NIS2 for Digital infrastructure
Five of the nine types are in scope whatever their size (art. 2(2)(a)) — providers of public electronic communications networks, providers of publicly available electronic communications services, trust service providers, TLD name registries and DNS service providers — and TLD name registries, DNS service providers and qualified trust service providers are essential whatever their size (art. 3(1)(b)).
Which entities are covered
Internet Exchange Point providers; DNS service providers, excluding operators of root name servers; TLD name registries; cloud computing service providers; data centre service providers; content delivery network providers; trust service providers; providers of public electronic communications networks; providers of publicly available electronic communications services.
Sub-sectors named in the annex
None. Annex I divides this sector into no sub-sectors: it names the types of entity directly.
Essential or important
A large entity of any of the nine types is essential (art. 3(1)(a)). Whatever their size, TLD name registries, DNS service providers and qualified trust service providers are essential (art. 3(1)(b)). Providers of public electronic communications networks or of publicly available electronic communications services are essential from medium size (art. 3(1)(c)); small or micro ones are in scope (art. 2(2)(a)(i)) and important (art. 3(2)). Trust service providers that are not qualified are in scope whatever their size (art. 2(2)(a)(ii)) and important unless large. Medium-sized Internet Exchange Point, cloud computing, data centre and content delivery network providers are important; small or micro ones are covered only under article 2(2)(b) to (e) or 2(3). Article 3(1)(e) to (g) can make any of them essential.
Essential entities face ex ante and ex post supervision (art. 32, recital 122) and, for infringing article 21 or 23, administrative fines with a maximum of at least EUR 10,000,000 or 2% of the total worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs, whichever is higher (art. 34(4)); important entities face ex post supervision only (art. 33) and a maximum of at least EUR 7,000,000 or 1.4% of that turnover (art. 34(5)).
Traps specific to this sector
Trap 1
Entities providing domain name registration services — registrars and agents acting on their behalf (art. 6(22)) — are not an Annex I type, yet the directive applies to them whatever their size (art. 2(4)): they keep registration data under article 28 and are recorded in the ENISA registry (art. 27(1)).
Trap 2
Jurisdiction differs by type: electronic communications providers fall under each member state in which they provide their services (art. 26(1)(a)); DNS, TLD, cloud computing, data centre and content delivery network providers under the member state of their main establishment in the Union (art. 26(1)(b), 26(2)); the others under the member state in which they are established (art. 26(1)).
Trap 3
A provider of one of the types in article 26(1)(b) that is not established in the Union but offers services within the Union designates a representative in the Union, established in one of the member states where the services are offered (art. 26(3), recital 116).
Trap 4
A trust service provider notifies a significant incident affecting its trust services within 24 hours, not 72 (art. 23(4), second subparagraph).
What else applies to you
Regulation (EU) No 910/2014 (eIDAS), as amended by Regulation (EU) 2024/1183, for trust service providers — NIS2 article 42 deleted its article 19; Directive (EU) 2018/1972 (European Electronic Communications Code) — NIS2 article 43 deleted its articles 40 and 41; Implementing Regulation (EU) 2024/2690, which sets the technical and methodological requirements of the article 21(2) measures for DNS, TLD, cloud computing, data centre, content delivery network and trust service providers (art. 1); Directive (EU) 2022/2557 (CER), whose article 8 disapplies its article 11 and Chapters III, IV and VI to critical entities in this sector.
Article 4 disapplies a NIS2 provision only where a sector-specific Union act requires cybersecurity risk-management measures or incident notification at least equivalent in effect — and only for the entities that act covers.