### provide advertisers and publishers to which it supplies advertising services , upon their request , with information concerning the price paid by the advertiser and publisher , as well as the amount or remuneration paid to the publisher , for the publishing of a given ad and for each of the relevant advertising services provided by the gatekeeper. ### provide advertisers and publishers , or third parties authorised by advertisers and publishers , to which it supplies advertising services , upon their request and free of charge , with continuous , detailed , comprehensive , real-time and easy to access information concerning the price paid by the advertiser and publisher , as well as the amount or remuneration paid to the publisher , for the publishing of a given ad and for each of the relevant advertising services provided by the gatekeeper , including aggregated data and performance data in a manner that would allow advertisers and publishers to run their own verification and measurement tools to assess performance of the core services provided for by the gatekeepers;


### provide advertisers and publishers to which it supplies advertising services , upon their request , with information concerning the price paid by the advertiser and publisher , as well as the amount or remuneration paid to the publisher , for the publishing of a given ad and for each of the relevant advertising services provided by the gatekeeper. ### provide an advertiser or publisher to which it supplies advertising services , upon request , with:


### provide advertisers and publishers to which it supplies advertising services , upon their request , with information concerning the price paid by the advertiser and publisher , as well as the amount or remuneration paid to the publisher , for the publishing of a given ad and for each of the relevant advertising services provided by the gatekeeper. ### provide each advertiser and publisher to which it supplies services with free of charge , high-quality , and effective access to information on the price paid by the advertiser or advertising intermediary , as well as the remuneration paid to the publisher , for the publishing of a given ad and for each of the relevant advertising services provided by the gatekeeper.


### allow end users to un-install any pre-installed software applications on its core platform service without prejudice to the possibility for a gatekeeper to restrict such un-installation in relation to software applications that are essential for the functioning of the operating system or of the device and which cannot technically be offered on a standalone basis by third-parties; ### allow end users to un-install any pre-installed software applications and provide users an option to change to a default see tings in regards and without any pre-installed software on anon-discriminatory basis on its core platform service without prejudice to the possibility for a gatekeeper to restrict such un-installation or pre-installment of software in relation to software applications that are essential for the functioning of the operating system or of the device and which cannot technically be offered on a standalone basis by third-parties;


### allow end users to un-install any pre-installed software applications on its core platform service without prejudice to the possibility for a gatekeeper to restrict such un-installation in relation to software applications that are essential for the functioning of the operating system or of the device and which cannot technically be offered on a standalone basis by third-parties; ### allow end users to un-install any pre-installed software applications on its core platform service and refrain from exclusively enabling its own core platform services as default services when equivalent alternative services which perform the same function can be proposed , without prejudice to the possibility for a gatekeeper to restrict such un-installation in relation to software applications that are essential for the functioning of the operating system or of the device and which cannot technically be offered on a standalone basis by third-parties;


### allow the installation and effective use of third party software applications or software application stores using , or interoperating with , operating systems of that gatekeeper and allow these software applications or software application stores to be accessed by means other than the core platform services of that gatekeeper. the gatekeeper shall not be prevented from taking proportionate measures to ensure that third party software applications or software application stores do not endanger the integrity of the hardware or operating system provided by the gatekeeper; ### allow the installation and effective use of third party software applications or software application stores using , or interoperating with , operating systems of that gatekeeper and allow these software applications or software application stores to be accessed by means other than the core platform services of that gatekeeper , and the ability of end users to choose between different software applications from different distribution channels . the gatekeeper shall not be prevented from taking proportionate measures to ensure that third party software applications or software application stores do not endanger the integrity of the hardware or operating system provided by the gatekeeper;


### allow the installation and effective use of third party software applications or software application stores using , or interoperating with , operating systems of that gatekeeper and allow these software applications or software application stores to be accessed by means other than the core platform services of that gatekeeper. the gatekeeper shall not be prevented from taking proportionate measures to ensure that third party software applications or software application stores do not endanger the integrity of the hardware or operating system provided by the gatekeeper; ### allow and technically enable the installation and effective use and interoperability of third party software applications or software application stores using , or interoperating with , operating systems of that gatekeeper and allow and enable these software applications or software application stores to be accessed by means other than the core platform services of that gatekeeper. the gatekeeper shall not be prevented from taking proportionate measures to ensure that third party software applications or software application stores do not endanger the integrity of the hardware or operating system provided by the gatekeeper , provided that such proportionate measures are duly justified;


### allow the installation and effective use of third party software applications or software application stores using , or interoperating with , operating systems of that gatekeeper and allow these software applications or software application stores to be accessed by means other than the core platform services of that gatekeeper. the gatekeeper shall not be prevented from taking proportionate measures to ensure that third party software applications or software application stores do not endanger the integrity of the hardware or operating system provided by the gatekeeper; ### allow and technically enable the installation and effective use of third party software applications or software application stores using , or interoperating with , operating systems of that gatekeeper and allow these software applications or software application stores to be accessed by means other than the core platform services of that gatekeeper. the gatekeeper shall not be prevented from taking proportionate measures to ensure that third party software applications or software application stores do not endanger the integrity of the hardware or operating system provided by the gatekeeper , provided that such proportionate measures are duly justified;


### provide advertisers and publishers , upon their request and free of charge , with access to the performance measuring tools of the gatekeeper and the information necessary for advertisers and publishers to carry out their own independent verification of the ad inventory; ### provide advertisers and publishers , or third parties authorised by advertisers and publishers , upon their request and free of charge , with continuous , detailed , comprehensive , accessible and real-time access information access to the performance measuring tools of the gatekeeper and the information necessary for advertisers and publishers to carry out their own independent verification of the ad inventory , including aggregated data and performance data in a manner that would allow advertisers and publishers to run their own verification and measurement tools to assess performance of the core services provided for by the gatekeepers;


### provide advertisers and publishers , upon their request and free of charge , with access to the performance measuring tools of the gatekeeper and the information necessary for advertisers and publishers to carry out their own independent verification of the ad inventory; ### provide advertisers and publishers , or third parties authorised by advertisers and publishers , upon their request and free of charge , with effective and real time access to the performance measuring tools of the gatekeeper and the information necessary for advertisers and publishers to carry out their own independent verification of the ad inventory , including aggregated data and performance data in a manner that would allow advertisers and publishers to run their own verification and measurement tools to assess performance of the core services provided by the gatekeepers;


### provide effective portability of data generated through the activity of a business user or end user and shall , in particular , provide tools for end users to facilitate the exercise of data portability , in line with regulation eu 2016/679 , including by the provision of continuous and real-time access ; ### provide effective portability of data generated through the activity of a business user or end user and shall , in particular , provide user-friendly tools for end users to facilitate the exercise of data portability , including personal data generated by his or her activity , in line with regulation eu 2016/679 , including by the provision of continuous and real-time access;


### provide effective portability of data generated through the activity of a business user or end user and shall , in particular , provide tools for end users to facilitate the exercise of data portability , in line with regulation eu 2016/679 , including by the provision of continuous and real-time access; ### provide effective portability of data provided for or generated through or in the context of the activity of a business user or end user and shall , in particular , provide free of charge and technically accessible tools for business users , or third parties authorised by business users or end users to facilitate the exercise of data portability , in line with regulation eu 2016/679 , including by the provision of continuous and real-time access;


### provide effective portability of data generated through the activity of a business user or end user and shall , in particular , provide tools for end users to facilitate the exercise of data portability , in line with regulation eu 2016/679 , including by the provision of continuous and real-time access ; ### provide effective portability of data generated through the activity of a business user or end user and shall , in particular , provide tools for end users to facilitate the exercise of data portability of personal data , in line with and building on regulation eu 2016/679 , and non-personal data including by the provision of continuous and real-time access. the commission shall determine by means of implementing acts the technical means acceptable to ensure an easy , secure , continuous and real-time access;


### provide effective portability of data generated through the activity of a business user or end user and shall , in particular , provide tools for end users to facilitate the exercise of data portability , in line with regulation eu 2016/679 , including by the provision of continuous and real-time access ; ### provide effective portability of data generated through the activity of a business user or end user and shall , in particular , provide free of charge and technically accessible tools for business users , or third parties authorised by a business user , and end users to facilitate the exercise of data portability , in line with regulation (eu) 2016/679 , including by the provision of continuous and real-time access ;


### provide to any third party providers of online search engines , upon their request , with access on fair , reasonable and non-discriminatory terms to ranking , query , click and view data in relation to free and paid search generated by end users on online search engines of the gatekeeper , subject to anonymisation for the query , click and view data that constitutes personal data; ### provide to any third party providers of online search engines , upon their request , with access on fair , reasonable and non-discriminatory terms to ranking , query , click and view data in relation to free and paid search generated by end users on online search engines of the gatekeeper , subject to effective anonymisation with every reasonable means and techniques available to prevent re-identification for the query , click and view data that constitutes personal data and the steps taken to enable end users to be aware of the relevant use of personal data , as well as to seek their consent;


### apply fair and non-discriminatory general conditions of access for business users to its software application store designated pursuant to article 3 of this regulation. ### apply fair and non-discriminatory general conditions of access for business users to its or of ancillary services offered by the gatekeeper software application store , cloud computing services , online search engines and online social networking services designated pursuant to article 3 of this regulation.


