Cyprus
Current Status: Partially implemented
Expected or actual implementation date or timeline
No official date for full transposition has been confirmed as of March 2026. Implementation measures remain ongoing, with key legislative steps taken in 2025, including the enactment of the Civil Defence (Resilience of Critical Entities) Regulations of 2024 in July 2025 and the NIS2 transposition law in April 2025.
If implemented, whether a transition period applies and, if so, its duration
Not applicable, as no fully enacted dedicated CER transposing framework has been adopted to date.
Other important remarks/notes
Cyprus failed to meet the 17 October 2024 transposition deadline under Directive (EU) 2022/2557 and remains subject to European Commission infringement proceedings as of March 2026.
While draft legislation has significantly progressed, establishing a framework for the identification and supervision of critical entities, including obligations on risk assessment, resilience measures, and incident reporting, only limited legislative steps have been formally adopted.
These include the Civil Defence (Resilience of Critical Entities) Regulations of 2024, which transpose elements of the Directive but do not constitute full transposition.
Cyprus has not yet notified complete transposition measures to the European Commission. Cyprus is progressing via a combined resilience and cybersecurity approach but lacks a comprehensive CER-specific legal framework as of early 2026.
The Law on the Security of Networks and Information Systems (Amendment) of 2025, transposing the NIS2 Directive, introduces overlapping obligations on risk management, incident reporting, and supervision of essential and important entities; however, it does not address CER-specific obligations such as critical entity identification, resilience planning, and sector-specific oversight, which remain to be introduced through dedicated legislation. Additionally, under the CER Directive's downstream timeline, Cyprus was required to adopt a national strategy for critical entity resilience by 17 January 2026 and must formally identify and designate critical entities by 17 July 2026; neither step has been confirmed as completed as of March 2026, meaning that entity-level obligations, including internal risk assessments, resilience measures, and incident reporting, have not yet been triggered.
Key contact
Theo Demetriou
© Eversheds Sutherland. All rights reserved. Eversheds Sutherland is a global provider of legal and other services operating through various separate and distinct legal entities. Eversheds Sutherland is the name and brand under which the members of Eversheds Sutherland Limited (Eversheds Sutherland (International) LLP and Eversheds Sutherland (US) LLP) and their respective controlled, managed and affiliated firms and the members of Eversheds Sutherland (Europe) Limited (each an "Eversheds Sutherland Entity" and together the "Eversheds Sutherland Entities") provide legal or other services to clients around the world. Eversheds Sutherland Entities are constituted and regulated in accordance with relevant local regulatory and legal requirements and operate in accordance with their locally registered names. The use of the name Eversheds Sutherland, is for description purposes only and does not imply that the Eversheds Sutherland Entities are in a partnership or are part of a global LLP. The responsibility for the provision of services to the client is defined in the terms of engagement between the instructed firm and the client.
Connect with us
