Greece transposed NIS2 through Law 5160/2024, and most of its deadlines have already run: registration windows closed in 2025, management approval was due three months after the law took effect, and the detailed requirements decision has applied since May 2025. The law was published in the Government Gazette as FEK A' 195 on 27 November 2024 and took effect on publication (Art. 45(1)). It makes the National Cybersecurity Authority (Εθνική Αρχή Κυβερνοασφάλειας) the competent authority, single point of contact and CSIRT, and it is detailed by Joint Ministerial Decision 1689/2025, the national framework of cybersecurity requirements. Greece adds its own features to the Directive: self-registration through gov.gr, a mandatory information and communication systems security officer (ΥΑΣΠΕ), an annual self-assessment sent to the Authority and annual external penetration tests. This guide covers scope, registration, obligations, reporting, fines, and what the requirements mean for service accounts, API keys and AI agents. It is for CISOs, compliance leads and auditors with Greek operations. The Directive itself is covered in the NIS2 Directive Guide and the cross-country picture in the NIS2 Transposition Tracker.
Status, checked 14 November 2026: Law 5160/2024 is in force as published on the Authority's site (cyber.gov.gr), with error corrections to Arts. 24 and 26 made by Art. 31 of Law 5256/2025 (read on the consolidated legal text site taxheaven.gr). JMD 1689/2025 (FEK B' 2186, 6 May 2025) and JMD 1381/2025 (FEK B' 463) are taken from the Authority's site and the government procedures register (mitos.gov.gr). Where a point rests on one secondary source, the page names it. The EU has proposed amendments to NIS2, which may lead to Greek changes later. This page is not legal advice.
Key takeaways
- One authority does almost everything: the National Cybersecurity Authority supervises, receives incident reports through its CSIRT and keeps the entity registry (Arts. 8 to 10).
- Self-registration, then keep it current: entities register on the Authority's platform with Taxisnet credentials and must update their data within two weeks of any change.
- Appoint a ΥΑΣΠΕ: a senior, qualified security officer who handles all contact with the Authority and cannot also be the GDPR data protection officer (Art. 15(5)(a)).
- Self-assess every year: JMD 1689/2025 requires an annual self-assessment sent to the Authority with a corrective action plan, plus annual external penetration tests.
- Fines reach EUR 10 million or 2%: for essential entities, and EUR 7 million or 1.4% for important entities, whichever is higher (Art. 26(4) and (5)).
Scope: essential and important entities
Art. 3(1) covers public or private entities of the types in Annexes I and II that are at least medium-sized under Recommendation 2003/361/EC. Art. 3(2) adds entities caught regardless of size.
| Category | Who (Law 5160/2024) | Articles |
|---|---|---|
| Essential entity (βασική οντότητα) | Annex I entities above the medium-sized ceilings (250 or more staff, or turnover above EUR 50 million and balance sheet above EUR 43 million); qualified trust service providers, top-level domain registries and DNS service providers of any size | Art. 4(1) |
| Important entity (σημαντική οντότητα) | Annex I or II entities that are not essential | Art. 4(2) |
| Size-independent cases | For example electronic communications providers, trust service providers and central government bodies | Art. 3(2) |
| Public administration | Central government bodies (as defined in Law 4270/2014) and local authorities under Art. 3(2)(στ) | Arts. 3(2)(στ), 45(2) |
- Former operators of essential services: references to Law 4577/2018 (the NIS1 law) now point to Law 5160/2024, and its operators are treated as essential entities (Art. 31(2)). Arts. 1 to 16 of Law 4577/2018 are repealed (Art. 32).
- Local authorities: Art. 45(2) deferred one public sector subpoint by a year. The Authority's September 2025 circular states this brings first-tier municipalities into the law from 27 November 2025.
- Digital providers: Implementing Regulation (EU) 2024/2690 sets measures and incident thresholds for DNS, cloud, data centre, managed service and similar providers, and JMD 1689/2025 cites it as a basis. See the NIS2 Implementing Regulation 2024/2690 Guide.
