{
  "version": "1.0.0",
  "generated": "2026-07-16",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "attribution": "theseeus.eu",
  "count": 14,
  "in_force": 11,
  "proposals": 3,
  "instruments": [
    {
      "id": "nis2",
      "title": "NIS2 Directive",
      "short": "NIS2",
      "celex": "32022L2555",
      "eli": "https://eur-lex.europa.eu/eli/dir/2022/2555/oj",
      "type": "directive",
      "layer": "horizontal",
      "status": "in-force",
      "in_force": "2023-01-16",
      "key_date": "2024-10-17 transposition deadline",
      "href": "/regulations/nis2",
      "one_liner": "Cybersecurity obligations for essential/important entities across 18 sectors."
    },
    {
      "id": "cer",
      "title": "CER Directive",
      "short": "CER",
      "celex": "32022L2557",
      "eli": "https://eur-lex.europa.eu/eli/dir/2022/2557/oj",
      "type": "directive",
      "layer": "horizontal",
      "status": "in-force",
      "in_force": "2023-01-16",
      "key_date": "2026-07-17 identify critical entities",
      "href": "/regulations/cer",
      "one_liner": "All-hazards physical resilience of critical entities; NIS2's physical twin."
    },
    {
      "id": "cybersecurity-act",
      "title": "Cybersecurity Act",
      "short": "CSA",
      "celex": "32019R0881",
      "eli": "https://eur-lex.europa.eu/eli/reg/2019/881/oj",
      "type": "regulation",
      "layer": "horizontal",
      "status": "in-force",
      "in_force": "2019-06-27",
      "key_date": "revision proposed 2026-01-20",
      "href": "/regulations/cybersecurity-act",
      "one_liner": "ENISA's mandate + the EU cybersecurity certification framework."
    },
    {
      "id": "cyber-solidarity-act",
      "title": "Cyber Solidarity Act",
      "short": "CSoA",
      "celex": "32025R0038",
      "eli": "https://eur-lex.europa.eu/eli/reg/2025/38/oj",
      "type": "regulation",
      "layer": "horizontal",
      "status": "in-force",
      "in_force": "2025-01-15",
      "href": "/regulations/cyber-solidarity-act",
      "one_liner": "EU-level detection (Cyber Shield), emergency mechanism, incident review."
    },
    {
      "id": "cra",
      "title": "Cyber Resilience Act",
      "short": "CRA",
      "celex": "32024R2847",
      "eli": "https://eur-lex.europa.eu/eli/reg/2024/2847/oj",
      "type": "regulation",
      "layer": "product",
      "status": "applies-partially",
      "in_force": "2024-12-10",
      "key_date": "2026-09-11 reporting; 2027-12-11 full",
      "href": "/regulations/cra",
      "one_liner": "Security by design for every product with digital elements; CE marking."
    },
    {
      "id": "dora",
      "title": "DORA",
      "short": "DORA",
      "celex": "32022R2554",
      "eli": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj",
      "type": "regulation",
      "layer": "sectoral",
      "status": "in-force",
      "in_force": "2023-01-16",
      "key_date": "2025-01-17 applies",
      "href": "/regulations/dora",
      "one_liner": "ICT-risk regime for the financial sector; lex specialis to NIS2."
    },
    {
      "id": "red-cyber",
      "title": "RED Cybersecurity (Delegated Reg. 2022/30)",
      "short": "RED",
      "celex": "32022R0030",
      "eli": "https://eur-lex.europa.eu/eli/reg_del/2022/30/oj",
      "type": "delegated-regulation",
      "layer": "product",
      "status": "in-force",
      "in_force": "2025-08-01",
      "key_date": "superseded by CRA in 2027",
      "href": "/regulations/red-cyber",
      "one_liner": "Cybersecurity for connected radio equipment / IoT; on-ramp to the CRA."
    },
    {
      "id": "gdpr-security",
      "title": "GDPR (security & breach)",
      "short": "GDPR",
      "celex": "32016R0679",
      "eli": "https://eur-lex.europa.eu/eli/reg/2016/679/oj",
      "type": "regulation",
      "layer": "adjacent",
      "status": "in-force",
      "in_force": "2018-05-25",
      "href": "/regulations/gdpr-security",
      "one_liner": "Security of processing (Art. 32) and 72h breach notification (Art. 33/34)."
    },
    {
      "id": "eidas2",
      "title": "eIDAS 2",
      "short": "eIDAS",
      "celex": "32024R1183",
      "eli": "https://eur-lex.europa.eu/eli/reg/2024/1183/oj",
      "type": "regulation",
      "layer": "adjacent",
      "status": "in-force",
      "in_force": "2024-05-20",
      "href": "/regulations/eidas2",
      "one_liner": "EU Digital Identity Wallet and trust-service security."
    },
    {
      "id": "ai-act-cyber",
      "title": "AI Act (cybersecurity)",
      "short": "AI Act",
      "celex": "32024R1689",
      "eli": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj",
      "type": "regulation",
      "layer": "adjacent",
      "status": "applies-partially",
      "in_force": "2024-08-01",
      "key_date": "2026-08-02 high-risk obligations",
      "href": "/regulations/ai-act-cyber",
      "one_liner": "Cybersecurity/robustness for high-risk AI (Art. 15) and systemic GPAI (Art. 55)."
    },
    {
      "id": "other-instruments",
      "title": "Other instruments",
      "short": "Other",
      "type": "mixed",
      "layer": "mixed",
      "status": "mixed",
      "href": "/regulations/other-instruments",
      "one_liner": "NCCS, Machinery Reg, Product Liability Directive, cybercrime directive, ePrivacy, Data Act, soft law."
    },
    {
      "id": "csa2",
      "title": "Cybersecurity Act 2 (CSA2)",
      "short": "CSA2",
      "celex": "COM(2026)11",
      "type": "proposal",
      "layer": "horizontal",
      "status": "proposal",
      "key_date": "proposed 2026-01-20",
      "href": "/proposals/csa2",
      "one_liner": "PROPOSAL: stronger ENISA, reformed certification, ICT supply-chain security."
    },
    {
      "id": "nis2-amendments-2026",
      "title": "NIS2 Targeted Amendments",
      "short": "NIS2+",
      "type": "proposal",
      "layer": "horizontal",
      "status": "proposal",
      "key_date": "proposed 2026-01-20",
      "href": "/proposals/nis2-amendments-2026",
      "one_liner": "PROPOSAL: jurisdiction clarity, 'small mid-cap' relief, SEP alignment."
    },
    {
      "id": "digital-omnibus-sep",
      "title": "Digital Omnibus / Single Entry Point",
      "short": "Omnibus",
      "type": "proposal",
      "layer": "horizontal",
      "status": "proposal",
      "key_date": "proposed 2025-11",
      "href": "/proposals/digital-omnibus-sep",
      "one_liner": "PROPOSAL: 'report once, share many' single incident-reporting point via ENISA."
    }
  ]
}