### apply fair and non-discriminatory general conditions of access for business users to its software application store designated pursuant to article 3 of this regulation. ### apply fair and non-discriminatory general conditions of access and treatment for business users to its core platform service , in particular to its software application store , its online search engine and to its online social networking service designated pursuant to article 3 of this regulation.


### apply fair and non-discriminatory general conditions of access for business users to its software application store designated pursuant to article 3 of this regulation. ### apply fair and non-discriminatory general conditions of access and treatment for business users to its core platform services including software application store , cloud computing services , online search engines and online social networking services designated pursuant to article 3 of this regulation.


### 2. for the purposes of point (a) of paragraph 1 data that is not publicly available shall include any aggregated and non-aggregated data generated by business users that can be inferred from , or collected through , the commercial activities of business users or their customers on the core platform service of the gatekeeper. ### 2. for the purposes of point (a) of paragraph 1 data exclusively in domain of core platform provider shall include any aggregated and non-aggregated data generated by business users that can be inferred from , or collected through , the commercial activities of business users or their customers on the core platform service of the gatekeeper.


### 2. for the purposes of point (a) of paragraph 1 data that is not publicly available shall include any aggregated and non-aggregated data generated by business users that can be inferred from , or collected through , the commercial activities of business users or their customers on the core platform service of the gatekeeper. ### 2. for the purposes of point (a) of paragraph 1 data that is not publicly available shall include any aggregated and non-aggregated data provided by , or observed from business users or end users through the commercial activities on the core platform service of the gatekeeper.


### (29) designated gatekeepers should comply with the obligations laid down in this regulation in respect of each of the core platform services listed in the relevant designation decision. the mandatory rules should apply taking into account the conglomerate position of gatekeepers , where applicable. furthermore , implementing measures that the commission may by decision impose on the gatekeeper following a regulatory dialogue should be designed in an effective manner , having regard to the features of core platform services as well as possible circumvention risks and in compliance with the principle of proportionality and the fundamental rights of the undertakings concerned as well as those of third parties. ### (29) designated gatekeepers should comply with the obligations laid down in this regulation in respect of each of the core platform services listed in the relevant designation decision. the mandatory rules should apply taking into account the conglomerate position of gatekeepers , where applicable. furthermore , implementing measures that the commission may by decision impose on the gatekeeper following a regulatory dialogue should be designed in an effective manner , having regard to the features of core platform services as well as possible circumvention risks and in compliance with the principle of proportionality and the fundamental rights of the undertakings concerned as well as those of third parties. the participants , agenda and results of regulatory dialogue should be made public. the regulatory dialogue itself should not take longer than 6 months.


### (29) designated gatekeepers should comply with the obligations laid down in this regulation in respect of each of the core platform services listed in the relevant designation decision. the mandatory rules should apply taking into account the conglomerate position of gatekeepers , where applicable. furthermore , implementing measures that the commission may by decision impose on the gatekeeper following a regulatory dialogue should be designed in an effective manner , having regard to the features of core platform services as well as possible circumvention risks and in compliance with the principle of proportionality and the fundamental rights of the undertakings concerned as well as those of third parties. ### (29) designated gatekeepers should comply with the obligations laid down in this regulation in respect of each of the core platform services listed in the relevant designation decision. the mandatory rules should apply taking into account the conglomerate position of gatekeepers within the undertaking to which they belong , where applicable. furthermore , implementing measures that the commission may by decision impose on the gatekeeper following a regulatory dialogue should be designed in an effective manner , having regard to the features of core platform services as well as possible circumvention risks and in compliance with the principle of proportionality and the fundamental rights of the undertakings concerned as well as those of third parties.


### (52) gatekeepers may also have a dual role as developers of operating systems and device manufacturers , including any technical functionality that such a device may have. for example , a gatekeeper that is a manufacturer of a device may restrict access to some of the functionalities in this device , such as near-field-communication technology and the software used to operate that technology , which may be required for the effective provision of an ancillary service by the gatekeeper as well as by any potential third party provider of such an ancillary service. such access may equally be required by software applications related to the relevant ancillary services in order to effectively provide similar functionalities as those offered by gatekeepers. if such a dual role is used in a manner that prevents alternative providers of ancillary services or of software applications to have access under equal conditions to the same operating system , hardware or software features that are available or used in the provision by the gatekeeper of any ancillary services , this could significantly undermine innovation by providers of such ancillary services as well as choice for end users of such ancillary services. the gatekeepers should therefore be obliged to ensure access under equal conditions to , and interoperability with , the same operating system , hardware or software features that are available or used in the provision of any ancillary services by the gatekeeper. ### (52) gatekeepers may also have a dual role as developers of operating systems and device manufacturers , including any technical functionality that such a device may have. for example , a gatekeeper that is a manufacturer of a device may restrict access to some of the functionalities in this device , such as near-field-communication technology and the software used to operate that technology , which may be required for the effective provision of an ancillary service by the gatekeeper as well as by any potential third party provider of such an ancillary service. such access may equally be required by software applications related to the relevant ancillary services in order to effectively provide similar functionalities as those offered by gatekeepers. if such a dual role is used in a manner that prevents alternative providers of ancillary services or of software applications to have access under equal conditions to the same operating system , hardware or software features that are available or used in the provision by the gatekeeper of any ancillary services , this could significantly undermine innovation by providers of such ancillary services as well as choice for end users of such ancillary services. the gatekeepers should therefore be obliged to ensure access free of charge under equal conditions to , and interoperability with , the same operating system , hardware or software features that are available or used in the provision of any ancillary services by the gatekeeper. the gatekeeper should not be prevented from taking indispensable measures to ensure that third party ancillary services do not compromise the integrity of the operating system , hardware or software features it provides. the gatekeeper should however be obliged to duly justify suchindispensable measures and provide , free of charge , an alternative access and interoperability solution to enable effective provision of ancillary services.


### advertising services , including any advertising networks , advertising exchanges and any other advertising intermediation services , provided by a provider of any of the core platform services listed in points (a) to (g); ### advertising services , including any advertising networks , advertising exchanges and any other advertising intermediation services , provided by a provider where the undertaking to which it belongs to is also a provider of any of the core platform services listed in points (a) to (g);


### 3. when sending a simple request for information to an undertaking or association of undertakings , the commission shall state the purpose of the request , specify what information is required and fix the time-limit within which the information is to be provided , and the penalties provided for in article 26 for supplying incomplete , incorrect or misleading information or explanations. ### 3. when sending a simple request for information to an undertaking or association of undertakings , the commission shall state the purpose of the request , specify what information is required and fix the time-limit within which the information is to be provided , and the penalties provided for in article 26 for supplying incomplete , incorrect or misleading information or explanations. such time-limits provided should respect the size and capabilities of an undertaking or association of undertakings.


### 4. where the commission requires undertakings and associations of undertakings to supply information by decision , it shall state the purpose of the request , specify what information is required and fix the time-limit within which it is to be provided. where the commission requires undertakings to provide access to its data-bases and algorithms , it shall state the legal basis and the purpose of the request , and fix the time-limit within which it is to be provided. it shall also indicate the penalties provided for in article 26 and indicate or impose the periodic penalty payments provided for in article 27. it shall further indicate the right to have the decision reviewed by the court of justice. ### 4. where the commission requires undertakings and associations of undertakings to supply information by decision , it shall state the purpose of the request , specify what information is required and fix the time-limit within which it is to be provided. where the commission requires undertakings to provide access to its data-bases and algorithms , it shall state the legal basis and the purpose of the request , and fix the time-limit within which it is to be provided. it shall also indicate the penalties provided for in article 26 and indicate or impose the periodic penalty payments provided for in article 27. it shall further indicate the right to have the decision reviewed by the court of justice. such time-limits provided should respect the size and capabilities of an undertaking or association of undertakings.