- Financial sector: DORA applies to financial entities. See the DORA and NIS2 Overlap Mapping Guide.
Authorities and CSIRTs
| Body | Role | Source |
|---|---|---|
| National Cybersecurity Authority | Competent authority, member of the NIS Cooperation Group, single point of contact, cyber crisis management authority (EU-CyCLONe), supervisory authority | Arts. 8, 9, 23 |
| CSIRT of the Authority | CSIRT for entities in scope; receives significant incident reports | Arts. 10(1), 16(1) |
| National CERT of the National Intelligence Service (EYP) | CSIRT for central government and local authorities under Art. 3(2)(στ), which report to it and inform the Authority at the same time | Arts. 10(1), 16(1) |
| Hellenic National Defence General Staff cyber defence unit | Acts as CSIRT until the Authority's CSIRT is certified adequate | Art. 31(1) |
| Ministry of Digital Governance | Responsible ministry for the registration service; co-signs the joint ministerial decisions with the Ministry of National Economy and Finance | mitos.gov.gr; JMD 1689/2025 |
Timeline and deadlines
| Date or period | Milestone | Source |
|---|---|---|
| 27 November 2024 | Law 5160/2024 published (FEK A' 195) and in force | Art. 45(1) |
| 17 January 2025 | Original deadline for DNS, TLD, cloud, data centre and other Art. 19 providers to submit registry data | Art. 19(1) |
| Three months after entry into force | Management bodies approve the risk management measures | Art. 14(1) |
| 10 February 2025 | JMD 1381/2025, creating the registration platform, published (FEK B' 463) | mitos.gov.gr; NCSA circular |
| 28 March and 11 April 2025 | Extended deadlines for Art. 19 providers and for essential and important entities, as reported by the legal news site Lawspot | JMD 1381/2025, Art. 9 |
| 17 April 2025, then every two years | Authority's list of entities (the Directive's date for member state lists) | Art. 4(5) |
| 6 May 2025 | JMD 1689/2025, the national requirements framework, published (FEK B' 2186) and in force | JMD 1689/2025, Art. 26 |
| 30 September 2025 | Registration deadline for central government bodies and second-tier local authorities | NCSA circular 28211/2025 |
| 27 November 2025 | First-tier municipalities in scope | Art. 45(2); NCSA circular |
| Annually | Self-assessment to the Authority; external penetration test | JMD 1689/2025, Art. 18 |
For a private entity in scope since 2024, every registration and approval deadline has passed. If you have not registered, do it now and document why it was late; the data you enter counts as a sworn statement.
Registration on the Authority's platform
- Where: the gov.gr service "Αυτοδήλωση οντοτήτων NIS2" (service 1000746), linked to the registry at nis2register.cyber.gov.gr. Access uses Taxisnet credentials and covers legal persons only. It is free.
- What you declare: whether the entity is essential or important, or provides one of the listed digital services; legal representative; services provided; and technical data, including IP ranges and domain names used.
- Legal weight: entering the data counts as a sworn statement under Art. 8 of Law 1599/1986, according to the government procedures register.
- Changes: update without delay and within two weeks of the change; Art. 19 digital providers have three months. A change means a new submission, and the platform keeps the history.
- Templates: Template I (essential and important entities) and Template II (other listed services) in JMD 1381/2025, amended by JMD 1990/2025 (FEK B' 4241).
Treat the Taxisnet login as a privileged identity: whoever holds it can make sworn declarations for the entity. Record who holds it, keep a deputy and review it on role change.
Key obligations
Management body (Art. 14)
- Approve and oversee: management bodies approve the risk management measures, oversee their implementation and are responsible for the entity's breaches of the article (Art. 14(1)).
- Training: members must take training, and entities must offer similar training to staff at least once a year (Art. 14(2)).
- Personal exposure: for essential entities that ignore enforcement deadlines, the Authority's Governor may temporarily bar a CEO-level person or legal representative from managerial duties (Art. 24(5)). Breach of Art. 14(1) carries its own fixed maximum fine of EUR 200,000 in Art. 26(9) as corrected by Law 5256/2025. See the NIS2 Management Liability Executive Briefing.
