Research in the annexes: the type of entity and its definition, word for word
You are reading a free preview
149 € excl. VAT — all 9 lessons, the assessment and a verifiable certificate.
In this lesson
- Quote the Annex II, point 7 row and the article 6(41) definition of research organisation word for word.
- Test an organisation against each element of that definition, strictly as worded, and record what the text leaves open.
- Separate research organisations from educational institutions, and explain what article 2(5)(b) lets member states do about education institutions.
- Recognise when a research organisation is also of a type listed in Annex I, which changes its position.
Where research sits
NIS2 lists the sectors it covers in two annexes: Annex I, the sectors of high criticality, and Annex II, the other critical sectors. Research is the seventh and last point of Annex II, and its row is the shortest in either annex. The sector column reads “Research”. The subsector column is empty: there are no subsectors. The type of entity column reads “Research organisations”.
Several rows of the annexes define their types by reference to another Union act, identified in a footnote. The research row has no footnote: the definition sits inside NIS2, in article 6(41). When article 3(4)(c) asks entities to submit “where applicable, the relevant sector and subsector referred to in Annex I or II”, the sector is the whole answer for a research organisation.
Article 2(1) applies the directive to “public or private entities of a type referred to in Annex I or II”, subject to the size rule covered in lesson m1l2. Two consequences follow. Ownership does not decide anything at this stage: a publicly funded institute and a private company are tested in the same way. And the test is the type of entity as defined, not the word research in a name, a funding programme or a job title.
The definition, word for word
Article 6(41) reads: “‘research organisation’ means an entity which has as its primary goal to conduct applied research or experimental development with a view to exploiting the results of that research for commercial purposes, but which does not include educational institutions.”
The sentence contains five elements. Each must be met, and each should appear in your scoping note with the evidence for it:
| Element | Words of article 6(41) | What the words require | What the text leaves open |
|---|---|---|---|
| Who | “an entity” | A natural or legal person, as defined in article 6(38) | How a research unit inside a larger entity bears on that entity’s primary goal |
| Goal | “which has as its primary goal” | Research is the primary goal, not necessarily the only one | Any threshold: no share of staff, budget or income is set |
| Activity | “to conduct applied research or experimental development” | One of two named activities | Their meaning, which recital 36 takes from the OECD Frascati Manual 2015 |
| Purpose | “with a view to exploiting the results of that research for commercial purposes” | Research done with commercial exploitation in view | Who must exploit, and how much exploitation is enough |
| Exclusion | “but which does not include educational institutions” | An educational institution is never a research organisation | What an educational institution is: article 6 does not define it |
Reading each element
An entity. Article 6(38) defines entity as “a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations”. A laboratory, a department or an institute without legal personality is not an entity. The test runs on the legal person that contains it. A group with a research company and a manufacturing company tests each company separately.
Primary goal. The article says primary, not sole. Recital 36 uses different words: research organisations “should be understood to include entities which focus the essential part of their activities on the conduct of applied research or experimental development”. The article binds; the recital helps to read it. Together they point to evidence of two kinds: what the entity is set up to do (statutes, articles of association, mission) and what it actually spends the essential part of its activity on (staff time, budget, income by activity). Neither text gives a percentage. An organisation with mixed missions, research alongside consulting, testing or public service tasks, cannot settle its position by formula. Record the evidence and the reasoning.
Applied research or experimental development. The definition names these two activities and no others. Recital 36 says they are meant “within the meaning of the Organisation for Economic Cooperation and Development’s Frascati Manual 2015: Guidelines for Collecting and Reporting Data on Research and Experimental Development”. This course does not reproduce the Manual: read its definitions there and cite them in your note. An entity whose primary goal is a kind of research the definition does not name is not a research organisation as worded.
