NIS2 for Digital providers
Overlapping EU digital regimes, each with its own reporting channel and its own regulator. NIS2 is the security floor beneath the DSA and the DMA.
Which entities are covered
Providers of online marketplaces, online search engines and social networking services platforms.
Sub-sectors named in the annex
- Online marketplaces
- Online search engines
- Social networking services platforms
Scope traps specific to this sector
Trap 1
Established outside the EU but serving EU users? You must designate a representative in a member state.
Trap 2
The DSA addresses content and systemic risk, not the security of your network and information systems. It does not displace NIS2.
Trap 3
Cloud-hosted marketplaces are important entities here while their cloud provider is an essential entity under digital infrastructure — different supervision for the same incident.
What else applies to you
Digital Services Act; Digital Markets Act; GDPR.
NIS2 rarely arrives alone. Where another EU act covers the same ground and is at least equivalent in effect, article 4 disapplies the corresponding NIS2 provisions — but only those, and only where that test is met.