### 4. where the commission requires undertakings and associations of undertakings to supply information by decision , it shall state the purpose of the request , specify what information is required and fix the time-limit within which it is to be provided. where the commission requires undertakings to provide access to its data-bases and algorithms , it shall state the legal basis and the purpose of the request , and fix the time-limit within which it is to be provided. it shall also indicate the penalties provided for in article 26 and indicate or impose the periodic penalty payments provided for in article 27. it shall further indicate the right to have the decision reviewed by the court of justice. ### 4. where the commission requires undertakings and associations of undertakings to supply information by decision , it shall state the purpose of the request , specify what information is required and fix the time-limit within which it is to be provided. where the commission requires undertakings to provide access to its data-bases and algorithms , it shall state the legal basis and the purpose of the request , and fix the time-limit within which it is to be provided. the decision shall also indicate the penalties provided for in article 26 and indicate or impose the periodic penalty payments provided for in article 27. it shall further indicate the right to have the decision reviewed by the court of justice.


### where the gatekeeper presents such sufficiently substantiated arguments to demonstrate that it does not satisfy the requirements of paragraph 1 , the commission shall apply paragraph 6 to assess whether the criteria in paragraph 1 are met. ### deleted


### where the gatekeeper presents such sufficiently substantiated arguments to demonstrate that it does not satisfy the requirements of paragraph 1 , the commission shall apply paragraph 6 to assess whether the criteria in paragraph 1 are met. ### where the provider of core platform services presents such sufficiently substantiated arguments to demonstrate that it exceptionally does not satisfy the requirements set out in paragraph 1 although it meets all the thresholds set out in paragraph 2 , the commission shall designate that provider as a gatekeeper , in accordance with the procedure laid down in article 15(3) , if it concludes that the provider was not able to demonstrate that the relevant core platform service it provides does not satisfy the requirements set out in paragraph 1.


### 4. in view of adopting the decision under paragraph 2 , the commission shall communicate its preliminary findings within three months from the opening of the proceedings. in the preliminary findings , the commission shall explain the measures it considers to take or it considers that the provider of core platform services concerned should take in order to effectively address the preliminary findings. ### 4. in view of adopting the decision under paragraph 2 , the commission shall communicate its preliminary findings within three months from the opening of the proceedings. in the preliminary findings , the commission shall explain the measures it considers to take or it considers that the provider of core platform services concerned should take in order to effectively address the preliminary findings. legitimate third parties with direct implication shall be able to provide comments to the national competent authorities with regard to the preliminary findings. member states shall define the rules to exercise such consultation procedure.


### 4. in view of adopting the decision under paragraph 2 , the commission shall communicate its preliminary findings within three months from the opening of the proceedings. in the preliminary findings , the commission shall explain the measures it considers to take or it considers that the provider of core platform services concerned should take in order to effectively address the preliminary findings. ### 4. in view of adopting the decision under paragraph 2 , the commission shall communicate its preliminary findings within three months from the opening of the proceedings. in the preliminary findings , the commission shall explain the measures it considers to take or it considers that the provider of core platform services concerned should take in order to effectively address the preliminary findings , taking into account the issues discussed during the regulatory dialogue.


### 4. in view of adopting the decision under paragraph 2 , the commission shall communicate its preliminary findings within three months from the opening of the proceedings. in the preliminary findings , the commission shall explain the measures it considers to take or it considers that the provider of core platform services concerned should take in order to effectively address the preliminary findings. ### 4. in view of adopting the decision under paragraph 2 , the commission shall communicate its preliminary findings as soon as possible , and in any case no later than three months from the opening of the proceedings. in the preliminary findings , the commission shall explain the measures it considers to take or it considers that the provider of core platform services concerned should take in order to effectively address the preliminary findings.


### in assessing the request , the commission shall take into account , in particular , the impact of the compliance with the specific obligation on the grounds in paragraph 2 as well as the effects on the gatekeeper concerned and on third parties. the suspension may be made subject to conditions and obligations to be defined by the commission in order to ensure a fair balance between the goals pursued by the grounds in paragraph 2 and the objectives of this regulation. such a request may be made and granted at any time pending the assessment of the commission pursuant to paragraph 1. ### in assessing the request , the commission shall take into account , in particular , the impact of the compliance with the specific obligation on the grounds in paragraph 2 as well as the effects on the gatekeeper concerned and on third parties. the suspension may be made subject to conditions and obligations to be defined by the commission in order to ensure a fair balance between the goals pursued by the grounds in paragraph 2 and the objectives of this regulation. such a request may be made and granted at any time pending the assessment of the commission pursuant to paragraph 1. the commission shall review any exemption decision adopted according to paragraph 1 on an annual basis and may amend its decision in accordance with its findings.


### 5. the commission shall communicate its objections to the gatekeeper concerned within six months from the opening of the investigation. in its objections , the commission shall explain whether it preliminarily considers that the conditions of paragraph 1 are met and which remedy or remedies it preliminarily considers necessary and proportionate. ### 5. the commission shall communicate its objections to the gatekeeper concerned as soon as possible , and in any case no later than six months from the opening of the investigation. in its objections , the commission shall explain whether it preliminarily considers that the conditions of paragraph 1 are met and which remedy or remedies it preliminarily considers necessary and proportionate.


### 6. at the request of the commission , the governments and authorities of the member states shall provide the commission with all necessary information to carry out the duties assigned to it by this regulation. ### 6. at the request of the commission or on their own initiative , relevant public authorities , bodies or agencies within of the member states shall provide the commission with all the necessary information to carry out the duties assigned to it by this regulation.


### 6. at the request of the commission , the governments and authorities of the member states shall provide the commission with all necessary information to carry out the duties assigned to it by this regulation. ### 6. at the request of the commission , competent national competition authorities shall provide the commission with all necessary information to carry out the duties assigned to it by this regulation.


### the commission may interview any natural or legal person which consents to being interviewed for the purpose of collecting information , relating to the subject-matter of an investigation , including in relation to the monitoring , implementing and enforcing of the rules laid down in this regulation. ### the commission , and competent national authorities , may interview any natural or legal person which consents to being interviewed for the purpose of collecting information , relating to the subject-matter of an investigation , pursuant to articles 7 , 16 , 17 , 25 and 26 , including in relation to the monitoring , implementing and enforcing of the rules laid down in this regulation.


### the commission may interview any natural or legal person which consents to being interviewed for the purpose of collecting information , relating to the subject-matter of an investigation , including in relation to the monitoring , implementing and enforcing of the rules laid down in this regulation. ### the commission and the competent national competition authorities , may , in accordance with article 32a , interview any natural or legal person which consents to being interviewed for the purpose of collecting information , relating to the subject-matter of an investigation , pursuant to articles 7 , 16 , 17 , 25 and 26 , including in relation to the monitoring , implementing and enforcing of the rules laid down in this regulation.


### 2. on-site inspections may also be carried out with the assistance of auditors or experts appointed by the commission pursuant to article 24(2). ### 2. on-site inspections may also be carried out with the assistance of auditors or experts appointed by the commission pursuant to article 24(2) as well as competent national authorities in the territory of that member state , where the gatekeeper has its premises.


### 1. in case of urgency due to the risk of serious and irreparable damage for business users or end users of gatekeepers , the commission may , by decision adopt in accordance with the advisory procedure referred to in article 32(4) , order interim measures against a gatekeeper on the basis of a prima facie finding of an infringement of articles 5 or 6. ### 1. in case of urgency due to the risk of serious and immediate damage for business users or end users of gatekeepers , the commission may , by decision adopt in accordance with the advisory procedure referred to in article 32(4) , order interim measures against a gatekeeper on the basis of a prima facie finding of an infringement of articles 5 or 6.


### 1. if during proceedings under articles 16 or 25 the gatekeeper concerned offers commitments for the relevant core platform services to ensure compliance with the obligations laid down in articles 5 and 6 , the commission may by decision adopted in accordance with the advisory procedure referred to in article 32(4) make those commitments binding on that gatekeeper and declare that there are no further grounds for action. ### 1. if during proceedings under articles 16 or 25 the gatekeeper concerned offers commitments for the relevant core platform services to ensure compliance with the obligations laid down in articles 5 and 6 , the commission may by decision adopted in accordance with the advisory procedure referred to in article 32(4) make those commitments binding on that gatekeeper and declare that there are no further grounds for action. the commission shall , where appropriate , be entitled to require the commitments to be tested to optimise their effectiveness.


