Resources / Legislation
Regulatory watch
Updated 25 October 2026
The dated changes to NIS2, Law 5160/2024 and its decisions, the guidance of Greece's National Cybersecurity Authority (ΕΑΚ), DORA and the CRA, each with its source. For the measures, see the KYA 1689/2025 guide.
Coming up
| Date | Change |
|---|---|
| 27 November 2026 | First tier local authorities, the municipalities, come under Law 5160/2024.[1] |
| 11 December 2027 | The Cyber Resilience Act (CRA) applies in full.[2] |
What changed
| Date | Change |
|---|---|
| 11 September 2026 | CRA: the manufacturers' reporting obligations (Article 14) apply.[2] |
| 30 July 2026 | ΕΑΚ circular 28427: essential entities fix first the flaws on internet-facing systems, those actively exploited and those that give full control. They scan monthly or more often, and fix some flaws within three days.[3] |
| 11 June 2026 | CRA: the rules on notified conformity assessment bodies (Chapter IV) apply.[2] |
| 8 June 2026 | ΕΑΚ circular 20718: public sector bodies register, apply multi-factor authentication and plan to move their email, each by a deadline. See the law in the public sector.[4] |
| 20 January 2026 | The European Commission proposes targeted amendments to NIS2, COM(2026) 13. It is a proposal, and the law applies as it stands.[5] |
| 14 October 2025 | KYA 2267/2025 moves the start for first tier local authorities to 27 November 2026.[1] |
| 30 September 2025 | The deadline to register on the ΕΑΚ's platform passes.[6] |
| 10 September 2025 | The ΕΑΚ publishes its compliance assessment tool, the gap analysis workbook.[7] |
| 5 August 2025 | ΥΑ 1899/2025 sets the qualifications and duties of the security officer the law requires (ΥΑΣΠΕ).[8] |
| 6 May 2025 | KYA 1689/2025 sets the national cybersecurity requirements framework.[9] |
| 15 April 2025 | KYA 1645/2025 extends the deadline to submit entity details.[10] |
| 10 February 2025 | KYA 1381/2025 creates the ΕΑΚ's registration platform.[11] |
| 17 January 2025 | DORA applies.[12] |
| 27 November 2024 | Law 5160/2024 brings NIS2 into Greek law.[13] |
| 18 October 2024 | Member states apply their NIS2 measures, transposed by 17 October 2024.[14] |
Sources
- KYA 2267/2025 (ΦΕΚ Β' 5472/14.10.2025) on when first-tier local authorities come under the law, checked 25 October 2026
- Regulation (EU) 2024/2847 (CRA), checked 25 October 2026
- ΕΑΚ, circular 28427/30.7.2026 on vulnerability management by essential entities, checked 25 October 2026
- ΕΑΚ, circular 20718/8.6.2026 on cybersecurity measures in the public sector, checked 25 October 2026
- European Commission, proposal for a directive COM(2026) 13, 20 January 2026, checked 24 October 2026
- ΕΑΚ, circular οικ. 28211/10.9.2025 on registering on the platform, checked 24 October 2026
- ΕΑΚ, announcement of the compliance assessment tool for Law 5160/2024, 10 September 2025, with the workbook, checked 24 October 2026
- ΥΑ 1899/2025 (ΦΕΚ Β' 4250/5.8.2025) on the ΥΑΣΠΕ, the authority's copy, checked 2 November 2026
- KYA 1689/2025 (ΦΕΚ Β' 2186/2025), the authority's copy, checked 24 October 2026
- KYA 1645/2025 (ΦΕΚ Β' 1882/15.4.2025) extending the deadline to submit entity details, checked 25 October 2026
- KYA 1381/2025 (ΦΕΚ Β' 463/2025) on the registration platform, checked 24 October 2026
- Regulation (EU) 2022/2554 (DORA), checked 25 October 2026
- Law 5160/2024 (ΦΕΚ Α' 195/27.11.2024), the authority's copy, checked 24 October 2026
- Directive (EU) 2022/2555 (NIS2), checked 24 October 2026
See what applies to your organisation
Vardion's applicability check proposes what applies to you and counts down to your dates.