NIS2 for the Health Sector — Health in the annexes: entity types, word for word

In this lesson

Quote the five types of entity in Annex I, point 5, word for word, and name the Union act each one points to.
Place a medical device or in vitro diagnostic manufacturer in Annex I or in Annex II, point 5(a), using the fifth-indent exception.
Recognise organisations that look like health entities but are not listed, and the other routes that can still bring them in.
Write a scoping note per legal entity that a supervisor can check line by line.

Where health sits

NIS2 has two annexes of sectors: Annex I, sectors of high criticality, and Annex II, other critical sectors. Health is point 5 of Annex I. Unlike energy or transport, the health row has no subsectors: it lists five types of entity directly. When article 3(4)(c) asks for “where applicable, the relevant sector and subsector referred to in Annex I or II”, the sector is the whole answer.

Article 2(1) applies the directive to “public or private entities of a type referred to in Annex I or II”. The test is the type of entity, read in the annex: not the word health in a company name, not the fact that your customers are hospitals, and not ownership.

The five types of entity, word for word

Annex I, point 5, lists the following types of entity, in this wording:

“Healthcare providers as defined in Article 3, point (g), of Directive 2011/24/EU of the European Parliament and of the Council”
“EU reference laboratories referred to in Article 15 of Regulation (EU) 2022/2371 of the European Parliament and of the Council”
“Entities carrying out research and development activities of medicinal products as defined in Article 1, point (2), of Directive 2001/83/EC of the European Parliament and of the Council”
“Entities manufacturing basic pharmaceutical products and pharmaceutical preparations referred to in section C division 21 of NACE Rev. 2”
“Entities manufacturing medical devices considered to be critical during a public health emergency (public health emergency critical devices list) within the meaning of Article 22 of Regulation (EU) 2022/123 of the European Parliament and of the Council”

Indents 1, 2, 3 and 5 import a definition or a list from another act, identified in the annex footnotes; indent 4 uses NACE Rev. 2:

Indent	Act referred to	What decides membership
1. Healthcare providers	Directive 2011/24/EU on the application of patients’ rights in cross-border healthcare	The definition in its article 3, point (g)
2. EU reference laboratories	Regulation (EU) 2022/2371 on serious cross-border threats to health	Being an EU reference laboratory referred to in its article 15
3. Research and development	Directive 2001/83/EC on the Community code relating to medicinal products for human use	Carrying out research and development of products that meet the definition of medicinal product in its article 1, point (2)
4. Pharmaceutical manufacturing	NACE Rev. 2, the classification the annexes use to identify economic activities	Manufacturing activity falling in section C, division 21
5. Critical medical devices	Regulation (EU) 2022/123 on a reinforced role for the European Medicines Agency in crisis preparedness and management for medicinal products and medical devices	Manufacturing devices on the public health emergency critical devices list within the meaning of its article 22

NIS2 adds no gloss to those definitions. Read each one in its own act and quote it in your scoping note.

Reading each indent

Healthcare providers. The indent that catches hospitals and clinics; its boundary is set by article 3(g) of Directive 2011/24/EU. Organisations at the edge of care, such as a medical laboratory or a teleradiology service, must test themselves against that definition in its own words and record the reasoning, not borrow a neighbour's conclusion.

EU reference laboratories. Narrow: only the laboratories referred to in article 15 of Regulation (EU) 2022/2371. Accreditation, or reference status at national level, is not the test. Another laboratory may still be in scope by another indent, for instance the first.

Research and development of medicinal products. The indent describes an activity applied to a defined object. It does not require the entity to own the product, so a contract research organisation should not assume it is outside the wording. Compare Annex II, point 7: article 6(41) defines a research organisation and adds that it “does not include educational institutions”. The health indent has no such exclusion, while article 2(5)(b) lets member states extend the directive to education institutions. How a university doing medicinal-product research is treated is a national point, on the transposition tracker.

Pharmaceutical manufacturing. Activity-based, through the NACE Rev. 2 division. It covers manufacturing, not the wholesale distribution of medicines.

Critical medical devices. List-based. Read literally, the indent reaches an entity that manufactures devices on the list, so one listed product line is enough. Check the list itself, with a date: a list can change while the annex does not.

Medical devices: Annex I or Annex II?

Annex II, point 5(a)

Annex II, point 5, headed Manufacturing, has a subsector (a), “Manufacture of medical devices and in vitro diagnostic medical devices”. Its type of entity reads in three parts: “Entities manufacturing medical devices as defined in Article 2, point (1), of Regulation (EU) 2017/745”, then “entities manufacturing in vitro diagnostic medical devices as defined in Article 2, point (2), of Regulation (EU) 2017/746”, and finally “with the exception of entities manufacturing medical devices referred to in Annex I, point 5, fifth indent, of this Directive”.

