SkarpChapter 1 of 12
Read the Regulator’s Playbook
Students will be able to construct an authority-power-remedy-review matrix for an EU cybersecurity enforcement matter.
1. Start with the enforcement question
The assigned objective
Construct an authority-power-remedy-review matrix for the payments firm's cybersecurity enforcement matter.
Each row connects a named authority, an exact legal power, a possible binding outcome, and the route for reviewing that outcome.
2. Use a disciplined row-building method
One row, one legal route
Use: `Regime and issue | Entity and authority | Legal basis | Power | Corrective measure | Penalty | Review`.
Distinguish an investigative step from a binding corrective or penalty decision. Mark missing national law for verification.
3. Construct the principal DORA row
Constructed DORA chain
Article 46 identifies the competent-authority route. Article 50(2)(a) supports access to and copying of relevant documents or data; Article 50(2)(b) supports on-site inspections or investigations; Article 50(2)(c) supports corrective and remedial measures.
Article 50(6) requires reasons and appeal for decisions imposing Article 50(2)(c) measures. National law must supply the forum, deadline, and procedure.
4. Add the GDPR row without merging authorities
Completed GDPR route
Document the Article 55 or 56 competence conclusion. Investigation and correction: Article 58. Penalties: Article 83. Judicial remedy: Article 78.
Do not treat the European Data Protection Board as the first-instance investigator.
5. Apply the NIS2 scope and sector-specific-law gates
Apply both gates precisely
First determine whether the payments firm is an essential or important entity under national rules transposing NIS2 Article 3.
If it is, DORA Article 1(2) gives DORA sector-specific status for that entity; then apply NIS2 Article 4 to the particular obligation.
6. Audit sources and review routes
Run a paragraph-level source audit
Every matrix entry needs an exact EU provision and the applicable national source or an express unresolved placeholder.
Separate possible review of an investigative step from appeal of a binding corrective or penalty decision.
7. Assemble the board-ready matrix
Compare routes without merging them
Keep DORA and GDPR in separate rows. Add NIS2 only after the Article 3 scope and Article 4 equivalence gates.
A complete row must identify authority, power, outcome, and review. Use verification placeholders for missing national details.
8. Check the matrix
Choose the best treatment of the possible NIS2 route.
The payments firm is a financial entity covered by DORA. How should counsel treat NIS2 in the enforcement matrix for the same outage?
- First determine whether the firm is an essential or important entity under national rules transposing NIS2 Article 3. If it is, treat DORA as sector-specific for that entity under DORA Article 1(2), then apply NIS2 Article 4 to the particular obligation and omit corresponding NIS2 enforcement provisions where the equivalence conditions are met
- Always add a second NIS2 enforcement row because every cybersecurity outage creates cumulative DORA and NIS2 supervision
- Omit the NIS2 scope check because DORA coverage automatically makes every firm and corporate-group entity subject to NIS2
Show Answer
Answer: A) First determine whether the firm is an essential or important entity under national rules transposing NIS2 Article 3. If it is, treat DORA as sector-specific for that entity under DORA Article 1(2), then apply NIS2 Article 4 to the particular obligation and omit corresponding NIS2 enforcement provisions where the equivalence conditions are met
DORA coverage does not by itself establish NIS2 scope. Counsel must first determine whether the firm is an essential or important entity under national rules transposing NIS2 Article 3. If it is, DORA Article 1(2) gives DORA sector-specific status for that entity, after which NIS2 Article 4 requires an obligation-specific equivalence analysis. Where its conditions are met, the corresponding NIS2 provisions, including related Chapter VII supervision and enforcement provisions, do not apply.
Key Terms
- Judicial review
- Court scrutiny of a binding regulatory decision under the applicable forum, procedure, and deadline.
- Corrective measure
- A binding measure designed to stop, limit, or remedy non-compliant conduct.
- Competent authority
- The regulator legally designated to supervise, investigate, or enforce a particular regime.
- Investigatory power
- A legally defined power to obtain information, inspect, audit, access premises, or seek explanations.
- Administrative penalty
- A regulatory sanction imposed under the applicable EU and national legal framework.
- Sector-specific Union legal act
- An EU legal act whose cybersecurity requirements may displace corresponding NIS2 provisions where the conditions in NIS2 Article 4 are met.