NIS2 for the Transport Sector — Transport in the annexes: subsectors and entity types, word for word

In this lesson

Quote the ten transport entity types of Annex I, point 2, and name the Union act that defines each one.
Read the qualifiers that widen or narrow each entry: commercial purposes, airports and ancillary installations, operators of service facilities, port facilities and works within ports, individual vessels, and road authorities whose traffic management is not essential to them.
Recognise transport-related organisations that NIS2 lists elsewhere or not at all, including the public transport operators that appear in the CER annex but not in NIS2.
Build a scope register entry for each legal entity of a transport group.

Transport is an Annex I sector

NIS2 places transport in Annex I, the sectors of high criticality, as point 2. The sector has four subsectors: (a) Air, (b) Rail, (c) Water and (d) Road. Across them the annex lists ten types of entity. Being in Annex I rather than Annex II matters for the class of the entity, which lesson m1l2 works out.

Almost every entry borrows its definition from another Union act: a regulation on aviation security, a directive on airport charges, the directive establishing the single European railway area, the regulation on ship and port facility security, and so on. NIS2 gives the reference; the definition itself sits in the act referred to, which this course does not reproduce. A scope analysis therefore starts from the definition in the referenced act, not from the way the organisation describes itself. The quotations below are the annex text; the footnote reference numbers are omitted.

Air: carriers, airports and air traffic control

Annex I, point 2(a)

Air carriers

The first entry reads: “Air carriers as defined in Article 3, point (4), of Regulation (EC) No 300/2008 used for commercial purposes”. Regulation (EC) No 300/2008 lays down common rules in the field of civil aviation security. Two filters apply: the carrier must meet that regulation's definition, and it must be used for commercial purposes. An aircraft operator flying only for its own non-commercial needs is outside this entry, whatever its size.

Airports and what is inside them

The second entry is the widest in the subsector: “Airport managing bodies as defined in Article 2, point (2), of Directive 2009/12/EC of the European Parliament and of the Council, airports as defined in Article 2, point (1), of that Directive, including the core airports listed in Section 2 of Annex II to Regulation (EU) No 1315/2013 of the European Parliament and of the Council, and entities operating ancillary installations contained within airports”.

Directive 2009/12/EC is the airport charges directive; Regulation (EU) No 1315/2013 sets the guidelines for the trans-European transport network. The entry therefore reaches three groups: the managing body, the airport itself, and entities operating ancillary installations contained within airports. NIS2 does not define ancillary installations. A company that operates an installation inside the airport perimeter may be an Annex I entity on its own account, not merely a supplier of the managing body.

Air traffic control

The third entry: “Traffic management control operators providing air traffic control (ATC) services as defined in Article 2, point (1), of Regulation (EC) No 549/2004 of the European Parliament and of the Council”. Regulation (EC) No 549/2004 is the framework regulation of the single European sky. The entry names air traffic control services, not every air navigation or air traffic management service. Lesson m2l1 shows that the aviation Part-IS rules reach a wider set of air traffic management and air navigation service providers: being bound by Part-IS does not by itself place an organisation in NIS2, and the reverse is also true.

Rail: infrastructure and undertakings

Annex I, point 2(b)

Two entries, both defined by Directive 2012/34/EU establishing a single European railway area:

“Infrastructure managers as defined in Article 3, point (2), of Directive 2012/34/EU of the European Parliament and of the Council”;
“Railway undertakings as defined in Article 3, point (1), of Directive 2012/34/EU, including operators of service facilities as defined in Article 3, point (12), of that Directive”.

The entries do not distinguish passenger from freight services: whether an operator is a railway undertaking depends on the definition in the railway directive, not on what it carries. The words “including operators of service facilities” extend the second entry to the operators of the facilities defined in article 3, point (12), of the railway directive. Check that definition before concluding that a terminal, depot or station operator is outside NIS2.

Water: companies, ports and vessel traffic services

Annex I, point 2(c)

Water transport companies, not their vessels

The first entry: “Inland, sea and coastal passenger and freight water transport companies, as defined for maritime transport in Annex I to Regulation (EC) No 725/2004 of the European Parliament and of the Council, not including the individual vessels operated by those companies”. Regulation (EC) No 725/2004 concerns enhancing ship and port facility security. The entry covers inland navigation as well as sea and coastal transport, passengers as well as freight. The closing words matter: the company is the entity, and the individual vessels it operates are not entities in their own right. The annex does not say whether the company's article 21 measures reach systems on board; settle that position against your national transposition and record it.