The split is clean. A manufacturer of devices on the public health emergency critical devices list is an Annex I health entity; every other manufacturer of medical devices or in vitro diagnostic medical devices is an Annex II entity, and the exception prevents double counting. The annex matters for the class: under article 3(1)(a), an Annex I entity above the medium-sized ceilings is essential, while an Annex II entity is important unless a specific route of article 3(1) makes it essential (lesson m1l2).

The exception speaks of medical devices only. An in vitro diagnostic manufacturer should check whether its product is on the list and how Regulation (EU) 2022/123 describes the devices it covers; NIS2 alone does not settle it.

The device definitions come from the device regulations. Article 2(1) of Regulation (EU) 2017/745 (the MDR) defines a medical device as “any instrument, apparatus, appliance, software, implant, reagent, material or other article intended by the manufacturer to be used, alone or in combination, for human beings for one or more of the following specific medical purposes”. Recital 19 of the MDR draws the software line: software intended by its manufacturer for a medical purpose is a device; software for general purposes, even when used in a healthcare setting, is not.

One point the annex leaves open: it defines the device, not the manufacturer. The MDR's article 2(30) counts as manufacturer a person who “has a device designed, manufactured or fully refurbished, and markets that device under its name or trademark”. Whether a company that outsources all production is an entity manufacturing medical devices for NIS2, the directive does not say. Document the reasoning and check national guidance.

Close to the list, but not on it

Wholesale distribution of medicinal products. The health row of the Annex to Directive (EU) 2022/2557 (CER) lists the same five types as NIS2 plus a sixth: “Entities holding a distribution authorisation as referred to in Article 79 of Directive 2001/83/EC”. NIS2 Annex I does not. Unless its activities fit another Annex type, a wholesaler enters NIS2 only through identification as a critical entity under CER, which brings it in regardless of size (article 2(3)). Article 2(2) cannot help: it applies only to entities of a type referred to in Annex I or II.
Health software and IT suppliers. Selling to hospitals does not make a supplier a health entity. It may be in Annex I in its own right, as a cloud computing service provider (point 8) or a managed service provider (point 9), or a device manufacturer if its software is a medical device.
Publicly owned hospitals. A public hospital that fits the first indent is in Annex I as a healthcare provider. Whether it is also a public administration entity depends on the cumulative criteria of article 6(35) and on recognition under national law, not on ownership alone.

One note per legal entity

NIS2 applies to entities, and article 3(4) collects information entity by entity. A health group's hospital, laboratory, manufacturing and distribution companies can each sit in a different row, or in none. Write one dated scoping note per legal entity, quoting the indent, the defining act and the facts relied on. Size and class follow, also per entity, with group figures added where the SME Recommendation requires it.

In practice

A fictional group, Halvard Care Group, operates in one member state through five legal entities. Its compliance lead drafts the scoping notes.

Halvard General Hospital, 2,100 staff, treats inpatients and outpatients. First indent: healthcare provider.
Halvard Laboratory Services, 180 staff, runs tests for the hospital and for general practitioners. It is not an EU reference laboratory. Whether it is a healthcare provider turns on article 3(g) of Directive 2011/24/EU; the note records the legal opinion obtained.
Halvard Pharma, 420 staff, manufactures sterile injectable preparations. Fourth indent: manufacture of pharmaceutical preparations in NACE Rev. 2 division 21.
Halvard Devices, 260 staff, manufactures infusion pumps. The team checks the critical devices list on the date of the note: the pumps are not on it. The entity is an Annex II, point 5(a) manufacturer, with a review date set.
Halvard Distribution, 90 staff, holds a wholesale distribution authorisation. Not an NIS2 Annex type; the note flags the CER route.

Five entities, three annex positions, one open question, each with its source. Lesson m1l2 adds size and class.

What a supervisor will ask

Which indent do you rely on, entity by entity, and which act defines it? The scoping notes, quoting the annex and the defining provision.
For a device manufacturer: is any of your products on the critical devices list, and when did you last check? A dated check against the list.
For an entity you concluded is out of scope: why? The written analysis, for example against article 3(g) of Directive 2011/24/EU.
Does your registration match your analysis? The information submitted under article 3(4), consistent with the notes.

Key points

Health is Annex I, point 5: five types of entity and no subsectors.
Indents 1, 2, 3 and 5 import their definition from another act (Directive 2011/24/EU, Regulation (EU) 2022/2371, Directive 2001/83/EC, Regulation (EU) 2022/123); indent 4 uses NACE Rev. 2 division 21.
Makers of devices on the public health emergency critical devices list are Annex I; all other medical device and in vitro diagnostic manufacturers are Annex II, point 5(a).
Wholesale distributors of medicines are in the CER health row but not in NIS2 Annex I; unless they fit another Annex type, they enter NIS2 only through identification as a CER critical entity (art. 2(3)).
Scope is decided per legal entity, in a dated note that quotes the annex.