### 2. the actions pursuant to paragraph 1 may include the appointment of independent external experts and auditors to assist the commission to monitor the obligations and measures and to provide specific expertise or knowledge to the commission. ### 2. the actions pursuant to paragraph 1 may include the appointment of independent external experts and auditors to assist the commission , including ones from competent national authorities , to monitor the obligations and measures and to provide specific expertise or knowledge to the commission.


### 2. before adopting the decision pursuant to paragraph 1 , the commission shall communicate its preliminary findings to the gatekeeper concerned. in the preliminary findings , the commission shall explain the measures it considers to take or it considers that the gatekeeper should take in order to effectively address the preliminary findings. ### 2. before adopting the decision pursuant to paragraph 1 , the commission shall communicate its preliminary findings to the gatekeeper concerned. in the preliminary findings , the commission shall explain the measures it considers to take or it considers that the gatekeeper should take in order to effectively address the preliminary findings. the commission shall take into account the views of relevant third parties such as end-users or business users before adopting a decision.


### 1. the commission may adopt implementing acts concerning: 3 , 6 , 12 , 13 , 15 , 16 , 17 , 20 , 22 , 23 , 25 and 30 ### 1. the commission may adopt implementing acts concerning articles 3 , 6 , 12 , 13 , 15 , 16 , 17 , 20 , 22 , 23 , 25 and 30 with respect to:


### 1. the commission may adopt implementing acts concerning: 3 , 6 , 12 , 13 , 15 , 16 , 17 , 20 , 22 , 23 , 25 and 30 ### 1. the commission may adopt implementing acts concerning articles: 3 , 6 , 12 , 13 , 15 , 16 , 17 , 20 , 22 , 23 , 25 and 30 with respect to:


### the form , content and other details of the technical measures that gatekeepers shall implement in order to ensure compliance with points (h) , (i) and (j) of article 6(1). ### the form , content and other details of the technical measures that gatekeepers shall implement in order to ensure compliance with article 6(1).


### 2. the practical arrangements for the cooperation and coordination between the commission and member states provided for in article 1(7).those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 32(4). before the adoption of any measures pursuant to paragraph 1 , the commission shall publish a draft thereof and invite all interested parties to submit their comments within the time limit it lays down , which may not be less than one month. ### 2. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 32(4). before the adoption of any measures pursuant to paragraph 1 , the commission shall publish a draft thereof and invite all interested parties to submit their comments within the time limit it lays down , which may not be less than one month.


### 2. this regulation shall apply from six months after its entry into force. ### 2. this regulation shall apply from three months after its entry into force.


### (64) the commission should investigate and assess whether additional behavioural , or , where appropriate , structural remedies are justified , in order to ensure that the gatekeeper cannot frustrate the objectives of this regulation by systematic non-compliance with one or several of the obligations laid down in this regulation , which has further strengthened its gatekeeper position. this would be the case if the gatekeeper’s size in the internal market has further increased , economic dependency of business users and end users on the gatekeeper’s core platform services has further strengthened as their number has further increased and the gatekeeper benefits from increased entrenchment of its position. the commission should therefore in such cases have the power to impose any remedy , whether behavioural or structural , having due regard to the principle of proportionality. structural remedies , such as legal , functional or structural separation , including the divestiture of a business , or parts of it , should only be imposed either where there is no equally effective behavioural remedy or where any equally effective behavioural remedy would be more burdensome for the undertaking concerned than the structural remedy. changes to the structure of an undertaking as it existed before the systematic non-compliance was established would only be proportionate where there is a substantial risk that this systematic non-compliance results from the very structure of the undertaking concerned. ### (64) the commission should investigate and assess whether additional behavioural , or , where appropriate , structural remedies are justified , in order to ensure that the gatekeeper cannot frustrate the objectives of this regulation by systematic non-compliance with one or several of the obligations laid down in this regulation. the commission should therefore in such cases have the power to impose any remedy , whether behavioural or structural , having due regard to the principle of proportionality. structural remedies , such as legal , functional or structural separation , including the divestiture of a business , or parts of it , should only be imposed either where there is no equally effective behavioural remedy or where any equally effective behavioural remedy would be more burdensome for the undertaking concerned than the structural remedy. changes to the structure of an undertaking as it existed before the systematic non-compliance was established would only be proportionate where there is a substantial risk that this systematic non-compliance results from the very structure of the undertaking concerned.


### (67) where , in the course of a proceeding into non-compliance or an investigation into systemic non-compliance , a gatekeeper offers commitments to the commission , the latter should be able to adopt a decision making these commitments binding on the gatekeeper concerned , where it finds that the commitments ensure effective compliance with the obligations of this regulation. this decision should also find that there are no longer grounds for action by the commission. ### (67) where , in the course of a proceeding into non-compliance or an investigation into systemic non-compliance , a gatekeeper offers commitments to the commission , the latter should be able to adopt a decision making these commitments binding on the gatekeeper concerned , where it finds that the commitments ensure effective compliance with the obligations of this regulation. the commission should , where appropriate , be entitled to require the commitments to be tested , including a/b tested in order to optimise their effectiveness. the commitments should be reviewed after they have been in place for an appropriate period. should the review of the commitments by the commission show that they have not led to effective compliance , the commission shall be entitled to require their amendment or revoke them;


### (70) the commission should be able to directly request that undertakings or association of undertakings provide any relevant evidence , data and information. in addition , the commission should be able to request any relevant information from any public authority , body or agency within the member state , or from any natural person or legal person for the purpose of this regulation. when complying with a decision of the commission , undertakings are obliged to answer factual questions and to provide documents. ### (70) the commission should be able to directly request that undertakings or association of undertakings provide any relevant evidence , data and information. in addition , the commission should be able to request any relevant information from any public authority , body or agency within the member state , or from any natural person or legal person for the purpose of this regulation. those public authorities , bodies or agencies within member states should have the possibility , on their own initiative , to provide the commission with relevant information. when complying with a decision of the commission , undertakings are obliged to answer factual questions and to provide documents.


### (16) in order to ensure the effective application of this regulation to providers of core platform services which are most likely to satisfy these objective requirements , and where unfair conduct weakening contestability is most prevalent and impactful , the commission should be able to directly designate as gatekeepers those providers of core platform services which meet certain quantitative thresholds. such undertakings should in any event be subject to a fast designation process which should start upon the entry into force of this regulation. ### (16) in order to ensure the effective application of this regulation to providers of core platform services which are most likely to satisfy these objective requirements , and where unfair conduct weakening contestability is most prevalent and impactful , the commission should be able to directly designate as gatekeepers those providers of core platform services which meet certain quantitative thresholds. such providers of core platform services should in any event be subject to a fast designation process which should start upon the entry into force of this regulation.


### (63) following a market investigation , an undertaking providing a core platform service could be found to fulfil all of the overarching qualitative criteria for being identified as a gatekeeper. it should then , in principle , comply with all of the relevant obligations laid down by this regulation. however , for gatekeepers that have been designated by the commission as likely to enjoy an entrenched and durable position in the near future , the commission should only impose those obligations that are necessary and appropriate to prevent that the gatekeeper concerned achieves an entrenched and durable position in its operations. with respect to such emerging gatekeepers , the commission should take into account that this status is in principle of a temporary nature , and it should therefore be decided at a given moment whether such a provider of core platform services should be subjected to the full set of gatekeeper obligations because it has acquired an entrenched and durable position , or conditions for designation are ultimately not met and therefore all previously imposed obligations should be waived. ### (63) following a market investigation , a provider of a core platform service could be found to fulfil all of the overarching qualitative criteria for being identified as a gatekeeper. it should then , in principle , comply with all of the relevant obligations laid down by this regulation. however , for gatekeepers that have been designated by the commission as likely to enjoy an entrenched and durable position in the near future , the commission should only impose those obligations that are necessary and appropriate to prevent that the gatekeeper concerned achieves an entrenched and durable position in its operations. with respect to such emerging gatekeepers , the commission should take into account that this status is in principle of a temporary nature , and it should therefore be decided at a given moment whether such a provider of core platform services should be subjected to the full set of gatekeeper obligations because it has acquired an entrenched and durable position , or conditions for designation are ultimately not met and therefore all previously imposed obligations should be waived.


