Resources / Legislation
Law 5160/2024: NIS2 in Greek law
Updated 24 October 2026
Law 5160/2024 (ΦΕΚ Α' 195/27.11.2024) brings the NIS2 Directive into Greek law[1]. It sets who it applies to, what their management owes, how incidents are reported and the fines the National Cybersecurity Authority (ΕΑΚ) imposes. KYA 1689/2025 sets out the measures in detail.
Who does Law 5160/2024 apply to?
- Public or private entities in the sectors of Annexes I and II that are medium-sized or larger under Recommendation 2003/361/EC and are established or active in Greece (Article 3(1))[1][2].
- Whatever their size: providers of public electronic communications networks and services, trust service providers, top-level domain registries and DNS service providers, the sole provider of an essential service and critical entities (Article 3(2) and (3))[1].
- Central government bodies and first and second tier local authorities (Article 3(2)(στ))[1].
Article 4 divides entities into essential and important. A medium-sized company counts its group: the Recommendation adds the figures of linked enterprises in full and of partner enterprises by the share held[2].
What is management responsible for?
The management bodies approve the risk-management measures, oversee their implementation and are responsible for infringements of them (Article 14(1)). Their members are trained, and the entity trains its staff at least once a year (Article 14(2))[1].
Which measures and reports does it require?
Entities take the measures of Article 15, which KYA 1689/2025 sets out in detail[1][3]. They notify every significant incident to the ΕΑΚ's CSIRT without delay, within the Directive's deadlines: an early warning within 24 hours, a notification within 72 hours and a final report within one month (Article 16)[1][4]. Central government bodies and local authorities notify the National CERT of the ΕΥΠ instead (Article 10)[1]. Central government bodies and local authorities notify the CSIRT of the National Intelligence Service, informing the ΕΑΚ at the same time[1].
How do you register and appoint a ΥΑΣΠΕ?
Every essential and important entity registers on the ΕΑΚ's digital platform (Law 5160/2024, Article 4(3))[1], which runs under KYA 1381/2025[5]. The deadline to register passed on 30 September 2025[6]. An entity that has not registered submits its details without delay, and any change to them within two weeks[7][6]. The ΥΑΣΠΕ is declared on the platform too[8].
The law (Article 34) and ΥΑ 1899/2025 set the role of the security officer for information and communication systems[1][8]. See who can be a ΥΑΣΠΕ.
Who supervises, and what are the fines?
The ΕΑΚ supervises essential entities before and after the fact, and important entities after the fact (Articles 24 and 25)[1].
| Breach | Fine | Article of Law 5160/2024 |
|---|---|---|
| Essential entity, for the measures (Article 15) or incident reporting (Article 16) | Up to €10,000,000 or 2% of worldwide annual turnover, whichever is higher | 26(4) |
| Important entity, for the same | Up to €7,000,000 or 1.4% of worldwide annual turnover, whichever is higher | 26(5) |
| Approval and oversight of the measures by the management bodies (Article 14(1)) | Up to €200,000 | 26(9)(a) |
| Training of management body members and staff (Article 14(2)) | Up to €100,000 | 26(9)(b) |
| Public sector entities of Article 3(2)(στ) | From €20,000 to €500,000 | 26(8) |
The authority imposes fines by a reasoned decision after a hearing, and how long a breach has lasted is one of the factors it weighs[1].
What changes with the Commission's 2026 proposal?
On 20 January 2026 the European Commission proposed targeted amendments to NIS2, together with a revision of the Cybersecurity Act[9]. It is a proposal: until the European Parliament and the Council adopt it and it is transposed, the obligations of Law 5160/2024 and KYA 1689/2025 apply as they stand.
What to do now
- Check whether the law applies to you, with the ΕΑΚ's scope test or with Vardion's applicability check, which adds up the group.
- If you have not registered on the ΕΑΚ's platform, register now.
- Appoint a ΥΑΣΠΕ from your own staff and declare them on the platform. See who can be a ΥΑΣΠΕ.
- Start the ΕΑΚ self-assessment, which is sent every year with a corrective action plan.
- Take the measures to the management body for approval and record the approval.
Sources
- Law 5160/2024 (ΦΕΚ Α' 195/27.11.2024), the authority's copy, checked 24 October 2026
- Recommendation 2003/361/EC on micro, small and medium-sized enterprises, checked 24 October 2026
- KYA 1689/2025 (ΦΕΚ Β' 2186/2025), the authority's copy, checked 24 October 2026
- Directive (EU) 2022/2555 (NIS2), checked 24 October 2026
- KYA 1381/2025 (ΦΕΚ Β' 463/2025) on the registration platform, checked 24 October 2026
- ΕΑΚ, circular οικ. 28211/10.9.2025 on registering on the platform, checked 24 October 2026
- ΕΑΚ, questions and answers on the registration platform, checked 24 October 2026
- ΥΑ 1899/2025 (ΦΕΚ Β' 4250/5.8.2025) on the ΥΑΣΠΕ, the authority's copy, checked 24 October 2026
- European Commission, proposal for a directive COM(2026) 13, 20 January 2026, checked 24 October 2026
See whether the law applies to you
Vardion's applicability check adds up the group and keeps the scope memo your management signs.