Annexes I & II · Directive (EU) 2022/2555
The 18 sectors in scope
Scope is the intersection of sector and size. Get the sector wrong and nothing else you do about NIS2 is aimed at the right target.
The size test comes second
For most types listed in Annex I or II, the size-cap rule of article 2(1) then decides. Some types are covered whatever their size — those of article 2(2)(a) and the central government entities of article 2(2)(f)(i) — and an annex type can also be brought in under article 2(2)(b) to (e) or (f)(ii). Two routes do not start from an annex type at all — critical entities under Directive (EU) 2022/2557 (article 2(3)) and entities providing domain name registration services (article 2(4)), both covered whatever their size (see below).
- Large enterprises — 250 or more staff, or turnover above €50 million and balance sheet total above €43 million — are essential entities in Annex I sectors.
- Medium-sized enterprises — 50 or more staff, or turnover and balance sheet total above €10 million — are important entities, and essential in some Annex I sectors.
- Small and micro enterprises are generally out of scope — unless they fall into one of the size-independent categories below.
In scope regardless of size
Certain entities are covered whatever their headcount or turnover (article 2(2) to 2(4)). The cases of article 2(2) concern entities of a type listed in Annex I or II; those of article 2(3) and 2(4) do not name an annex type.
- Providers of public electronic communications networks or of publicly available electronic communications services (article 2(2)(a)(i))
- Trust service providers (article 2(2)(a)(ii))
- TLD name registries and DNS service providers (article 2(2)(a)(iii))
- An entity that is the sole provider in a member state of a service which is essential for the maintenance of critical societal or economic activities (article 2(2)(b))
- An entity whose service disruption could have a significant impact on public safety, public security or public health (article 2(2)(c))
- An entity whose service disruption could induce a significant systemic risk, in particular for sectors where such disruption could have a cross-border impact (article 2(2)(d))
- An entity that is critical because of its specific importance at national or regional level for the particular sector or type of service, or for other interdependent sectors in the member state (article 2(2)(e))
- Public administration entities of central government, as defined by the member state in accordance with national law (article 2(2)(f)(i))
- Public administration entities at regional level, as defined by the member state, that, following a risk-based assessment, provide services the disruption of which could have a significant impact on critical societal or economic activities (article 2(2)(f)(ii))
- Entities identified as critical entities under Directive (EU) 2022/2557 (article 2(3))
- Entities providing domain name registration services (article 2(4))
Member states may go further: article 2(5) lets them extend the directive to public administration entities at local level and to education institutions, and article 5 lets them adopt provisions ensuring a higher level of cybersecurity. Check your country, not only the directive.
Annex I
Sectors of high criticality
Eleven sectors. Large entities here are essential, subject to ex ante and ex post supervision; medium-sized ones are important, save the cases of article 3(1)(b) to (g).
| # | Sector | Sub-sectors and entity types |
|---|---|---|
| 1 | Energy | Sub-sectors: Electricity; District heating and cooling; Oil; Gas; Hydrogen. |
| 2 | Transport | Sub-sectors: Air; Rail; Water; Road. |
| 3 | Banking | Credit institutions as defined in Article 4, point (1), of Regulation (EU) No 575/2013. |
| 4 | Financial market infrastructures | Operators of trading venues as defined in Article 4, point (24), of Directive 2014/65/EU; central counterparties (CCPs) as defined in Article 2, point (1), of Regulation (EU) No 648/2012. |
| 5 | Health | Healthcare providers as defined in Article 3, point (g), of Directive 2011/24/EU; EU reference laboratories referred to in Article 15 of Regulation (EU) 2022/2371; entities carrying out research and development activities of medicinal products as defined in Article 1, point (2), of Directive 2001/83/EC; entities manufacturing basic pharmaceutical products and pharmaceutical preparations referred to in section C division 21 of NACE Rev. 2; entities manufacturing medical devices considered to be critical during a public health emergency (public health emergency critical devices list) within the meaning of Article 22 of Regulation (EU) 2022/123. |
| 6 | Drinking water | Suppliers and distributors of water intended for human consumption as defined in Article 2, point (1)(a), of Directive (EU) 2020/2184, excluding distributors for which distribution of water for human consumption is a non-essential part of their general activity of distributing other commodities and goods. |
| 7 | Waste water | Undertakings collecting, disposing of or treating urban waste water, domestic waste water or industrial waste water as defined in Article 2, points (1), (2) and (3), of Council Directive 91/271/EEC, excluding undertakings for which collecting, disposing of or treating urban waste water, domestic waste water or industrial waste water is a non-essential part of their general activity. |
| 8 | Digital infrastructure | Internet Exchange Point providers; DNS service providers, excluding operators of root name servers; TLD name registries; cloud computing service providers; data centre service providers; content delivery network providers; trust service providers; providers of public electronic communications networks; providers of publicly available electronic communications services. |
| 9 | ICT service management (business-to-business) | Managed service providers — entities providing services related to the installation, management, operation or maintenance of ICT products, networks, infrastructure, applications or any other network and information systems, via assistance or active administration carried out either on customers’ premises or remotely (art. 6(39)) — and managed security service providers, the managed service providers that carry out or provide assistance for activities relating to cybersecurity risk management (art. 6(40)). |
| 10 | Public administration | Public administration entities of central governments as defined by a member state in accordance with national law; public administration entities at regional level as defined by a member state in accordance with national law. A public administration entity is one recognised as such under national law that meets the criteria of article 6(35)(a) to (d), not including the judiciary, parliaments or central banks. |
| 11 | Space | Operators of ground-based infrastructure, owned, managed and operated by Member States or by private parties, that support the provision of space-based services, excluding providers of public electronic communications networks. |
Annex II
Other critical sectors
Seven sectors. Entities here are important unless article 3(1)(e) to (g) makes them essential, and important entities are subject to ex post supervision — authorities act on evidence rather than inspecting proactively (article 33(1)).