Commercial exploitation. “With a view to” describes the purpose for which the research is done. The definition does not require exploitation to have succeeded. Recital 36 gives examples of exploiting results “for commercial purposes, such as the manufacturing or development of a product or process, the provision of a service, or the marketing thereof”. Contract research sold to companies, the licensing of results and product development fit those examples. Two situations remain open. First, a publicly funded institute that publishes all its results openly and exploits none of them commercially does not meet the purpose element as worded; whether national guidance takes another view is a national point. Second, the text does not say whether exploitation by someone other than the organisation, a funder or a partner, is enough.
Educational institutions. The exclusion is categorical: the definition “does not include educational institutions”, whatever their research activity. But article 6 does not define educational institution. A university that teaches and does research is, on the ordinary meaning of the words, an educational institution, and so is not a research organisation under point 7. Read literally, the exclusion concerns the entity being tested: a separately incorporated company owned by a university, such as a spin-off, is not an educational institution for that reason alone. If its own primary goal fits, it can be a research organisation. National guidance may draw these lines more precisely; check it on the transposition tracker.
Why research is in the directive
Recital 36 gives the reason in three sentences: “Research activities play a key role in the development of new products and processes. Many of those activities are carried out by entities that share, disseminate or exploit the results of their research for commercial purposes. Those entities can therefore be important players in value chains, which makes the security of their network and information systems an integral part of the overall cybersecurity of the internal market.” The rationale is the value chain: a research organisation is in scope because others build on what it produces.
Education institutions: a member state option
Article 2(5) reads: “Member States may provide for this Directive to apply to”, then, at point (b), “education institutions, in particular where they carry out critical research activities.” Three things follow from the words.
- May means may. The directive neither requires a member state to bring education institutions in nor forbids it. Whether a member state used the option, for which institutions and with what obligations, is a national fact. It is on the country pages under /nis2/, reached through the transposition tracker, and not in this course.
- The wording differs. Article 2(5)(b) says education institutions; article 6(41) says educational institutions. Quote each as written.
- The class is not set by NIS2. Article 3 classifies entities of a type referred to in Annex I or II, and article 6(41) excludes educational institutions from the only research type. An education institution brought in under article 2(5)(b) therefore has no class under article 3 itself; national law decides how it is treated.
No recital of NIS2 explains this option: neither education nor educational appears in any recital. In the articles, the word education appears otherwise only in article 7(2)(f), on the policies of national cybersecurity strategies, and educational only in article 6(41).
Neighbouring types that change the answer
Nothing in NIS2 makes the types of entity mutually exclusive. Test every row that could fit, and record each result.
- Medicinal products. Annex I, point 5 (health) lists “Entities carrying out research and development activities of medicinal products as defined in Article 1, point (2), of Directive 2001/83/EC of the European Parliament and of the Council”. That indent has no educational exclusion and no commercial-purpose condition. A research organisation working on medicinal products may also be an Annex I entity, which matters for its class (lesson m1l2).
- Digital infrastructure. A research organisation that provides computing or hosting to others should test itself against the Annex I, point 8 types, such as cloud computing service providers and data centre service providers. Recital 35 adds that the term data centre service “should not apply to in-house corporate data centres owned and operated by the entity concerned, for its own purposes”.
What a supervisor will ask
- Why are you, or why are you not, a research organisation? The scoping note, element by element, quoting article 6(41).
- What shows your primary goal? Statutes, mission and the split of staff time and income by activity, dated.
- How are your results exploited commercially? Contract research, licences or products, with the evidence.
- Have you checked the other rows? The test against Annex I, points 5 and 8, recorded even when negative.
Key points
- Research is Annex II, point 7: one type of entity, research organisations, and no subsectors.
- Article 6(41) has five elements: an entity, a primary goal, applied research or experimental development, a view to commercial exploitation, and the exclusion of educational institutions.
- The text sets no threshold for primary goal and does not define educational institution; record the evidence and check national guidance.
- Article 2(5)(b) lets member states extend the directive to education institutions; it does not require them to, and NIS2 does not set their class.
- A research organisation can also be an Annex I entity, notably for research and development of medicinal products.