• Encryption and access control.EU NIS2 Directive Article 21NIS2 Greece – NIS Solutions
• Greek guidance indicates that entities must adopt documented policies, roles, and technical controls aligned with these requirements.NCSA NIS2 pageAdvisera – NIS2 Transposition Greece overview

5. Incident Reporting and Notification

• Entities must notify significant incidents to NCSA and follow NIS2 timelines (usually an early warning within 24 hours, followed by more detailed reports and final notifications).EU NIS2 Directive Articles 23–24Lexology article on Law 5160/2024
• NCSA is the single recipient for incident reports in Greece, centralising intake and coordination.NCSA homepageNIS2 Greece – RISI country entry

6. Governance, Management Accountability & YASPE Officer

• Law 5160/2024, consistent with NIS2, places responsibility on management bodies for approving and overseeing cybersecurity measures and may impose personal liability in certain cases.EU NIS2 Directive Article 20Advisera – Greek NIS2 Law overview
• Guidance on Greek implementation refers to a designated “YASPE” officer or equivalent security focal point responsible for coordination with NCSA and NIS2 compliance.NIS2 in Greece – NCSA platform requirementsCybersecurity overview – Greece

7. Enforcement, Sanctions, and Supervisory Actions

• NCSA may impose administrative fines and corrective measures for non‑compliance, following the ranges and criteria in NIS2 (for essential and important entities).EU NIS2 Directive Articles 31–34Directive‑NIS2 Greece summary
• Law 5160/2024 explicitly empowers NCSA to use inspections, binding instructions, and orders to remedy deficiencies.Lexology article on Law 5160/2024NIS2 Greece – NIS Solutions

Compliance Challenges

1. Scope Determination & Entity Classification

• Many Greek organisations struggle to determine whether they qualify as essential or important entities, especially in multi‑sector or cross‑border contexts.Advisera – NIS2 Transposition GreeceNIS2 Greece – NIS Solutions
• Industry analyses note that the expanded scope under Law 5160/2024 pulls in SMEs and mid‑market entities in sectors like health, transport, and digital infrastructure that have limited prior regulatory experience.Cybersecurity in Greece – NIS2 complianceIWH – NIS2 changes for Greek SMEs

2. Building NIS2‑Level Risk‑Management Capabilities

• Implementing comprehensive risk‑management measures as per NIS2 Article 21 is resource‑intensive, requiring policies, technology, and trained staff that many organisations lack.EU NIS2 Directive Article 21Advisera – NIS2 Greece guidance
• Reports on Greek NIS2 readiness emphasise gaps in incident response, supply‑chain security, and vulnerability management among smaller entities.Cybersecurity in Greece – NIS2 complianceNIS2 Greece – NIS Solutions

3. Registration & Data Submission Processes

• Practical challenges include aligning internal data with NCSA’s registration requirements, completing forms, and keeping information updated across multiple systems.EY – Law 5160/2024 overviewNIS2 in Greece – NCSA platform steps
• Temporary processes (e.g., email‑based registration) and evolving platform configuration complicate compliance planning.Digital Strategy – NIS2 Greece contactsNCSA NIS2 page

4. Governance, Accountability & Culture

• Requiring management bodies to be actively responsible and trained in cybersecurity governance creates a cultural and organisational change challenge.EU NIS2 Directive Article 20Advisera – NIS2 governance obligations
• Industry commentary notes reluctance and limited expertise among boards and executive teams in Greek organisations to assume specific cybersecurity responsibilities.Cybersecurity law in Greece – impact analysisNIS2 Greece – NIS Solutions

5. Cost & Resource Burden (Especially for SMEs)

• Analyses of NIS2’s impact on Greek SMEs highlight significant cost and staffing burdens to achieve required levels of risk management, incident handling, and reporting.IWH – NIS2 Amendments and Greek SMEsCybersecurity in Greece overview
• Compliance efforts often compete with other regulatory requirements (e.g., GDPR), increasing complexity and resource strain.EU NIS2 Directive Recital & ArticlesAdvisera – NIS2 and GDPR interaction

Implementation Best Practices

1. Map Scope and Classification Early

• Conduct a scope assessment against NIS2 Annex sector and size criteria to confirm whether your organisation is an essential or important entity under Law 5160/2024.EU NIS2 Directive Annex I–IIAdvisera – NIS2 scope guidance for Greece
• Use NCSA and EU NIS2 implementation pages as references to clarify sector definitions and contact NCSA when in doubt.NCSA NIS2 pageDigital Strategy – NIS2 implementation in Greece

2. Align with Recognised Cybersecurity Frameworks

• Implement NIS2 risk‑management obligations by aligning with established frameworks such as ISO/IEC 27001 and the NIST Cybersecurity Framework, which are recognised in NIS2 implementation guidance.EU NIS2 Directive Article 21Advisera – using ISO 27001 for NIS2 compliance
• Map NIS2 requirements to existing controls to reduce duplication and leverage current investments.NIS2 Greece – NIS Solutions control mappingCybersecurity law in Greece – framework discussion