Ports, their facilities and what operates inside them

The second entry: “Managing bodies of ports as defined in Article 3, point (1), of Directive 2005/65/EC of the European Parliament and of the Council, including their port facilities as defined in Article 2, point (11), of Regulation (EC) No 725/2004, and entities operating works and equipment contained within ports”. Directive 2005/65/EC concerns enhancing port security. As with airports, the entry reaches beyond the managing body: an entity operating works and equipment inside the port can be caught on its own account.

Vessel traffic services

The third entry: “Operators of vessel traffic services (VTS) as defined in Article 3, point (o), of Directive 2002/59/EC of the European Parliament and of the Council”, the directive establishing a Community vessel traffic monitoring and information system.

Road: traffic management, not haulage

Annex I, point 2(d)

The first entry: “Road authorities as defined in Article 2, point (12), of Commission Delegated Regulation (EU) 2015/962 responsible for traffic management control, excluding public entities for which traffic management or the operation of intelligent transport systems is a non-essential part of their general activity”. Delegated Regulation (EU) 2015/962 concerns EU-wide real-time traffic information services. Two filters narrow the entry: the road authority must be responsible for traffic management control, and a public entity for which traffic management or the operation of intelligent transport systems is a non-essential part of its general activity is excluded.

The second entry: “Operators of Intelligent Transport Systems as defined in Article 4, point (1), of Directive 2010/40/EU of the European Parliament and of the Council”, the directive on the framework for deploying intelligent transport systems in road transport and for interfaces with other modes. The definition sits in that directive; read it before concluding that a traffic platform or data service is, or is not, covered.

Road hauliers and bus or coach companies are not among the ten entity types: a haulage company is not an Annex I transport entity as such.

Around the edges of point 2

CER Annex, point 2

A transport group can contain entities that NIS2 reaches through other entries, or not at all.

Organisation	Where NIS2 places it
Public service operators in public passenger transport	Not listed in Annex I, point 2. The CER Directive lists them in its own annex, point 2(e), by reference to Regulation (EC) No 1370/2007; if identified as a critical entity, NIS2 applies through article 2(3) (lesson m1l2).
Postal and courier service providers	Annex II, point 1, a different sector.
Manufacturers of motor vehicles, trailers and semi-trailers, and of other transport equipment	Annex II, points 5(e) and 5(f), by NACE Rev. 2 divisions 29 and 30.
Cloud, data centre, managed service and managed security service providers serving transport	Annex I, points 8 and 9: entities in their own right, not part of the transport sector.
Road hauliers, bus and coach companies	Not listed, unless another annex entry applies, or the company is identified as a critical entity under CER (for a bus or coach company, as a public service operator), which brings it in through article 2(3). The size-independent cases of article 2(2) apply only to entities of an Annex I or II type.

The CER annex repeats the four NIS2 transport subsectors almost word for word and adds a fifth, public transport. One difference of wording matters: where NIS2 lists railway undertakings “including operators of service facilities”, the CER annex lists railway undertakings “and operators of service facilities”.

In practice

Fictional case. A port group in a coastal member state builds its scope register, one line per legal entity, each line quoting the annex entry and the definition it relies on.

The port authority company is the managing body of the port: Annex I, point 2(c), second indent, including its port facilities.
It also operates the vessel traffic service for the port approaches: the third indent applies to the same legal entity, which the register notes so that one entity is not counted twice.
A container terminal subsidiary operates cranes and yard systems inside the port: entities operating works and equipment contained within ports, so it has its own line and its own scope decision.
A ferry subsidiary carries passengers and vehicles to two islands: a sea and coastal passenger water transport company, first indent; its ships are not separate entities.
A road haulage subsidiary moves containers inland: not listed in point 2, recorded as out of the transport sector with the reason.
An IT subsidiary runs managed services for the group and for outside customers: assessed against Annex I, point 9, as a possible managed service provider in its own right.

Size and class come next, entity by entity, in lesson m1l2.

What a supervisor will ask

Which annex entry does each of your legal entities fall under, and on which definition? A scope register quoting the annex wording and the referenced act.
Why is this subsidiary out of scope? A written reason tied to the annex text, for example the exclusion of public entities for which traffic management is non-essential.
Who operates installations, works or equipment inside your airport or port? A list of those operators, so that their own status can be assessed.
Have you registered the sector and subsector correctly? The registration data required by article 3(4), point (c).

Key points

Transport is Annex I, point 2: four subsectors, ten entity types, each defined by reference to another Union act.
Airports and ports reach beyond their managing bodies, to entities operating ancillary installations or works and equipment inside them.
Air carriers count only when used for commercial purposes; water transport companies are covered, their individual vessels are not.
Road covers road authorities responsible for traffic management control and operators of intelligent transport systems, not hauliers or bus companies.
Public transport operators appear in the CER annex, not in NIS2's Annex I.