Annexes I & II · Directive (EU) 2022/2555
The 18 sectors in scope
Scope is the intersection of sector and size. Get the sector wrong and nothing else you do about NIS2 is aimed at the right target.
The size test comes second
Being in an Annex I or II sector is necessary but not sufficient. The size-cap rule of article 2 then applies:
- Large enterprises — 250 or more staff, or turnover above €50 million and balance sheet total above €43 million — are essential entities in Annex I sectors.
- Medium-sized enterprises — 50 or more staff, or turnover and balance sheet total above €10 million — are important entities, and essential in some Annex I sectors.
- Small and micro enterprises are generally out of scope — unless they fall into one of the size-independent categories below.
In scope regardless of size
Certain entities are covered whatever their headcount or turnover:
- Providers of public electronic communications networks or publicly available electronic communications services
- Trust service providers
- TLD name registries and DNS service providers
- Entities that are the sole provider in a member state of a service essential for societal or economic activity
- Entities whose disruption could have significant impact on public safety, security or health, or induce significant systemic risk across sectors
- Public administration entities, as designated by the member state
- Entities identified as critical under Directive (EU) 2022/2557 (CER)
Member states could also extend scope further in their national law — several did. Check your country, not only the directive.
Annex I
Sectors of high criticality
Eleven sectors. Large entities here are essential, and therefore subject to ex ante supervision.
| # | Sector | Sub-sectors and entity types |
|---|---|---|
| 1 | Energy | Electricity, District heating and cooling, Oil, Gas, Hydrogen |
| 2 | Transport | Air, Rail, Water, Road |
| 3 | Banking | Credit institutions |
| 4 | Financial market infrastructures | Trading venues, Central counterparties |
| 5 | Health | Healthcare providers, EU reference laboratories, R&D of medicinal products, Manufacture of basic pharmaceutical products, Medical devices critical during a public health emergency |
| 6 | Drinking water | Suppliers and distributors of water intended for human consumption |
| 7 | Waste water | Collection, disposal and treatment of urban, domestic and industrial waste water |
| 8 | Digital infrastructure | Internet exchange points, DNS service providers, TLD name registries, Cloud computing service providers, Data centre service providers, Content delivery networks, Trust service providers, Public electronic communications networks and services |
| 9 | ICT service management (B2B) | Managed service providers, Managed security service providers |
| 10 | Public administration | Central government, Regional government where a member state so provides |
| 11 | Space | Operators of ground-based infrastructure supporting space-based services |
Annex II
Other critical sectors
Seven sectors. Entities here are important, subject to ex post supervision — authorities act on evidence rather than inspecting proactively.
| # | Sector | Sub-sectors and entity types |
|---|---|---|
| 12 | Postal and courier services | Postal service providers, Courier services |
| 13 | Waste management | Undertakings carrying out waste management |
| 14 | Chemicals | Manufacture, production and distribution of chemicals |
| 15 | Food | Production, processing and distribution of food |
| 16 | Manufacturing | Medical devices and in vitro diagnostics, Computer, electronic and optical products, Electrical equipment, Machinery and equipment, Motor vehicles, trailers and semi-trailers, Other transport equipment |
| 17 | Digital providers | Online marketplaces, Online search engines, Social networking services platforms |
| 18 | Research organisations | Research organisations |
Common questions
Our sector is in Annex I but we only have 40 employees. Are we in scope?
Probably not on the size test alone: the size-cap rule brings in medium-sized enterprises, meaning 50 or more staff, or annual turnover and balance sheet total above EUR 10 million. However, you are in scope regardless of size if you are a provider of public electronic communications networks or services, a trust service provider, a DNS service provider, a TLD name registry, the sole provider in your member state of an essential service, or an entity designated as critical under Directive (EU) 2022/2557. Several member states also extended scope below the directive floor in national law.
What is the practical difference between Annex I and Annex II?
Annex I lists eleven sectors of high criticality; Annex II lists seven further critical sectors. The security obligations under article 21 are substantially the same. The difference is classification and therefore supervision: large entities in Annex I sectors are essential entities subject to ex ante supervision, while Annex II entities are important entities subject to ex post supervision. Maximum fines also differ: EUR 10m or 2% of turnover versus EUR 7m or 1.4%.
We are a managed service provider. Which sector applies?
ICT service management (business-to-business) in Annex I, which explicitly covers managed service providers and managed security service providers. This was a deliberate addition in NIS2: MSPs were largely outside NIS1 despite holding privileged access to their customers' networks. Note that your customers also have supply chain obligations under article 21(2)(d) that will reach you contractually, whether or not you are directly in scope.
Is public administration in scope?
Central government public administration entities are in Annex I. Regional level entities are in scope where the member state so provides, and local level entities may be included at national discretion. This is one of the areas where national transposition diverges most, so check your national law rather than the directive alone.
How do we count staff and turnover for a group?
The directive uses the definitions in the Annex to Commission Recommendation 2003/361/EC, which aggregate linked and partner enterprises. A subsidiary that looks small on its own may count as medium-sized or large once the group is taken into account. This is a common source of incorrect scope determinations and is worth confirming with counsel where the answer is close to a threshold.
Not sure which side of the line you are on?
Six questions, no registration, and it tells you whether you would be essential or important.