YTYK You think you know

Card 13 of 18 Supervision and penalties ●●○ Working knowledge

Supervised before, or supervised after

Essential entities are under an ex ante regime: the authority may inspect, audit and request evidence without any indication that something is wrong. Important entities are under an ex post regime: supervision is triggered by evidence, an indication or a report of non-compliance.

Why it is like this

It concentrates a finite number of inspectors where a failure costs the most, while keeping every entity inspectable. It is also the main practical consequence of the essential/important split.

Not to be confused with

A guarantee that important entities will be left alone. Ex post means *on cause*, not *never* — and a single incident report can be the cause.

In practice

An essential entity can receive a request for its Article 21 evidence on an ordinary Tuesday. An important entity usually receives one in the week after it notifies an incident.

Source: Directive (EU) 2022/2555 (NIS2) — Art. 32 and Art. 33. Read on .

Predict Check yourself

A competent authority wants to audit an important entity that has reported nothing and shows no sign of a problem. Can it?

  1. Not under the ex post regime — supervision of important entities needs evidence or an indication of non-compliance.
  2. Yes — the supervisory powers are identical for both classes.
  3. Yes, but only once per year.
  4. Only with a court order.
Show the answer

Not under the ex post regime — supervision of important entities needs evidence or an indication of non-compliance.

Article 33 makes supervision of important entities ex post: it requires evidence, indication or information suggesting non-compliance. Article 32 gives the broader, proactive powers over essential entities.