| # | Sector | Sub-sectors and entity types |
|---|---|---|
| 12 | Postal and courier services | Postal service providers as defined in Article 2, point (1a), of Directive 97/67/EC, including providers of courier services. (Point (1a), inserted by Directive 2008/6/EC, defines a postal service provider as an ‘undertaking that provides one or more postal services’.) |
| 13 | Waste management | Undertakings carrying out waste management as defined in Article 3, point (9), of Directive 2008/98/EC, excluding undertakings for whom waste management is not their principal economic activity. |
| 14 | Manufacture, production and distribution of chemicals | Undertakings carrying out the manufacture of substances and the distribution of substances or mixtures, as referred to in Article 3, points (9) and (14), of Regulation (EC) No 1907/2006 of the European Parliament and of the Council and undertakings carrying out the production of articles, as defined in Article 3, point (3), of that Regulation, from substances or mixtures |
| 15 | Production, processing and distribution of food | Food businesses as defined in Article 3, point (2), of Regulation (EC) No 178/2002 of the European Parliament and of the Council which are engaged in wholesale distribution and industrial production and processing |
| 16 | Manufacturing | Sub-sectors: Manufacture of medical devices and in vitro diagnostic medical devices; Manufacture of computer, electronic and optical products; Manufacture of electrical equipment; Manufacture of machinery and equipment n.e.c.; Manufacture of motor vehicles, trailers and semi-trailers; Manufacture of other transport equipment. |
| 17 | Digital providers | Providers of online marketplaces (art. 6(28), referring to Directive 2005/29/EC), of online search engines (art. 6(29), referring to Regulation (EU) 2019/1150) and of social networking services platforms (art. 6(33)). |
| 18 | Research | Research organisations: an entity ‘which has as its primary goal to conduct applied research or experimental development with a view to exploiting the results of that research for commercial purposes, but which does not include educational institutions’ (art. 6(41)). The primary goal is the research; commercial exploitation is its purpose. |
Common questions
Our sector is in Annex I but we only have 40 employees. Are we in scope?
Not on the size rule if your enterprise is small: fewer than 50 staff and an annual turnover or an annual balance sheet total of at most EUR 10 million (Recommendation 2003/361/EC, Annex, article 2(2)), counted with your partner and linked enterprises (Annex, article 6). With 40 staff but both turnover and balance sheet total above EUR 10 million you are at least medium-sized, and in scope (article 2(1) of the directive): medium-sized while your turnover is at most EUR 50 million or your balance sheet total at most EUR 43 million, large once both are exceeded (Annex, article 2(1)). Whatever your size, you are in scope as a provider of public electronic communications networks or publicly available electronic communications services, a trust service provider, a TLD name registry or a DNS service provider (article 2(2)(a)), as a public administration entity under article 2(2)(f), where your member state identifies you under article 2(2)(b) to (e) — as the sole provider in that state of a service essential for critical societal or economic activities, for instance — or as a critical entity under Directive (EU) 2022/2557 (article 2(3)). Member states may also adopt provisions going further than the directive (article 5).
What is the practical difference between Annex I and Annex II?
Articles 21 and 23 apply to essential and important entities alike. The difference is classification. A large entity of an Annex I sector is essential (article 3(1)(a)); a medium-sized one, and any entity of an Annex II sector, is important (article 3(2)) unless article 3(1)(b) to (g) makes it essential. Essential entities are subject to ex ante and ex post supervision (article 32), important entities to ex post supervision (article 33). For infringing article 21 or 23, the administrative fines have a maximum of at least EUR 10 000 000 or 2 % of the total worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs for essential entities, and of at least EUR 7 000 000 or 1.4 % of that turnover for important entities, whichever is higher (article 34(4) and 34(5)).
We are a managed service provider. Which sector applies?
ICT service management (business-to-business), Annex I, point 9, which lists managed service providers and managed security service providers as defined in article 6(39) and 6(40). Implementing Regulation (EU) 2024/2690 sets the technical and methodological requirements of your article 21(2) measures (its article 1). Separately, your customers that are essential or important entities must address the security of their relationships with direct suppliers and service providers (article 21(2)(d)) and take into account the vulnerabilities and cybersecurity practices of each of them (article 21(3)) — whether or not you are in scope yourself.
Is public administration in scope?
Annex I, point 10 lists public administration entities of central governments and at regional level, each as defined by a member state in accordance with national law. Central government entities are in scope and essential whatever their size (articles 2(2)(f)(i) and 3(1)(d)). Regional entities are in scope where, following a risk-based assessment, they provide services whose disruption could have a significant impact on critical societal or economic activities (article 2(2)(f)(ii)). The local level is not in the annex, but a member state may apply the directive to it (article 2(5)(a)). Public administration entities carrying out their activities in the areas of national security, public security, defence or law enforcement are excluded (article 2(7)). Because the annex leaves these definitions to national law, read your national law as well as the directive.
How do we count staff and turnover for a group?
The directive uses the definitions of the Annex to Commission Recommendation 2003/361/EC (article 2(1)), which add to an enterprise's own data those of its partner and linked enterprises (Annex, article 6). Article 3(4) of that Annex — no SME status where public bodies control 25 % or more of the capital or voting rights — does not apply for the purposes of the directive (article 2(1), second subparagraph). Recital 16 lets member states take into account the degree of independence an entity enjoys from its partner or linked enterprises, in particular in terms of the network and information systems it uses and the services it provides.
Not sure which side of the line you are on?
Seven questions, no registration, and it tells you whether you would be essential or important.