Your sector in the annexes: the three digital provider types, word for word

In this lesson

• Read Annex II, point 6, exactly as the directive writes it, and say what it lists and what it leaves to article 6.
• Match each service you operate to one of the three types, using articles 6(28), 6(29) and 6(33) and the definitions they borrow from Directive 2005/29/EC and Regulation (EU) 2019/1150.
• Keep the NIS2 definitions apart from the Digital Services Act categories that use similar words.
• Build a service-line inventory that a supervisor can follow line by line.

Point 6 as the annex writes it

Annex II, point 6

Annex II of Directive (EU) 2022/2555 is headed Other critical sectors. Point 6 is headed Digital providers. It has no subsectors: the types of entity follow the sector name directly. The three entries read, word for word:

• Providers of online marketplaces
• Providers of online search engines
• Providers of social networking services platforms

Three consequences follow. First, point 6 carries no reference to another EU act inside the annex itself. The meaning of each entry lives in article 6: two definitions are borrowed from other acts, and the third is written by NIS2. Second, the list describes services, not companies. A company can run a marketplace with a social feed, or a search engine with a shopping section, and each match must be checked on its own. Third, the sector sits in Annex II, not Annex I. That placement decides the class of the entity, as the next lesson shows, and it is one of the most consequential facts about this sector.

The same three types are named together, in the same order, in five other provisions of the directive: the definition of a representative in article 6(34), the implementing powers of articles 21(5) and 23(11), the main-establishment rule of article 26(1)(b) and the ENISA registry of article 27(1). Article 21(5), and the title and article 1 of Implementing Regulation (EU) 2024/2690, spell the first type “online market places”, in two words; it is the same type of entity.

Online marketplace: a borrowed consumer-law definition

Art. 6(28)

Article 6(28) reads: “‘online marketplace’ means an online marketplace as defined in Article 2, point (n), of Directive 2005/29/EC of the European Parliament and of the Council”. Directive 2005/29/EC is the Unfair Commercial Practices Directive. As adopted in 2005, its article 2 ended at point (l). Point (n) was added by article 3(1)(b) of Directive (EU) 2019/2161, which reads:

“‘online marketplace’ means a service using software, including a website, part of a website or an application, operated by or on behalf of a trader which allows consumers to conclude distance contracts with other traders or consumers.”

Recital 25 of Directive (EU) 2019/2161 explains the wording: the definition was “updated and rendered more technologically neutral in order to cover new technologies”, which is why it refers, instead of to a website, to software, including a website, part of a website or an application. The same article of 2005/29/EC defines the two parties the test turns on. A consumer is “any natural person who, in commercial practices covered by this Directive, is acting for purposes which are outside his trade, business, craft or profession” (art. 2(a)). A trader is “any natural or legal person who, in commercial practices covered by this Directive, is acting for purposes relating to his trade, business, craft or profession and anyone acting in the name of or on behalf of a trader” (art. 2(b)).

Read the definition clause by clause and three tests appear:

• Who operates it. The service is operated by or on behalf of a trader.
• Who contracts. It allows consumers to conclude distance contracts. A platform reserved to business buyers does not meet these words.
• With whom. The consumer contracts with other traders or consumers. Consumer-to-consumer resale is covered as well as third-party sellers. A brand's own web shop, where the consumer contracts only with the operator, does not meet the words “other traders or consumers”.

Online search engine: borrowed from the P2B Regulation

Art. 6(29)

Article 6(29) points to Article 2, point (5), of Regulation (EU) 2019/1150, the platform-to-business Regulation: “a digital service that allows users to input queries in order to perform searches of, in principle, all websites, or all websites in a particular language, on the basis of a query on any subject in the form of a keyword, voice request, phrase or other input, and returns results in any format in which information related to the requested content can be found”.

