Your sector in the annexes: the nine entity types, word for word

In this lesson

• Read Annex I, point 8, exactly as the directive writes it, and say what it lists and what it leaves out.
• Match each service line you operate to one of the nine entity types, using the definitions of article 6 and the eIDAS and Electronic Communications Code definitions that article 6 borrows.
• Recognise the services that sit next to point 8 without being in it: domain name registration, root name servers, own-use TLDs, in-house data centres and closed-system trust services.
• Build a service-line scoping inventory that a supervisor can follow line by line.

Point 8 as the annex writes it

Annex I, point 8

Annex I of Directive (EU) 2022/2555 lists the sectors of high criticality. Point 8 is headed Digital infrastructure. Unlike energy or transport, it has no subsectors: the types of entity follow the sector name directly. The nine entries read, word for word:

• Internet Exchange Point providers
• DNS service providers, excluding operators of root name servers
• TLD name registries
• Cloud computing service providers
• Data centre service providers
• Content delivery network providers
• Trust service providers
• Providers of public electronic communications networks
• Providers of publicly available electronic communications services

Two consequences follow. First, unlike the energy, transport, banking, health and water rows, point 8 carries no reference to another EU act inside the annex itself. The meaning of each entry lives in article 6, which writes six of the definitions itself and borrows the other three from Regulation (EU) No 910/2014 (eIDAS) and Directive (EU) 2018/1972 (the European Electronic Communications Code, or EECC). Second, the list describes services, not companies. A hosting group can be a data centre service provider, a cloud computing service provider and a DNS service provider at the same time, and each match carries consequences of its own, as the next lesson shows.

The six definitions NIS2 writes itself

Art. 6(18)-(21), (30)-(32)

• Internet exchange point, Art. 6(18): “a network facility which enables the interconnection of more than two independent networks (autonomous systems), primarily for the purpose of facilitating the exchange of internet traffic, which provides interconnection only for autonomous systems and which neither requires the internet traffic passing between any pair of participating autonomous systems to pass through any third autonomous system nor alters or otherwise interferes with such traffic”. Every clause matters: a private interconnect between two networks is not an IXP, and neither is a facility that routes traffic through its own autonomous system.
• DNS service provider, Art. 6(20): an entity that provides “publicly available recursive domain name resolution services for internet end-users” or “authoritative domain name resolution services for third-party use, with the exception of root name servers”. Recital 32 repeats that the directive “should not apply to root name servers.” A resolver that serves only your own staff is not publicly available; authoritative service that hosts only your own domains is not for third-party use.
• TLD name registry, Art. 6(21): an entity that has been delegated a specific TLD and administers it, including registrations and the technical operation of the TLD, “irrespective of whether any of those operations are carried out by the entity itself or are outsourced, but excluding situations where TLD names are used by a registry only for its own use”. Outsourcing the back-end does not move the registry out of scope; a brand TLD used only by its holder is out.
• Cloud computing service, Art. 6(30): a digital service enabling on-demand administration and broad remote access to a scalable and elastic pool of shareable computing resources. Recital 33 names IaaS, PaaS, SaaS and NaaS among the service models and private, community, public and hybrid among the deployment models; recital 34 adds that services may be delivered in a highly distributed form, at the edge.
• Data centre service, Art. 6(31): structures dedicated to the centralised accommodation, interconnection and operation of IT and network equipment, together with the facilities for power distribution and environmental control. Recital 35 covers data centre services that are not cloud services, and excludes “in-house corporate data centres owned and operated by the entity concerned, for its own purposes.”
• Content delivery network, Art. 6(32): “a network of geographically distributed servers for the purpose of ensuring high availability, accessibility or fast delivery of digital content and services to internet users on behalf of content and service providers”.

The three definitions NIS2 borrows

Art. 6(24)-(27), (36)-(37)

Trust service providers. Article 6(25) points to Article 3, point (19), of eIDAS: “a natural or a legal person who provides one or more trust services either as a qualified or as a non-qualified trust service provider”. The Annex covers both kinds; the difference matters for class, not for scope. Article 6(24) defines the trust service itself by pointing to Article 3, point (16), of eIDAS. Regulation (EU) 2024/1183 replaced that point: the current text lists fourteen services, from the issuance and validation of certificates and the creation and validation of electronic signatures and seals, through electronic timestamps and electronic registered delivery, to the issuance of electronic attestations of attributes, electronic archiving and the recording of electronic data in an electronic ledger. Recital 11 of NIS2 keeps one exclusion from eIDAS: trust services “used exclusively within closed systems resulting from national law or from agreements between a defined set of participants” are not covered.