### 2. the evaluations shall establish whether additional rules , including regarding the list of core platform services laid down in point 2 of article 2 , the obligations laid down in articles 5 and 6 and their enforcement , may be required to ensure that digital markets across the union are contestable and fair. following the evaluations , the commission shall take appropriate measures , which may include legislative proposals. ### 2. the evaluations shall establish whether inclusion of additional rules or deletion of the existing ones , including regarding the list of core platform services laid down in point 2 of article 2 , the obligations laid down in articles 5 and 6 and their enforcement , may be required to ensure that digital markets across the union are contestable and fair. following the evaluations , the commission shall take appropriate measures , which may include legislative proposals.


### cloud computing services; ### cloud computing services , including enterprise software , applications , and solution services;


### 4. the commission shall , without undue delay and at the latest 60 days after receiving the complete information referred to in paragraph 3 , designate the provider of core platform services that meets all the thresholds of paragraph 2 as a gatekeeper , unless that provider , with its notification , presents sufficiently substantiated arguments to demonstrate that , in the circumstances in which the relevant core platform service operates , and taking into account the elements listed in paragraph 6 , the provider does not satisfy the requirements of paragraph 1. ### 4. the commission shall , without undue delay and at the latest 60 working days after receiving the complete information referred to in paragraph 3 , designate the provider of core platform services that meets all the thresholds of paragraph 2 as a gatekeeper , unless that provider , with its notification , presents sufficiently substantiated arguments to demonstrate that , in the circumstances in which the relevant core platform service operates , and taking into account the elements listed in paragraph 6 , the provider exceptionally does not satisfy the requirements of paragraph 1 although it meets all the thresholds in paragraph 2.


### (35) the obligations laid down in this regulation are necessary to address identified public policy concerns , there being no alternative and less restrictive measures that would effectively achieve the same result , having regard to need to safeguard public order , protect privacy and fight fraudulent and deceptive commercial practices. ### (35) the obligations laid down in this regulation are necessary to address identified public policy concerns , there being no alternative and less restrictive measures that would effectively achieve the same result , having regard to the need to safeguard public order , protect privacy and fight fraudulent and deceptive commercial practices.


### (6) ‘online search engine’ means a digital service as defined in point 5 of article 2 of regulation (eu) 2019/1150; ### (6) ‘online search engine’ means a digital service as defined in point 5 of article 2 of regulation (eu) 2019/1150 , thus excluding the search functions on other online intermediation services;


### (12) sector-specific legislation and instruments can contribute to ensuring high levels of cybersecurity , while taking full account of the specificities and complexities of those sectors. where a sector–specific union legal act requires essential or important entities to adopt cybersecurity risk management measures or to notify incidents or significant cyber threats of at least an equivalent effect to the obligations laid down in this directive , those sector-specific provisions , including on supervision and enforcement , should apply. the commission may issue guidelines in relation to the implementation of the lex specialis. this directive does not preclude the adoption of additional sector-specific union acts addressing cybersecurity risk management measures and incident notifications. this directive is without prejudice to the existing implementing powers that have been conferred to the commission in a number of sectors , including transport and energy. ### (12) sector-specific legislation and instruments can contribute to ensuring high levels of cybersecurity , while taking full account of the specificities and complexities of those sectors. where a sector–specific union legal act requires essential or important entities to adopt cybersecurity risk management measures or to notify incidents or significant cyber threats of at least an equivalent effect to the obligations laid down in this directive , those sector-specific provisions , including on supervision and enforcement , should apply. in order to avoid overregulation , legal uncertainty and unnecessary administrative burden , in the interpretation and application of this directive the commission should ensure coherence between this directive and the applicable sector-specific legislation. to this end , the commission should identify duplications/overlapping in the respective legislation , regulatory requirements or procedures , with a view to remove them. in that regard , the commission action should specifically aim at preventing the proliferation/overlapping/duplication of systems of notification in sectors where eu sector-specific legislation is already applied , such as the transport sector. the commission may issue guidelines in relation to the implementation of the lex specialis. this directive does not preclude the adoption of additional sector-specific union acts addressing cybersecurity risk management measures and incident notifications. this directive is without prejudice to the existing implementing powers that have been conferred to the commission in a number of sectors , including transport and energy.


### (12) sector-specific legislation and instruments can contribute to ensuring high levels of cybersecurity , while taking full account of the specificities and complexities of those sectors. where a sector–specific union legal act requires essential or important entities to adopt cybersecurity risk management measures or to notify incidents or significant cyber threats of at least an equivalent effect to the obligations laid down in this directive , those sector-specific provisions , including on supervision and enforcement , should apply. the commission may issue guidelines in relation to the implementation of the lex specialis. this directive does not preclude the adoption of additional sector-specific union acts addressing cybersecurity risk management measures and incident notifications. this directive is without prejudice to the existing implementing powers that have been conferred to the commission in a number of sectors , including transport and energy. ### (12) sector-specific legislation and instruments can contribute to ensuring high levels of cybersecurity , while taking full account of the specificities and complexities of those sectors. where a sector–specific union legal act requires essential or important entities to adopt cybersecurity risk management measures or to notify incidents or significant cyber threats of at least an equivalent effect to the obligations laid down in this directive , those sector-specific provisions , including on supervision and enforcement , should apply. the commission should issue guidelines in relation to the implementation of the lex specialis , taking relevant opinions , expertise and best practices of enisa and the cooperation group into account. this directive does not preclude the adoption of additional sector-specific union acts addressing cybersecurity risk management measures and incident notifications. this directive is without prejudice to the existing implementing powers that have been conferred to the commission in a number of sectors , including transport and energy.


### (15) upholding and preserving a reliable , resilient and secure domain name system (dns) is a key factor in maintaining the integrity of the internet and is essential for its continuous and stable operation , on which the digital economy and society depend. therefore , this directive should apply to all providers of dns services along the dns resolution chain , including operators of root name servers , top-level-domain (tld) name servers , authoritative name servers for domain names and recursive resolvers. ### (15) upholding and preserving a reliable , resilient and secure domain name system (dns) is a key factor in maintaining the integrity of the internet and is essential for its continuous and stable operation , on which the digital economy and society depend. therefore , this directive should apply to publicly available recursive domain name resolution services and authoritative domain name resolution services. this directive does not apply to root name servers.


### (30) access to correct and timely information on vulnerabilities affecting ict products and services contributes to an enhanced cybersecurity risk management. in that regard , sources of publicly available information on vulnerabilities are an important tool for entities and their users , but also national competent authorities and csirts. for this reason , enisa should establish a vulnerability registry where , essential and important entities and their suppliers , as well as entities which do not fall in the scope of application of this directive may , on a voluntary basis , disclose vulnerabilities and provide the vulnerability information that allows users to take appropriate mitigating measures. ### (30) access to correct and timely information on vulnerabilities affecting ict products and services contributes to an enhanced cybersecurity risk management. in that regard , sources of publicly available information on vulnerabilities are an important tool for entities and their users , but also national competent authorities and csirts. for this reason , enisa should establish a vulnerability database where , essential and important entities and their suppliers , as well as entities which do not fall in the scope of application of this directive may , on a voluntary basis , disclose vulnerabilities and provide the vulnerability information that allows users to take appropriate mitigating measures.


### (46) to further address key supply chain risks and assist entities operating in sectors covered by this directive to appropriately manage supply chain and supplier related cybersecurity risks , the cooperation group involving relevant national authorities , in cooperation with the commission and enisa , should carry out coordinated sectoral supply chain risk assessments , as was already done for 5g networks following recommendation (eu) 2019/534 on cybersecurity of 5g networks21 , with the aim of identifying per sector which are the critical ict services , systems or products , relevant threats and vulnerabilities. ### (46) to further address key supply chain risks and assist entities operating in sectors covered by this directive to appropriately manage supply chain and supplier related cybersecurity risks , the cooperation group involving relevant national authorities , in cooperation with the commission , enisa and the european defense agency should carry out coordinated sectoral supply chain risk assessments , as was already done for 5g networks following recommendation (eu) 2019/534 on cybersecurity of 5g networks21 , with the aim of identifying per sector which are the critical ict services , systems or products , relevant threats and vulnerabilities and proposing adequate remedies.


