Your sector in the annex: the space row, word for word

In this lesson

• Quote Annex I, point 11, word for word and split it into the five elements a scoping note must test.
• Apply the Union space programme boundary that recital 37 draws, and the exclusion of providers of public electronic communications networks.
• Recognise who is not in this row, and the other routes that may still bring them into NIS2.
• List the questions the wording leaves open, and record them as open instead of answering them by assumption.

Where space sits

Annex I, point 11

NIS2 has two annexes of sectors: Annex I, headed sectors of high criticality, and Annex II, other critical sectors. Space is point 11, the last row of Annex I. It has no subsector and a single type of entity. When article 3(4)(c) asks entities to give “where applicable, the relevant sector and subsector referred to in Annex I or II”, the sector is the whole answer.

Article 2(1) applies the directive to “public or private entities of a type referred to in Annex I or II”, subject to the size rule of lesson m1l2. Owning a satellite, selling satellite data or having space in a company name decides nothing.

The row, word for word

Annex I, point 11, lists one type of entity, in this wording:

“Operators of ground-based infrastructure, owned, managed and operated by Member States or by private parties, that support the provision of space-based services, excluding providers of public electronic communications networks”

A row such as transport defines each type of entity by reference to another Union act. This row cites no other act, and article 6 defines none of its terms except one: “public electronic communications network”, which article 6(36) takes from Article 2, point (8), of Directive (EU) 2018/1972, the European Electronic Communications Code (EECC). Operator, ground-based infrastructure and space-based services keep their ordinary meaning, so your scoping note carries the reasoning a definition would otherwise do.

Five elements to test

1. Operators

The type of entity is the operator; the phrase that follows (owned, managed and operated) describes the infrastructure. Where one company owns a site and another runs it under contract, the wording points to the one that operates. Whether an owner that manages without operating is an operator, the text does not say. Record who owns, manages and operates each site, with the contract that allocates the roles.

2. Ground-based infrastructure

The scope trigger is infrastructure on the ground, as opposed to the spacecraft. The directive gives no list. Candidates to examine, site by site, include antennas and ground stations that send commands to spacecraft or receive their telemetry and data, control centres from which spacecraft are operated, and facilities that process or distribute data received from space. Treat these as a reading to test, not as text.

The boundary concerns what triggers scope, not what the obligations cover. Once an entity is in scope, article 21(1) asks it to manage the risks to the network and information systems “which those entities use for their operations or for the provision of their services”. Lesson m3l1 draws the consequences for systems that are not on the ground.

3. Owned, managed and operated by Member States or by private parties

Recital 37

Recital 37 explains what the phrase leaves out. It lists space among the sectors of growing interdependence “in so far as the provision of certain services depending on ground-based infrastructures that are owned, managed and operated either by Member States or by private parties is concerned, therefore not covering infrastructures owned, managed or operated by or on behalf of the Union as part of its space programme”.

The inclusion is cumulative (owned, managed and operated); the exclusion is alternative (owned, managed or operated) and adds “on behalf of”. As the recital reads, a private company that operates infrastructure on behalf of the Union as part of its space programme is outside the row for that infrastructure, while the same company's other infrastructure is not. Recitals explain the operative text rather than add to it, so cite the annex wording first and the recital as the reason. Recital 5 of the CER Directive (2022/2557) draws the same boundary for that directive.

Whether an activity is carried out “on behalf of the Union as part of its space programme” is answered by the contract that governs it; keep a copy with the note.

4. That support the provision of space-based services

The infrastructure need not provide the service itself; supporting its provision is enough. Space-based services are not defined. A natural reading covers services delivered from or through spacecraft, such as satellite communications, positioning and timing signals, or Earth observation data, but that list is a reading, not law. Write down, per facility, the service supported and the link between them: commands it, receives its data, distributes its output.

5. Excluding providers of public electronic communications networks

EECC art. 2(1), (8)

Under Article 2, point (8), of the EECC, a public electronic communications network is “an electronic communications network used wholly or mainly for the provision of publicly available electronic communications services which support the transfer of information between network termination points”. The EECC definition of electronic communications network in Article 2, point (1), expressly includes “satellite networks”. A satellite operator that provides a public network of that kind is excluded from point 11. It is not out of NIS2: providers of public electronic communications networks are a type of entity in Annex I, point 8, digital infrastructure, with their own size and class rules (lesson m1l2).

Two limits of the exclusion. First, it names network providers only. Providers of publicly available electronic communications services, the next type in point 8, are not named; on a literal reading, an entity that provides such a service without providing the network, and also operates qualifying ground infrastructure, stays in point 11 and is also a point 8 type. Second, running a radio link for your own operations does not make you a provider of a public network: the network must be used wholly or mainly for publicly available services.

Who is not in this row

• Satellite operators as such. Operating a spacecraft is not the test; operating ground infrastructure is. A satellite operator that runs its own control centre or ground stations is described by the row through them. One that contracts all ground operations to a third party may not be: the contractor is then the operator of the infrastructure. Whether the satellite operator still manages it, in the sense of the row, is open.
• Manufacturers. Building satellites, launchers or ground equipment is not operating infrastructure. A manufacturer may fall under Annex II, point 5, Manufacturing, whose subsectors (b) to (f) are defined by NACE Rev. 2 divisions, among them division 26 and division 30; check the product line against the classification itself.
• Downstream users. A transport, energy or finance entity that relies on positioning or timing signals uses space-based services; it does not operate infrastructure that supports their provision. It is in scope, or not, through its own sector, and its dependence on space-based services is a continuity and supply chain matter for it (art. 21(2)(c) and (d)).
• Union space programme infrastructure, as recital 37 explains.
• Providers of public electronic communications networks, which belong to Annex I, point 8.

Open questions, declared as open

The wording leaves at least these questions unanswered. Name them in the note, state the reading adopted and date it.

• Is an owner that manages but does not operate an operator?
• Does a facility that only processes or distributes archived space data support the provision of space-based services?
• Do launch facilities, which are on the ground, support the provision of space-based services in the sense of the row?
• How is infrastructure owned or operated by an international organisation treated? The annex names Member States and private parties; recital 37 excludes only the Union's space programme.
• How should an entity that is both a point 11 operator and a point 8 provider of publicly available electronic communications services register (art. 3(4)(c))?

National transposition and guidance may answer some of these. Check your member state's page through the transposition tracker before finalising the note.

What a supervisor will ask

• Which facilities make you an operator of ground-based infrastructure, and which space-based service does each support? The site-by-site scoping note.
• Who owns, manages and operates each site? The contracts that allocate those roles.
• Why is a given activity outside the row? The contract placing it on behalf of the Union space programme, or the analysis showing you provide a public electronic communications network.
• Does your registration match your analysis? The information submitted under article 3(4), consistent with the notes.

Key points

• Space is Annex I, point 11: one type of entity, no subsector, and no definition imported from another act.
• The entity in scope is the operator of ground-based infrastructure that supports the provision of space-based services.
• Recital 37 explains that infrastructure owned, managed or operated by or on behalf of the Union as part of its space programme is not covered.
• Providers of public electronic communications networks are excluded from point 11 and belong to Annex I, point 8; the exclusion does not name providers of publicly available electronic communications services.
• Satellite operators as such, manufacturers and downstream users are not described by the row, though other routes may bring them into NIS2.
• Open questions are recorded as open, with the reading adopted and a date.