The definition is wide on input and output: keyword, voice request or phrase in; results “in any format” out. It is narrow on reach. The search must cover, in principle, all websites, or all websites in a particular language, and accept a query on any subject. A search box over your own catalogue, or a tool that searches one subject, does not meet those words. NIS2 borrows point (5) only. Point (6) of the same article, which defines the provider of an online search engine by reference to consumers, is not imported.

Social networking services platform: NIS2's own words

Art. 6(33)

The third definition borrows from nobody. Article 6(33): “a platform that enables end-users to connect, share, discover and communicate with each other across multiple devices, in particular via chats, posts, videos and recommendations”.

The core is four verbs, connect, share, discover and communicate, exercised by end-users “with each other” and “across multiple devices”. Chats, posts, videos and recommendations are introduced by “in particular”: they illustrate the definition and are not a checklist. Note what the definition does not contain: no user threshold, no reference to advertising, and no exception for minor or ancillary features.

Similar words, different law

DSA, Art. 3(i)-(j)

The Digital Services Act, Regulation (EU) 2022/2065, uses close vocabulary for its own purposes, and the two classifications must be made separately.

• Online search engine. DSA article 3(j) repeats the P2B wording almost exactly, but starts with “an intermediary service” instead of “a digital service”. NIS2 imports the P2B version.
• Online platform. DSA article 3(i) defines “a hosting service that, at the request of a recipient of the service, stores and disseminates information to the public”, with an exception where that activity is “a minor and purely ancillary feature of another service”. DSA recital 13 names social networks and online platforms allowing consumers to conclude distance contracts with traders as examples. NIS2 article 6(33) has no ancillary-feature exception, so a DSA conclusion that a feature is ancillary does not settle the NIS2 question.
• Marketplaces. The DSA's additional section for marketplaces speaks of online platforms allowing consumers to conclude distance contracts with traders. The NIS2 definition, borrowed from consumer law, also covers contracts concluded with other consumers.

Module 2 shows what each regime then requires. For scoping, the rule is simple: classify against the NIS2 definitions, and keep the DSA classification in a separate column.

What sits next to point 6 without being in it

Annex I, point 8

• The infrastructure under your platform. Cloud computing, data centre, content delivery network and DNS service providers are Annex I, point 8, types. If you buy those services, your suppliers have their own status. If your group sells them, that legal entity is assessed under Annex I.
• Messaging. Recital 96 of NIS2 says it is necessary to ensure that number-independent interpersonal communications services “as defined in Directive (EU) 2018/1972”, “such as messaging services”, are also subject to appropriate security requirements. That directive is the European Electronic Communications Code, the source of the Annex I, point 8, electronic communications types. A stand-alone messaging product therefore raises an Annex I question, covered in the Digital Infrastructure certification. A chat feature inside a social network is named in article 6(33) itself.
• Search inside your own service. As shown above, site search and single-subject search do not meet the P2B wording.
• Business-to-business trading platforms do not meet the consumer test of the marketplace definition.

What a supervisor will ask

• Which point 6 types do you provide, service by service? The inventory, with the article 6 definition, or the borrowed definition, quoted for each line.
• Why is this service outside scope? The clause that fails: no consumers, no other traders or consumers, not all websites, no end-users communicating with each other.
• Which version of the borrowed text did you apply? For marketplaces, point (n) of article 2 of Directive 2005/29/EC as inserted by Directive (EU) 2019/2161.
• Did you rely on your DSA classification? The answer should be no: the NIS2 analysis stands on its own definitions.

Key points

• Annex II, point 6, lists three types of entity and no subsectors.
• Online marketplace comes from Directive 2005/29/EC, article 2(n), inserted by Directive (EU) 2019/2161; online search engine from Regulation (EU) 2019/1150, article 2(5); social networking services platform is defined by NIS2 article 6(33) itself.
• The marketplace test needs a trader operator and consumers contracting with other traders or consumers.
• The search engine test needs searches of, in principle, all websites, or all websites in a language, on any subject.
• DSA categories use similar words but are a separate classification.