### (47) the supply chain risk assessments , in light of the features of the sector concerned , should take into account both technical and , where relevant , non-technical factors including those defined in recommendation (eu) 2019/534 , in the eu wide coordinated risk assessment of 5g networks security and in the eu toolbox on 5g cybersecurity agreed by the cooperation group. to identify the supply chains that should be subject to a coordinated risk assessment , the following criteria should be taken into account: (i) the extent to which essential and important entities use and rely on specific critical ict services , systems or products; (ii) the relevance of specific critical ict services , systems or products for performing critical or sensitive functions , including the processing of personal data; (iii) the availability of alternative ict services , systems or products; (iv) the resilience of the overall supply chain of ict services , systems or products against disruptive events and (v) for emerging ict services , systems or products , their potential future significance for the entities’ activities. ### (47) the supply chain risk assessments , in light of the features of the sector concerned , should take into account both technical and , where relevant , non-technical factors including those defined in recommendation (eu) 2019/534 , in the eu wide coordinated risk assessment of 5g networks security and in the eu toolbox on 5g cybersecurity agreed by the cooperation group. to identify the supply chains that should be subject to a coordinated risk assessment , the following criteria should be taken into account: (i) the extent to which essential and important entities use and rely on specific critical ict services , systems or products; (ii) the relevance of specific critical ict services , systems or products for performing critical or sensitive functions , including the processing of personal data; (iii) the availability of alternative ict services , systems or products; (iv) the resilience of the overall supply chain of ict services , systems or products against disruptive events (iva) the extent to which specific critical ict services , systems or products directly used by consumers are resilient and compliant with a customer friendly approach; and (v) for emerging ict services , systems or products , their potential future significance for the entities’ activities.


### (47) the supply chain risk assessments , in light of the features of the sector concerned , should take into account both technical and , where relevant , non-technical factors including those defined in recommendation (eu) 2019/534 , in the eu wide coordinated risk assessment of 5g networks security and in the eu toolbox on 5g cybersecurity agreed by the cooperation group. to identify the supply chains that should be subject to a coordinated risk assessment , the following criteria should be taken into account: (i) the extent to which essential and important entities use and rely on specific critical ict services , systems or products; (ii) the relevance of specific critical ict services , systems or products for performing critical or sensitive functions , including the processing of personal data; (iii) the availability of alternative ict services , systems or products; (iv) the resilience of the overall supply chain of ict services , systems or products against disruptive events and (v) for emerging ict services , systems or products , their potential future significance for the entities’ activities. ### (47) the supply chain risk assessments , in light of the features of the sector concerned , should take into account both technical and , where relevant , non-technical factors including those defined in recommendation (eu) 2019/534 , in the eu wide coordinated risk assessment of 5g networks security and in the eu toolbox on 5g cybersecurity agreed by the cooperation group.


### (68) entities should be encouraged to collectively leverage their individual knowledge and practical experience at strategic , tactical and operational levels with a view to enhance their capabilities to adequately assess , monitor , defend against , and respond to , cyber threats. it is thus necessary to enable the emergence at union level of mechanisms for voluntary information sharing arrangements. to this end , member states should actively support and encourage also relevant entities not covered by the scope of this directive to participate in such information-sharing mechanisms. those mechanisms should be conducted in full compliance with the competition rules of the union as well as the data protection union law rules. ### (68) entities should be encouraged to collectively leverage their individual knowledge and practical experience at strategic , tactical and operational levels with a view to enhance their capabilities to adequately assess , monitor , defend against , and respond to , cyber threats. it is thus necessary to enable the emergence at union level of mechanisms for voluntary information sharing arrangements. to this end , member states should actively support and encourage also relevant entities not covered by the scope of this directive to participate in such information-sharing mechanisms. those mechanisms should be conducted in full compliance with the competition rules of the union as well as the data protection union law rules. to the same end , member states should support competent authorities and csirts to establish free-of-charge or accessible cybersecurity assistance , education , and audit programs for entities that fall outside the scope of this directive , in particular start-ups , smes and non-governmental organisations.


### 1. this directive applies to public and private entities of a type referred to as essential entities in annex i and as important entities in annex ii. this directive does not apply to entities that qualify as micro and small enterprises within the meaning of commission recommendation 2003/361/ec.28 ### 1. this directive applies to public and private entities of a type referred to as essential entities in annex i and as important entities in annex ii that provide their services or carry out their activities within the union. this directive does not apply to entities that qualify as micro and small enterprises within the meaning of commission recommendation 2003/361/ec.28


### a governance framework to achieve those objectives and priorities , including the policies referred to in paragraph 2 and the roles and responsibilities of public bodies and entities as well as other relevant actors; ### a governance framework to achieve those objectives and priorities , including the policies referred to in paragraph 2;


### a policy addressing cybersecurity in the supply chain for ict products and services used by essential and important entities for the provision of their services; ### a policy addressing cybersecurity in the supply chain for ict products and services used by essential and important entities for the provision of their services , based on a comprehensive assessment of potential threats to supply chains;


### a policy on promoting and developing cybersecurity skills , awareness raising and research and development initiatives; ### a policy on promoting and developing cyber hygiene and cybersecurity skills , awareness raising and research and development initiatives;


### a policy on supporting academic and research institutions to develop cybersecurity tools and secure network infrastructure; ### a policy on supporting academic and research institutions in cybersecurity research and in the development of cybersecurity tools and secure network infrastructure;


### a policy addressing specific needs of smes , in particular those excluded from the scope of this directive , in relation to guidance and support in improving their resilience to cybersecurity threats. ### a policy addressing specific needs of start-ups , smes , and non-governmental organizations , in particular those excluded from the scope of this directive , in relation to guidance and support in improving their resilience to cybersecurity threats , responding to cybersecurity incidents , and seeking cybersecurity assistance;


### coordinated vulnerability disclosure and a european vulnerability registry ### coordinated vulnerability disclosure and a european vulnerability database


### 2. enisa shall develop and maintain a european vulnerability registry. to that end , enisa shall establish and maintain the appropriate information systems , policies and procedures with a view in particular to enabling important and essential entities and their suppliers of network and information systems to disclose and register vulnerabilities present in ict products or ict services , as well as to provide access to the information on vulnerabilities contained in the registry to all interested parties. the registry shall , in particular , include information describing the vulnerability , the affected ict product or ict services and the severity of the vulnerability in terms of the circumstances under which it may be exploited , the availability of related patches and , in the absence of available patches , guidance addressed to users of vulnerable products and services as to how the risks resulting from disclosed vulnerabilities may be mitigated. ### 2. enisa shall develop and maintain a european vulnerability database. to that end , enisa shall establish and maintain the appropriate information systems , policies and procedures as well as the appropriate disclosure policies with a view in particular to enabling important and essential entities and their suppliers of network and information systems to disclose and easily register vulnerabilities present in ict products or ict services , as well as to provide access to the relevant information on vulnerabilities contained in the registry to all interested parties , provided that such actions do not undermine the protection of confidentiality and trade secrets. the vulnerability database shall , in particular , include information describing the vulnerability , the affected ict product or ict services and the severity of the vulnerability in terms of the circumstances under which it may be exploited , the availability of related patches and , in the absence of available patches , guidance addressed to users of vulnerable products and services as to how the risks resulting from disclosed vulnerabilities may be mitigated.


### 2. enisa shall develop and maintain a european vulnerability registry. to that end , enisa shall establish and maintain the appropriate information systems , policies and procedures with a view in particular to enabling important and essential entities and their suppliers of network and information systems to disclose and register vulnerabilities present in ict products or ict services , as well as to provide access to the information on vulnerabilities contained in the registry to all interested parties. the registry shall , in particular , include information describing the vulnerability , the affected ict product or ict services and the severity of the vulnerability in terms of the circumstances under which it may be exploited , the availability of related patches and , in the absence of available patches , guidance addressed to users of vulnerable products and services as to how the risks resulting from disclosed vulnerabilities may be mitigated. ### 2. enisa shall develop and maintain a european vulnerability registry. to that end , enisa shall establish and maintain the appropriate information systems , policies and procedures with a view in particular to enabling important and essential entities and their suppliers of network and information systems to disclose and register vulnerabilities present in ict products or ict services , as well as to provide access to the information on vulnerabilities contained in the registry to all interested parties. in accordance with article 10 (2) , csirts should facilitate access to information on vulnerabilities registered in the european vulnerability registry , alongside risk mitigation assistance , to entities that do not fall under the scope of this directive , in particular start-ups , smes , and non-governmental organizations. the registry shall , in particular , include information describing the vulnerability , the affected ict product or ict services and the severity of the vulnerability in terms of the circumstances under which it may be exploited , the availability of related patches and , in the absence of available patches , guidance addressed to users of vulnerable products and services as to how the risks resulting from disclosed vulnerabilities may be mitigated.


