NIS2 for Digital providers
These providers fall under the member state of their main establishment in the Union (art. 26(1)(b), 26(2)) and are recorded in the ENISA registry (art. 27); Implementing Regulation (EU) 2024/2690 sets the technical and methodological requirements of their article 21(2) measures and the cases in which their incidents are significant (art. 1).
Which entities are covered
Providers of online marketplaces (art. 6(28), referring to Directive 2005/29/EC), of online search engines (art. 6(29), referring to Regulation (EU) 2019/1150) and of social networking services platforms (art. 6(33)).
Sub-sectors named in the annex
None. Annex II divides this sector into no sub-sectors: it names the types of entity directly.
Essential or important
An entity of this Annex II sector that is medium-sized or larger is important (art. 3(2)); a small or micro one is covered only under article 2(2) or 2(3). Whatever its size, an entity is essential where article 3(1)(e) to (g) applies: identification by the member state as an essential entity under article 2(2)(b) to (e), critical-entity status under Directive (EU) 2022/2557, or, where the member state so provides, earlier identification as an operator of essential services. An entity the member state identifies as an important entity under the same points is important (art. 3(2)).
Essential entities face ex ante and ex post supervision (art. 32, recital 122) and, for infringing article 21 or 23, administrative fines with a maximum of at least EUR 10,000,000 or 2% of the total worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs, whichever is higher (art. 34(4)); important entities face ex post supervision only (art. 33) and a maximum of at least EUR 7,000,000 or 1.4% of that turnover (art. 34(5)).
Traps specific to this sector
Trap 1
A provider not established in the Union that offers services within the Union designates a representative in the Union, established in one of the member states where the services are offered (art. 26(3), recital 116).
Trap 2
They submit the information of article 27(2) — including their IP ranges — to the competent authority, and the single point of contact forwards it to ENISA for its registry, all but the IP ranges (art. 27(1), 27(2), 27(4)). Changes are notified to the competent authority without delay and in any event within three months (art. 27(3)); changes to the details given for the national list of entities, without delay and in any event within two weeks (art. 3(4)).
What else applies to you
Implementing Regulation (EU) 2024/2690 (technical and methodological requirements, significant incidents); Regulation (EU) 2022/2065 (Digital Services Act), for intermediary services including online platforms and online search engines; Directive 2005/29/EC as amended by Directive (EU) 2019/2161, and Regulation (EU) 2019/1150, which define online marketplaces and online search engines.
Article 4 disapplies a NIS2 provision only where a sector-specific Union act requires cybersecurity risk-management measures or incident notification at least equivalent in effect — and only for the entities that act covers.