Public electronic communications networks. Article 6(36) points to Article 2, point (8), of the EECC: “an electronic communications network used wholly or mainly for the provision of publicly available electronic communications services which support the transfer of information between network termination points”. The underlying network definition in Article 2, point (1), is technology-neutral: satellite, fixed and mobile networks, cable television networks and electricity cable systems used for transmitting signals all qualify.

Publicly available electronic communications services. Article 6(37) defines the electronic communications service by pointing to Article 2, point (4), of the EECC; the annex entry adds that the service must be publicly available. Article 2, point (4), covers internet access services, interpersonal communications services, and services consisting wholly or mainly in the conveyance of signals, such as transmission for machine-to-machine services and broadcasting. Services providing, or exercising editorial control over, content are excluded. Interpersonal communications services include number-independent ones (EECC, Art. 2(7)); recital 96 of NIS2 notes that “number-independent interpersonal communications services, such as messaging services, are becoming widespread attack vectors”. The EECC definition of interpersonal communications services (Art. 2(5)) excludes services which enable interpersonal communication “merely as a minor ancillary feature that is intrinsically linked to another service”; a public messaging service whose purpose is communication is not in that position, and can fall under point 8 however its provider describes it.

What sits next to point 8 without being in it

Art. 2(4); Art. 6(22)

Several neighbouring activities are excluded, or are handled elsewhere in the directive:

• Root name servers are excluded from the DNS entry, in the annex and in article 6(20).
• Own-use TLDs fall outside the TLD registry definition.
• In-house corporate data centres are excluded by recital 35.
• Closed-system trust services are excluded by recital 11.
• Domain name registration services are not an Annex I type at all. Article 6(22) defines the entity providing them as “a registrar or an agent acting on behalf of registrars, such as a privacy or proxy registration service provider or reseller”, and article 2(4) brings it into the directive by a separate route, covered in the next lesson.
• Managed service and managed security service providers are Annex I, point 9, a sector of their own; online marketplaces, search engines and social networking platforms are in Annex II, point 6.
• Space ground infrastructure, Annex I, point 11, expressly excludes providers of public electronic communications networks, so a satellite operator that provides a public electronic communications network is assessed under point 8, not point 11.

One service line at a time

The method that survives a supervisor's questions is mechanical. List every service you sell or operate for others. For each, quote the definition it matches, or the clause that excludes it. Keep the reasoning for borderline cases: a peering LAN with two members, a resolver offered only inside your corporate network, a white-label cloud platform you operate on someone else's hardware. Two features of this sector matter here. Services stack: a CDN can run on cloud capacity hosted in third-party data centres, and each layer is a separate provider with its own status. And one company can carry several types, which matters for jurisdiction, for the ENISA registry and for incident criteria, all covered later in the course.

Recital 115 gives an example of how the same function can change character: a publicly available recursive DNS service provided by an electronic communications provider “only as a part of the internet access service” follows that provider's jurisdiction rule. The function is DNS; the legal treatment follows the service it is part of.

What a supervisor will ask

• Which point 8 types do you provide, service by service? The inventory, with the article 6 definition quoted for each line.
• Why is this service outside scope? The excluding clause: own-use TLD, root server, in-house data centre, closed system, not publicly available.
• Which version of the borrowed definitions did you apply? For trust services, the current text of eIDAS Article 3, point (16), as replaced by Regulation (EU) 2024/1183.
• When was the inventory last reviewed? A dated review after every new service launch.

Key points

• Annex I, point 8, lists nine types of entity and no subsectors.
• Article 6 defines IXPs, DNS service providers, TLD name registries, cloud, data centre and CDN services itself; trust services come from eIDAS and electronic communications from the EECC.
• Root name servers, own-use TLDs, in-house data centres and closed-system trust services are excluded.
• Domain name registration services are not an Annex I type; article 2(4) brings them in separately.
• Scope is decided service line by service line, and one company can carry several types.