### 4. to the extent necessary to effectively carry out the tasks and obligations laid down in this directive , member states shall ensure appropriate cooperation between the competent authorities and single points of contact and law enforcement authorities , data protection authorities , and the authorities responsible for critical infrastructure pursuant to directive (eu) xxxx/xxxx [resilience of critical entities directive] and the national financial authorities designated in accordance with regulation (eu) xxxx/xxxx of the european parliament and of the council39 [the dora regulation] within that member state. ### 4. to the extent necessary to effectively carry out the tasks and obligations laid down in this directive , member states shall ensure appropriate cooperation between the competent authorities and single points of contact and law enforcement authorities , data protection authorities , national supervisory authorities for artificial intelligence , national competent authorities for data governance , and the authorities responsible for critical infrastructure pursuant to directive (eu) xxxx/xxxx [resilience of critical entities directive] and the national financial authorities designated in accordance with regulation (eu) xxxx/xxxx of the european parliament and of the council39 [the dora regulation] within that member state.


### increasing the level of preparedness of the management of large scale incidents and crises; ### increasing the level of preparedness of the management of large scale incidents and crises and liaising with member state institutions in charge of state security and territorial defence;


### supply chain security including security-related aspects concerning the relationships between each entity and its suppliers or service providers such as providers of data storage and processing services or managed security services; ### measures for supply chain security risk assessment including on security-related aspects concerning the relationships between each entity and its suppliers or service providers such as providers of data storage and processing services or managed security services;


### supply chain security including security-related aspects concerning the relationships between each entity and its suppliers or service providers such as providers of data storage and processing services or managed security services; ### supply chain security including security-related aspects concerning the relationships between each entity and its suppliers or service providers;


### policies and procedures (testing and auditing) to assess the effectiveness of cybersecurity risk management measures; ### policies and procedures (testing and auditing) and regular cybersecurity exercises to assess the effectiveness of cybersecurity risk management measures;


### 3. member states shall ensure that , where considering appropriate measures referred to in point (d) of paragraph 2 , entities shall take into account the vulnerabilities specific to each supplier and service provider and the overall quality of products and cybersecurity practices of their suppliers and service providers , including their secure development procedures. ### 3. member states shall ensure that , where considering appropriate measures referred to in point (d) of paragraph 2 , entities shall take into account the vulnerabilities specific to each supplier and service provider and the overall quality of products and cybersecurity practices of their suppliers and service providers , including their secure development procedures in accordance to union cybersecurity standards and laws and potential non-technical risk factors , such as concealed vulnerabilities or backdoors and potential systemic supply disruptions.


### 6. the commission is empowered to adopt delegated acts in accordance with article 36 to supplement the elements laid down in paragraph 2 to take account of new cyber threats , technological developments or sectorial specificities. ### 6. the commission , in cooperation with the cooperation group and enisa , shall provide guidance and best practices on the compliance by entities in a proportionate manner with the requirements , laid down in paragraph 2 , and in particular to the requirement in point (d) of that paragraph.


### 1. the cooperation group , in cooperation with the commission and enisa , may carry out coordinated security risk assessments of specific critical ict services , systems or products supply chains , taking into account technical and , where relevant , non-technical risk factors. ### 1. the cooperation group , in cooperation with the commission , enisa and the european defence agency , may carry out coordinated security risk assessments of specific critical ict services , systems or products supply chains , taking into account technical and , where relevant , non-technical risk factors.


### 2. the commission , after consulting with the cooperation group and enisa , shall identify the specific critical ict services , systems or products that may be subject to the coordinated risk assessment referred to in paragraph 1. ### 2. the commission , after consulting with the cooperation group , enisa and the european defence agency , shall identify the specific critical ict services , systems or products that may be subject to the coordinated risk assessment referred to in paragraph 1.


### 1. member states shall ensure that essential and important entities notify , without undue delay , the competent authorities or the csirt in accordance with paragraphs 3 and 4 of any incident having a significant impact on the provision of their services. where appropriate , those entities shall notify , without undue delay , the recipients of their services of incidents that are likely to adversely affect the provision of that service. member states shall ensure that those entities report , among others , any information enabling the competent authorities or the csirt to determine any cross-border impact of the incident. ### 1. member states shall ensure that essential and important entities notify , without undue delay , the competent authorities or the csirt in accordance with paragraphs 3 and 4 of any incident having a significant impact on the provision of their services. where appropriate , those entities shall notify , without undue delay , the recipients of their services of incidents that are likely to adversely affect the provision of that service. member states shall ensure that those entities report , among others , any information enabling the competent authorities or the csirt to determine any cross-border impact of the incident.


### 1. member states shall ensure that essential and important entities notify , without undue delay , the competent authorities or the csirt in accordance with paragraphs 3 and 4 of any incident having a significant impact on the provision of their services. where appropriate , those entities shall notify , without undue delay , the recipients of their services of incidents that are likely to adversely affect the provision of that service. member states shall ensure that those entities report , among others , any information enabling the competent authorities or the csirt to determine any cross-border impact of the incident. ### 1. member states shall ensure that essential and important entities notify , without undue delay , the competent authorities or the csirt in accordance with paragraphs 3 and 4 of any incident having a significant impact. where appropriate , those entities shall notify , without undue delay , the recipients of their services of incidents that are likely to adversely affect the provision of that service. member states shall ensure that those entities report , among others , any information enabling the competent authorities or the csirt to determine any cross-border impact of the incident. where the competent authorities or the csirt consider that it is necessary , essential and important entities may notify other essential and important entities of any significant incident occurring in their sector.


### 1. in order to demonstrate compliance with certain requirements of article 18 , member states may require essential and important entities to certify certain ict products , ict services and ict processes under specific european cybersecurity certification schemes adopted pursuant to article 49 of regulation (eu) 2019/881. the products , services and processes subject to certification may be developed by an essential or important entity or procured from third parties. ### 1. in order to demonstrate compliance with certain requirements of article 18 , member states after having consulted the cooperation group , with the aim of ensuring harmonisation at union level , shall encourage essential and important entities to certify certain ict products , ict services and ict processes , either developed by the essential or important entity or procured from third parties , under european cybersecurity schemes adopted pursuant to article 49 of regulation (eu) 2019/881 or under similar internationally recognised certification schemes.


### 1. in order to demonstrate compliance with certain requirements of article 18 , member states may require essential and important entities to certify certain ict products , ict services and ict processes under specific european cybersecurity certification schemes adopted pursuant to article 49 of regulation (eu) 2019/881. the products , services and processes subject to certification may be developed by an essential or important entity or procured from third parties. ### 1. in order to demonstrate compliance with certain requirements of article 18 , member states shall encourage essential and important entities to certify certain ict products , ict services and ict processes , either developed by the essential or important entity or procured from third parties , under specific european cybersecurity certification schemes adopted pursuant to article 49 of regulation (eu) 2019/881 or under similar internationally recognised certification schemes.


### 1. in order to demonstrate compliance with certain requirements of article 18 , member states may require essential and important entities to certify certain ict products , ict services and ict processes under specific european cybersecurity certification schemes adopted pursuant to article 49 of regulation (eu) 2019/881. the products , services and processes subject to certification may be developed by an essential or important entity or procured from third parties. ### 1. in order to demonstrate compliance with certain requirements of article 18 , member states may require essential and important entities to use certain certified ict products , ict services and ict processes , whether procured from third parties or developed by the essential or important entity , certified under specific european cybersecurity certification schemes adopted pursuant to article 49 of regulation (eu) 2019/881 , or , in the absence of such a scheme , under equivalent internationally recognised certification schemes.


### 2. the commission shall be empowered to adopt delegated acts specifying which categories of essential entities shall be required to obtain a certificate and under which specific european cybersecurity certification schemes pursuant to paragraph 1. the delegated acts shall be adopted in accordance with article 36. ### 2. the commission shall regularly assess the efficiency and use of the adopted european cybersecurity certification schemes under article 49 of regulation (eu) 2019/881 and shall identify which categories of essential entities shall be encouraged to obtain a certificate and under which specific european cybersecurity certification schemes pursuant to paragraph 1.


### 2. the commission shall be empowered to adopt delegated acts specifying which categories of essential entities shall be required to obtain a certificate and under which specific european cybersecurity certification schemes pursuant to paragraph 1. the delegated acts shall be adopted in accordance with article 36. ### deleted


### databases of domain names and registration data ### databases infrastructure of domain names and registration data


### 1. for the purpose of contributing to the security , stability and resilience of the dns , member states shall ensure that tld registries and the entities providing domain name registration services for the tld shall collect and maintain accurate and complete domain name registration data in a dedicated database facility with due diligence subject to union data protection law as regards data which are personal data. ### 1. for the purpose of contributing to the security , stability and resilience of the dns , member states shall ensure that tld registries and entities providing domain name registration services are required to collect and maintain accurate , verified and complete domain name registration data in a database facility with due diligence subject to union data protection law as regards data which are personal data.


