NIS2 for the Manufacturing Sector — Manufacturing in Annex II: six subsectors and the NACE divisions, word for word

In this lesson

Quote the six subsectors of Annex II, point 5, and their types of entity, word for word.
Read NACE Rev. 2 divisions 26 to 30 as Regulation (EC) No 1893/2006 sets them out, down to their classes.
Separate the device manufacturers of Annex II, point 5(a), from those of Annex I, point 5.
Say what the directive leaves open when manufacturing is not an undertaking's main activity, and record your position.

Where manufacturing sits

NIS2 lists sectors of high criticality in Annex I and other critical sectors in Annex II. Manufacturing is point 5 of Annex II, the only sector of that annex divided into subsectors, (a) to (f).

Article 2(1) applies the directive to “public or private entities of a type referred to in Annex I or II”, subject to the size rule of lesson m1l2. The test is the type of entity as the annex writes it, not a trade association membership. Article 3(4)(c) asks each entity for “where applicable, the relevant sector and subsector referred to in Annex I or II”: the subsector letter is part of a manufacturer's registration.

The six subsectors, word for word

Subsector	Type of entity
(a) “Manufacture of medical devices and in vitro diagnostic medical devices”	“Entities manufacturing medical devices as defined in Article 2, point (1), of Regulation (EU) 2017/745 of the European Parliament and of the Council”, “and entities manufacturing in vitro diagnostic medical devices as defined in Article 2, point (2), of Regulation (EU) 2017/746 of the European Parliament and of the Council”, “with the exception of entities manufacturing medical devices referred to in Annex I, point 5, fifth indent, of this Directive”
(b) “Manufacture of computer, electronic and optical products”	“Undertakings carrying out any of the economic activities referred to in section C division 26 of NACE Rev. 2”
(c) “Manufacture of electrical equipment”	“Undertakings carrying out any of the economic activities referred to in section C division 27 of NACE Rev. 2”
(d) “Manufacture of machinery and equipment n.e.c.”	“Undertakings carrying out any of the economic activities referred to in section C division 28 of NACE Rev. 2”
(e) “Manufacture of motor vehicles, trailers and semi-trailers”	“Undertakings carrying out any of the economic activities referred to in section C division 29 of NACE Rev. 2”
(f) “Manufacture of other transport equipment”	“Undertakings carrying out any of the economic activities referred to in section C division 30 of NACE Rev. 2”

Two techniques sit side by side: (a) borrows product definitions and speaks of entities manufacturing; (b) to (f) borrow a statistical classification and speak of undertakings carrying out activities.

Subsector (a): devices, and the split with Annex I

A medical device is what article 2(1) of Regulation (EU) 2017/745 (the MDR) says it is: “any instrument, apparatus, appliance, software, implant, reagent, material or other article intended by the manufacturer to be used, alone or in combination, for human beings for one or more of the following specific medical purposes”. An in vitro diagnostic medical device is, under article 2(2) of Regulation (EU) 2017/746 (the IVDR), “any medical device which is a reagent, reagent product, calibrator, control material, kit, instrument, apparatus, piece of equipment, software or system, whether used alone or in combination, intended by the manufacturer to be used in vitro for the examination of specimens” derived from the human body, for the purposes it lists. Scope in 5(a) follows these definitions, not NACE, and software is in both: a company writing medical device software can be a 5(a) entity without a factory.

The exception sends one group elsewhere. Annex I, point 5, fifth indent, lists “Entities manufacturing medical devices considered to be critical during a public health emergency (public health emergency critical devices list) within the meaning of Article 22 of Regulation (EU) 2022/123 of the European Parliament and of the Council”. Those manufacturers are Annex I health entities, with a different class rule (lesson m1l2); their scoping, and what the MDR and IVDR require of device manufacturers on information security, are taught in the certification NIS2 for the Health Sector and not repeated here. Note only that the exception names medical devices, not in vitro diagnostic medical devices: an IVD maker should check whether its product is on the list and how Regulation (EU) 2022/123, outside this course's sources, describes the devices it covers; NIS2 alone does not settle it.

Subsectors (b) to (f): the NACE divisions

Reg. 1893/2006, art. 2, Annex I

NACE Rev. 2 is established by Regulation (EC) No 1893/2006. Article 2(1) gives it four levels: sections identified by a letter, divisions by two digits, groups by three and classes by four. Section C is manufacturing. The annex to NIS2 names five of its divisions; Annex I to the Regulation fills them in:

Division	Heading	What its groups cover
26	Manufacture of computer, electronic and optical products	Electronic components and boards; computers and peripheral equipment; communication equipment; consumer electronics; instruments and appliances for measuring, testing and navigation, watches and clocks; irradiation, electromedical and electrotherapeutic equipment; optical instruments and photographic equipment; magnetic and optical media
27	Manufacture of electrical equipment	Electric motors, generators, transformers and electricity distribution and control apparatus; batteries and accumulators; wiring and wiring devices, including fibre optic cables; electric lighting equipment; domestic appliances; other electrical equipment
28	Manufacture of machinery and equipment n.e.c.	General-purpose machinery, such as engines and turbines other than aircraft, vehicle and cycle engines, pumps, compressors, valves and bearings; other general-purpose machinery, such as furnaces, lifting and handling equipment and power-driven hand tools; agricultural and forestry machinery; metal forming machinery and machine tools; other special-purpose machinery, such as for metallurgy, mining and construction, food, textiles, paper, plastics and rubber
29	Manufacture of motor vehicles, trailers and semi-trailers	Motor vehicles; bodies (coachwork) for motor vehicles, and trailers and semi-trailers; parts and accessories for motor vehicles, including electrical and electronic equipment
30	Manufacture of other transport equipment	Ships and floating structures, pleasure and sporting boats; railway locomotives and rolling stock; air and spacecraft and related machinery; military fighting vehicles; motorcycles, bicycles and invalid carriages, and transport equipment n.e.c.