Risk management measures (Art. 15 and JMD 1689/2025)
Art. 15(2) repeats the Directive's minimum list, from risk analysis to multi-factor authentication. JMD 1689/2025 turns it into 26 articles of requirements. The ones that most change day-to-day work:
| JMD 1689/2025 article | Requirement | Applies to |
|---|---|---|
| Art. 6 | General information security policy approved by top management, plus 11 minimum topic policies (including access control, asset management, cryptography, backups, incident management) | All |
| Art. 7 | Roles and responsibilities; the ΥΑΣΠΕ reports directly to top management on cybersecurity | All |
| Art. 8 | Independent audits at planned intervals and after serious incidents or significant changes | Essential |
| Art. 13 | Unique identity for each user and system; least privilege, need to know, separation of duties; privileged accounts kept to the minimum; rights changed on role change or exit; strong authentication; MFA where classification requires | All |
| Art. 14(γ) | Change default passwords when installing any new product, system or application | All |
| Art. 18(1)(b) | External penetration test at least annually or after a serious incident | All |
| Art. 18(1)(d) | Self-assessment annually or after a serious incident, using the Authority's guide; results and corrective action plan sent to the Authority | All |
| Art. 18(2)(a) | Internal penetration test at least annually or after a serious incident | Essential |
| Art. 22 | Written cryptography policy; encryption at rest and in transit for highly critical data; key and certificate management procedures | All |
| Art. 24 | Incident management and event logging, with protected storage and regular review of logs for a predefined period | All |
| Art. 25 | Business continuity and crisis management | All |
The JMD sets no password length, rotation interval or log retention period, so set and document your own. ISO/IEC 27001 work maps well to the management parts; see the ISO 27001 Certification Guide.
The ΥΑΣΠΕ
- Who: a senior staff member with suitable qualifications, given the resources needed (Art. 15(5)(a)).
- Duties: all communication with the Authority and internal coordination of compliance with Arts. 15 and 16.
- Conflict rule: the role cannot be combined with the GDPR Art. 37 data protection officer.
- Detail: the compliance guide published by SEV (the Hellenic Federation of Enterprises) in October 2025 states that JMD 1899/2025 (FEK B' 4250) sets the ΥΑΣΠΕ's qualifications, incompatibilities and duties. Read that decision before you appoint.
Incident reporting (Art. 16)
| Stage | Deadline | Article |
|---|---|---|
| Early warning | Within 24 hours of becoming aware, saying whether malicious action is suspected | Art. 16(4)(α) |
| Incident notification | Within 72 hours, with an initial assessment | Art. 16(4)(β) |
| Intermediate report | On the Authority's request | Art. 16(4)(γ) |
| Final report | Within one month of the incident notification | Art. 16(4)(δ) |
| Progress report | If the incident is still ongoing at the final report date; final report within one month of handling it | Art. 16(4)(ε) |
| Trust service providers | Significant incidents affecting their services within 24 hours of becoming aware | Art. 16(4) |
- Where to report: the Authority's CSIRT; public bodies under Art. 3(2)(στ) report to the EYP National CERT and inform the Authority.
- What is significant: an incident that has caused or can cause serious operational disruption or financial loss, or considerable material or non-material damage to others (Art. 16(3)). Digital providers also use the thresholds in Implementing Regulation 2024/2690.
- Cross-reference: see the Cyber Incident Reporting Requirements Map for overlaps with GDPR and DORA.
Supervision and sanctions
| Item | Essential entities | Important entities |
|---|---|---|
| Supervision | On-site and off-site, random checks, regular and targeted audits, ad hoc audits, security scans, information requests (Art. 24(2)) | Ex post, on evidence of non-compliance: on-site inspections, targeted audits, scans, information requests (Art. 25(1) and (2)) |
| Maximum fine for Arts. 15 or 16 breaches | EUR 10,000,000 or 2% of prior-year worldwide group turnover, whichever is higher (Art. 26(4)) | EUR 7,000,000 or 1.4% of prior-year worldwide turnover, whichever is higher (Art. 26(5)) |
| Fines for ignoring enforcement measures | Up to EUR 1,000,000 (Art. 26(6)) | Up to EUR 700,000 (Art. 26(6)) |
| Further measures | Warnings, binding instructions, orders, publication, supervising officer, suspension of certification, temporary management ban (Art. 24(4) and (5)) | Warnings, binding instructions, orders and publication; no supervising officer or management ban (Art. 25(4)) |
- Public bodies: fines of EUR 20,000 to 500,000 for Art. 3(2)(στ) entities (Art. 26(8)).