### 2. member states shall ensure that the databases of domain name registration data referred to in paragraph 1 contain relevant information to identify and contact the holders of the domain names and the points of contact administering the domain names under the tlds. ### 2. member states shall ensure that the database infrastructure of domain name registration data referred to in paragraph 1 contains relevant information , which shall include at least the registrants’ name , their physical and email address as well as their telephone number , to identify and contact the holders of the domain names and the points of contact administering the domain names under the tlds.


### 3. member states shall ensure that the tld registries and the entities providing domain name registration services for the tld have policies and procedures in place to ensure that the databases include accurate and complete information. member states shall ensure that such policies and procedures are made publicly available. ### 3. member states shall ensure that tld registries and entities providing domain name registration services have policies and procedures in place to ensure that the database infrastructure includes accurate , verified and complete information. member states shall ensure that such policies and procedures are made publicly available.


### 4. member states shall ensure that the tld registries and the entities providing domain name registration services for the tld publish , without undue delay after the registration of a domain name , domain registration data which are not personal data. ### 4. member states shall ensure that the tld registries and the entities providing domain name registration services make publicly available , without undue delay and in any event within 24 hours after the registration of a domain name , all domain registration data of legal persons as registrants.


### 5. member states shall ensure that the tld registries and the entities providing domain name registration services for the tld provide access to specific domain name registration data upon lawful and duly justified requests of legitimate access seekers , in compliance with union data protection law. member states shall ensure that the tld registries and the entities providing domain name registration services for the tld reply without undue delay to all requests for access. member states shall ensure that policies and procedures to disclose such data are made publicly available. ### 5. member states shall ensure that tld registries and entities providing domain name registration services are required toprovide access to specific domain name registration data. including personal data , upon duly justified requests of legitimate access seekers , in compliance with union data protection law. member states shall ensure that tld registries and entities providing domain name registration services reply without undue delay and in any event within 72 hours to all requests for access. member states shall ensure that policies and procedures to disclose such data are made publicly available.


### 3. member states shall set out rules specifying the procedure , operational elements (including the use of dedicated ict platforms) , content and conditions of the information sharing arrangements referred to in paragraph 2. such rules shall also lay down the details of the involvement of public authorities in such arrangements , as well as operational elements , including the use of dedicated it platforms. member states shall offer support to the application of such arrangements in accordance with their policies referred to in article 5(2) (g). ### 3. member states shall set out guidelines specifying the procedure , operational elements (including the use of dedicated ict platforms) , content and conditions of the information sharing arrangements referred to in paragraph 2. such guidelines shall also include the details of the involvement , where relevant , of public authorities and independent experts in such arrangements , as well as operational elements , including the use of dedicated it platforms. member states shall offer support to the application of such arrangements in accordance with their policies referred to in article 5(2) (g).


### targeted security audits based on risk assessments or risk-related available information; ### targeted security audits based on risk assessments or risk-related available information , including on risks related to supply chains as defined in article 18 (3);


### 3. where exercising their powers under points (e) to (g) of paragraph 2 , the competent authorities shall state the purpose of the request and specify the information requested. ### 3. where exercising their powers under points (e) to (g) of paragraph 2 , the competent authorities shall state the purpose of the request , specify the information requested and shall limit their requests to the scope of the incident or issue of concern.


### 3. where exercising their powers pursuant to points (d) or (e) of paragraph 2 , the competent authorities shall state the purpose of the request and specify the information requested. ### 3. where exercising their powers pursuant to points (d) or (e) of paragraph 2 , the competent authorities shall state the purpose of the request , specify the information requested and shall limit their requests to the scope of the incident or issue of concern.


### 4. member states shall ensure that infringements of the obligations laid down in article 18 or article 20 shall , in accordance with paragraphs 2 and 3 of this article , be subject to administrative fines of a maximum of at least 10 000 000 eur or up to 2% of the total worldwide annual turnover of the undertaking to which the essential or important entity belongs in the preceding financial year , whichever is higher. ### 4. member states shall ensure that infringements of the obligations laid down in article 18 or article 20 shall , in accordance with paragraphs 2 and 3 of this article , be subject to administrative fines of a maximum of 10 000 000 eur or up to 2% of the total worldwide annual turnover of the undertaking to which the essential or important entity belongs in the preceding financial year , whichever is higher.


### (3) network and information systems have developed into a central feature of everyday life with the speedy digital transformation and interconnectedness of society , including in cross-border exchanges. that development has led to an expansion of the cybersecurity threat landscape , bringing about new challenges , which require adapted , coordinated and innovative responses in all member states. the number , magnitude , sophistication , frequency and impact of cybersecurity incidents are increasing , and present a major threat to the functioning of network and information systems. as a result , cyber incidents can impede the pursuit of economic activities in the internal market , generate financial losses , undermine user confidence and cause major damage to the union economy and society. cybersecurity preparedness and effectiveness are therefore now more essential than ever to the proper functioning of the internal market. ### (3) network and information systems have developed into a central feature of everyday life with the speedy digital transformation and interconnectedness of society , including in cross-border exchanges. that development has led to an expansion of the cybersecurity threat landscape , bringing about new challenges , which require adapted , coordinated and innovative responses in all member states. the number , magnitude , sophistication , frequency and impact of cybersecurity incidents are increasing , and present a major threat to the functioning of network and information systems. as a result , cyber incidents can impede the pursuit of economic activities in the internal market , generate financial losses , undermine user confidence and cause major damage to the union economy and society. cybersecurity preparedness and effectiveness are therefore now more essential than ever to the proper functioning of the internal market. moreover , cybersecurity is a key enabler for many critical sectors , such as transport , to successfully embrace the digital transformation and to fully grasp the economic , social and sustainable benefits of digitalisation.


### (17) given the emergence of innovative technologies and new business models , new cloud computing deployment and service models are expected to appear on the market in response to evolving customer needs. in that context , cloud computing services may be delivered in a highly distributed form , even closer to where data are being generated or collected , thus moving from the traditional model to a highly distributed one (‘edge computing’). ### (17) given the emergence of innovative technologies , such as artificial intelligence , and new business models , new cloud computing deployment and service models are expected to appear on the market in response to evolving customer needs. in that context , cloud computing services may be delivered in a highly distributed form , even closer to where data are being generated or collected , thus moving from the traditional model to a highly distributed one (‘edge computing’).


### (33) when developing guidance documents , the cooperation group should consistently: map national solutions and experiences , assess the impact of cooperation group deliverables on national approaches , discuss implementation challenges and formulate specific recommendations to be addressed through better implementation of existing rules. ### (33) when developing guidance documents , the cooperation group should consistently: map national solutions and experiences , assess the impact of cooperation group deliverables on national approaches , discuss implementation challenges and formulate specific recommendations to be addressed through better implementation of existing rules. the cooperation group should also map the national solutions in order to promote compatibility of cybersecurity solutions applied to each specific sector across europe. this is particular relevant for the sectors which have an international and cross-border nature such as transport.


### 6. where provisions of sector–specific acts of union law require essential or important entities either to adopt cybersecurity risk management measures or to notify incidents or significant cyber threats , and where those requirements are at least equivalent in effect to the obligations laid down in this directive , the relevant provisions of this directive , including the provision on supervision and enforcement laid down in chapter vi , shall not apply. ### 6. where provisions of sector–specific acts of union law require essential or important entities either to adopt cybersecurity risk management measures or to notify incidents or significant cyber threats , and where those requirements are at least equivalent in effect to the obligations laid down in this directive , the relevant provisions of this directive , including the provision on supervision and enforcement laid down in chapter vi , shall not apply. the commission shall issue guidelines in relation to the implementation of the sector–specific acts of union law in order to ensure that security requirements established by this directive are met by those acts. when preparing those guidelines , the commission shall take into account enisa and the cooperation group best practices and expertise.


### public administration entities of central governments ### public administration entities of central governments


### (26) given the importance of international cooperation on cybersecurity , csirts should be able to participate in international cooperation networks in addition to the csirts network established by this directive. ### (26) given the importance of international cooperation on cybersecurity , csirts should be able to participate in international cooperation networks , including with csirts outside the union , in addition to the csirts network established by this directive.