CHAPTER IX FINAL PROVISIONS

Article 40

By 17 October 2027 and every 36 months thereafter, the Commission shall review the functioning of this Directive, and report to the European Parliament and to the Council. The report shall in particular assess the relevance of the size of the entities concerned, and the sectors, subsectors and types of entity referred to in Annexes I and II for the functioning of the economy and society in relation to cybersecurity. To that end and with a view to further advancing the strategic and operational cooperation, the Commission shall take into account the reports of the Cooperation Group and the CSIRTs network on the experience gained at a strategic and operational level. The report shall be accompanied, where necessary, by a legislative proposal.

Article 42

In Regulation (EU) No 910/2014, Article 19 is deleted with effect from 18 October 2024.

Article 43

In Directive (EU) 2018/1972, Articles 40 and 41 are deleted with effect from 18 October 2024.

Article 44

Directive (EU) 2016/1148 is repealed with effect from 18 October 2024.

References to the repealed Directive shall be construed as references to this Directive and shall be read in accordance with the correlation table set out in Annex III.

Article 45

This Directive shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

Article 46

This Directive is addressed to the Member States.