The annex to the Regulation has no explanatory notes. Its only legend explains two marks: “n.e.c. : not elsewhere classified”, and an asterisk on an ISIC Rev. 4 code meaning part of. Four readings follow from the class headings themselves:

A division is wider than its heading. Division 27 includes class 27.52, “Manufacture of non-electric domestic appliances”.
Component suppliers are reached. Division 29 includes class 29.31, “Manufacture of electrical and electronic equipment for motor vehicles”, and 29.32 for other parts and accessories. A maker of electronic control units for vehicle makers, classed under 29.31, is a 5(e) undertaking in its own right.
Defence is inside. Division 30 includes class 30.40, “Manufacture of military fighting vehicles”. Article 2(8) is in lesson m1l2.
Neighbours are outside. Division 25 (fabricated metal products, including weapons and ammunition), division 32 (including medical and dental instruments), division 33 “Repair and installation of machinery and equipment” and class 62.01 “Computer programming activities” are not named; a device maker in division 32 is still caught by 5(a).

Activities, not companies: what NACE does not decide

Reg. 1893/2006, art. 1(2), 5, 8

NACE classifies activities. Article 1(2) of the Regulation adds: “This Regulation shall apply only to the use of the classification for statistical purposes.” NIS2 borrows the classification for a legal purpose, not the statistical machinery around it.

The Regulation contains no rule assigning an undertaking to one class. Article 8(1) has statistical units in business registers classified according to NACE Rev. 2, and article 5 has the Commission, with the member states, publish explanatory notes and guidelines for classifying statistical units, documents outside this course's sources. Where the Regulation counts enterprises, it uses their main activity: in the structural statistics it amends, “Enterprise statistics refer to the population of all enterprises whose main activity is classified in Sections B, C, D or E.”

NIS2 does not say main activity. Subsectors (b) to (f) reach undertakings “carrying out any of the economic activities” of a division. Where the legislator wanted a principal-activity filter, it wrote one: Annex II, point 2, on waste management, is “excluding undertakings for whom waste management is not their principal economic activity”. Point 5 has no such words. Recital 21 acknowledges that an entity “may simultaneously carry out activities, some of which fall within and some of which are excluded from the scope of this Directive” and says the Commission could provide guidance; it does not decide the case.

So the position of an undertaking whose division 26 to 30 activity is secondary is open. A literal reading takes in any undertaking carrying out the activity; a statistical reading looks at its main activity. The directive does not choose; national law or guidance may. Treat a registered activity code as evidence, not as the test, check your country page on the transposition tracker, and record the reading you apply. A brand owner whose production is all done by contract manufacturers raises a similar question, also left open.

One note per legal entity

NIS2 applies to entities, natural or legal persons under article 6(38): a group's plants, sales and service companies can each sit in a different row, or in none. A company maintaining customers' control systems remotely should also test that service against the definition of managed service provider in article 6(39), an Annex I type.

In practice

Fictional case. Arvalo Group operates in one member state; its compliance lead drafts one dated scoping note per legal entity.

Arvalo Drives, 900 staff, makes electric motors. On the class heading 27.11, “Manufacture of electric motors, generators and transformers”: subsector (c).
Arvalo Therapy, 120 staff, places electrotherapy units on the market as medical devices under the MDR: subsector (a). On the group heading for irradiation, electromedical and electrotherapeutic equipment, its activity also falls in division 26, so the note records (b) as well. The critical devices list was checked on the date of the note: the units are not on it.
Arvalo Field Services, 300 staff, installs and repairs machinery (division 33) and maintains customers' control systems remotely. Not a manufacturing type; the note tests the remote service against article 6(39).

A second fictional company, Northway Logistics, a road haulier with 2,000 staff, builds semi-trailers for its own fleet in a workshop and sells a few. Its note quotes 5(e) and recital 21, records both readings, applies the literal one pending national guidance, and sets a review date.

What a supervisor will ask

Which subsector do you rely on, entity by entity, and why? The scoping notes, quoting the annex and the NACE class heading or the device definition.
For a device maker: is any product on the critical devices list? A dated check.
For a secondary manufacturing activity: which reading did you apply? The written reasoning and the national guidance consulted.
Does your registration match? The information submitted under article 3(4), subsector letters included.

Key points

Manufacturing is Annex II, point 5, with six subsectors: (a) devices by MDR and IVDR definition, (b) to (f) NACE Rev. 2 divisions 26 to 30.
Makers of devices on the public health emergency critical devices list are Annex I health entities, not 5(a).
Divisions are read down to their classes: non-electric domestic appliances, vehicle parts and military fighting vehicles are inside; repair, installation and software development are not.
NIS2 borrows NACE but has no principal-activity filter for manufacturing: a secondary activity is an open question, recorded per legal entity in a dated note.