3. Establish Robust Incident Response and Reporting

• Develop or update an incident response plan including detection, triage, containment, recovery, communication, and NCSA notification workflows aligned with NIS2 timelines.EU NIS2 Directive Articles 21, 23–24NCSA NIS2 information
• Test incident procedures through table‑top exercises and technical simulations to ensure readiness for reporting to NCSA and coordination with CSIRT.NIS2 implementation guidance – Greece overviewAdvisera – NIS2 incident handling recommendations

4. Strengthen Governance and Assign a NIS2 Responsible Officer

• Ensure the management body formally approves cybersecurity policies and receives regular risk reports, as required by NIS2.EU NIS2 Directive Article 20Lexology article – management obligations in Law 5160/2024
• Designate a NIS2 compliance lead (e.g., YASPE officer or equivalent) as point of contact for NCSA and internal coordination.NIS2 in Greece – registration requirementsCyber.gov.gr NIS2 content

5. Tools and Resources

• NCSA website and NIS2 page: Primary source of national guidance, registration information, and contact details.
• National Cybersecurity Authority (NCSA)
• NCSA NIS2 Information
• EU NIS2 resources:
• NIS2 Directive official text (EUR‑Lex)
• European Commission – NIS2 Directive overview
• Implementation guidance and templates for Greece:
• NIS2 in Greece – practical templates and registration process
• Advisera – NIS2 Transposition in Greece overview and implementation steps
• [EY – Law 5160/2024 tax and compliance

Recent developments

• 2026-08-26 — Analysis of how Law 5160/2024, transposing NIS2, functions in practice, noting that registration with the National Cybersecurity Authority has closed, the authority is actively supervising entities, and Greek businesses face increased compliance and enforcement pressure under the new cybersecurity framework.[10] (source)
• 2026-08-11 — Overview confirming that Greece has fully transposed NIS2 via Law 5160/2024 and that secondary legislation on registration and security measures has been adopted, meaning NIS2 is fully implemented and replacing the earlier NIS-based regime for covered sectors.[4] (source)
• 2026-08-06 — Status update on Greece’s NIS2 transposition explaining that Law 5160/2024 (FEK A’ 195/27.11.2024) completed the principal transposition of Directive (EU) 2022/2555, positioning Greece among the member states with a fully operational NIS2 legal framework.[1] (source)
• 2026-08-04 — Communication from the National Cybersecurity Authority highlighting Law 5160/2024 as the core instrument incorporating NIS2 into Greek law and serving as the basis for national cybersecurity supervision, registration, and enforcement activities.[14] (source)
• 2026-07-04 — Greek-language article describing NIS2 as implemented by Law 5160/2024, emphasizing heavy fines and management liability for non-compliance and noting a ministerial decision (2267/2025) granting extended compliance deadlines for certain public-sector entities until 27-11-2026.[9] (source)
• 2026-06-01 — Timeline-style update detailing Greece’s NIS2 status, confirming that Law 5160/2024 was published in Government Gazette A’ 195 on 27 November 2024 and summarizing key milestones for entities’ registration and implementation obligations under the new cybersecurity regime.[3] (source)
• 2026-04-17 — Industry compliance guide explaining how Law 5160/2024 embeds NIS2 into Greek law, providing practical instructions for Greek organizations on risk management, incident reporting, governance, and sector-specific obligations, and highlighting significant operational impacts on cybersecurity programs.[8] (source)
• 2026-04-14 — Legal briefing outlining recent cybersecurity regulatory developments following Law 5160/2024, including reference to Ministerial Decision 1689/2025 and the National Cybersecurity Authority’s publication of a dedicated gap-analysis tool (developed with ENISA) to help entities assess compliance gaps with NIS2 obligations.[11] (source)
• 2026-03-17 — Practice guide chapter describing Law 5160/2024 as Greece’s core horizontal cybersecurity framework, detailing its application to essential and important entities in multiple critical sectors, and explaining requirements such as registration with the National Cybersecurity Authority and strengthened security and reporting obligations.[7] (source)
• 2026-01-19 — Compliance-focused article on NIS2 implementation in Greece via Law 5160/2024, summarizing key regulatory milestones and extensions (including submission deadlines extended to 30 September 2025) and analyzing the law’s practical impact on governance, risk management, and potential fines for Greek organizations.[6] (source)

Related regulations

• NYDFS Cybersecurity Regulation — New York, Active, effective 2025-11-01
• Law on Cybersecurity of Vietnam — Vietnam, Active
• Austria NIS2 Act — Austria, Upcoming
• Luxembourg NIS2 Transposition — Luxembourg, Active
• EU Cyber Resilience Act (CRA) — European Union, Phased, effective 2027-12-11
• EU Cyber Resilience Act - Vulnerability and Incident Reporting (11 Sep 2026) — European Union, Active, effective 2026-09-11
• Netherlands NIS2 Transposition (Cyberbeveiligingswet) — Netherlands, Active, effective 2026-08-15
• Belgium NIS2 Transposition — Belgium, Active, effective 2024-10-18

Put it into practice

• Generate the policy: NIS2 policy generator (generatepolicy.com)
• Buy the policy pack: NIS2 Compliance Policy (cyberpolicy.shop)
• Build it yourself: DORA + NIS2 EU Compliance Workbook (ciso.diy)

Browse all regulations · Compliance deadlines · Latest updates