- Specific provisions: Art. 26(9) sets fixed maximums per provision, for example EUR 800,000 for Art. 20 and EUR 300,000 for Art. 15(6).
- Procedure: sanctions are imposed by reasoned decision of the Authority's Governor after a hearing, and periodic penalty payments can compel an end to a breach (Art. 26(2)).
What it means for AI agents and non-human identities
- "Each user and system" means machines too: JMD 1689/2025 Art. 13(β) requires a unique identity per user and system. Shared service accounts and API keys reused across applications do not meet it. The Non-Human Identity (NHI) Guide sets out the categories.
- Privileged machine accounts: Art. 13(δ) limits privileged accounts to what is strictly necessary. Include automation, CI/CD and backup accounts in the privileged inventory.
- Default credentials: Art. 14(γ) covers appliances, databases and SaaS integrations that ship with default secrets.
- Keys and certificates: Art. 22(δ) asks for key and certificate management procedures; machine certificates and signing keys belong in them.
- Agents: give each AI agent its own scoped identity and log its actions so a 24-hour early warning can say which identity was involved.
- Self-assessment evidence: keep machine identity inventories, rotation records and access reviews ready, not only human reviews.
- Review cadence: NHI Mgmt Group recommends quarterly review of privileged machine identities and annual review of the rest. This is our recommendation, not a Greek rule.
Common failure patterns
- Stale registration: a new legal representative, IP range or domain not updated within two weeks.
- ΥΑΣΠΕ doubling as DPO: combining the roles the law keeps apart.
- Self-assessment treated as optional: JMD 1689/2025 makes it annual and sends it to the Authority.
- Penetration test scope too narrow: essential entities need internal as well as external tests every year.
- Human-only access reviews: service accounts, API keys and agents missing from Art. 13 evidence.
- Undefined log retention: the JMD leaves the period to you, and an unset period is a finding.
Practitioner checklist
- Confirm category (essential or important) and register, or check the registration is current, on the gov.gr service.
- Appoint the ΥΑΣΠΕ under Art. 15(5)(a), check JMD 1899/2025, and keep the role separate from the DPO.
- Record management approval of the measures and the annual training under Art. 14.
- Map controls to JMD 1689/2025 Arts. 6 to 25 and write the 11 topic policies.
- Schedule the annual self-assessment and penetration tests; send results and the action plan to the Authority.
- Rehearse the 24-hour, 72-hour and one-month reports with the Authority's CSIRT contact details.
- Inventory machine identities and AI agents in scope, each unique and owned.
- Set and document log retention and password standards that the JMD leaves open.
Standards and references
- National Cybersecurity Authority: Law 5160/2024, FEK A' 195
- National Cybersecurity Authority: JMD 1689/2025, National Framework of Cybersecurity Requirements (FEK B' 2186)
- National Cybersecurity Authority: Circular on entity registration (28211/2025)
- Mitos: Registration of essential and important entities under Law 5160/2024
- National Cybersecurity Authority: NIS2 registry FAQ
- SEV: Guide to compliance with Law 5160/2024 and NIS2
- Taxheaven: Law 5256/2025, Art. 31 (corrections to Law 5160/2024)
Related NHI Mgmt Group resources: NIS2 Directive Guide · NIS2 Transposition Tracker · Cyprus and Malta NIS2 Implementation Guide · NIS2 Readiness Checklist · Non-Human Identity (NHI) Guide. This guide summarises Greek Law 5160/2024 as it stood on 14 November 2026 and is not legal advice.