NIS2 for Production, processing and distribution of food
The entry is narrower than the General Food Law: a food business is any undertaking, for profit or not, public or private, carrying out any stage of production, processing and distribution of food (Regulation (EC) No 178/2002, art. 3(2)); the annex keeps only those engaged in wholesale distribution and industrial production and processing.
Which entities are covered
Food businesses as defined in Article 3, point (2), of Regulation (EC) No 178/2002 of the European Parliament and of the Council which are engaged in wholesale distribution and industrial production and processing
Sub-sectors named in the annex
None. Annex II divides this sector into no sub-sectors: it names the types of entity directly.
Essential or important
An entity of this Annex II sector that is medium-sized or larger is important (art. 3(2)); a small or micro one is covered only under article 2(2) or 2(3). Whatever its size, an entity is essential where article 3(1)(e) to (g) applies: identification by the member state as an essential entity under article 2(2)(b) to (e), critical-entity status under Directive (EU) 2022/2557, or, where the member state so provides, earlier identification as an operator of essential services. An entity the member state identifies as an important entity under the same points is important (art. 3(2)).
Essential entities face ex ante and ex post supervision (art. 32, recital 122) and, for infringing article 21 or 23, administrative fines with a maximum of at least EUR 10,000,000 or 2% of the total worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs, whichever is higher (art. 34(4)); important entities face ex post supervision only (art. 33) and a maximum of at least EUR 7,000,000 or 1.4% of that turnover (art. 34(5)).
Traps specific to this sector
Trap 1
Food is the only Annex II sector that the CER Directive also lists (Directive (EU) 2022/2557, Annex, point 11): a food business identified as a critical entity is covered whatever its size and is essential, not important (art. 2(3), 3(1)(f)).
Trap 2
The CER annex words the food entry differently — food businesses ‘engaged exclusively in logistics and wholesale distribution and large scale industrial production and processing’. Read literally, article 2(3) — with article 1(2)(b), which names critical entities alongside entities of a type referred to in Annex I or II — does not require an annex type, so a food business identified under that row would be brought in even where it falls outside the NIS2 wording.
Trap 3
The row joins wholesale distribution and industrial production and processing with ‘and’; it does not say whether one of those activities is enough.
Trap 4
‘Wholesale distribution’ and ‘industrial production and processing’ are defined neither in NIS2 nor in the General Food Law, whose definition of retail (art. 3(7)) itself includes supermarket distribution centres and wholesale outlets: a food-law label does not settle the NIS2 question.
What else applies to you
Regulation (EC) No 178/2002 (General Food Law), which defines food businesses (art. 3(2)) and sets traceability (art. 18), the food business operator's withdrawal and notification duties (art. 19) and the rapid alert system (art. 50); Directive (EU) 2022/2557 (CER), whose Annex lists food at point 11, for food businesses identified as critical entities.
Article 4 disapplies a NIS2 provision only where a sector-specific Union act requires cybersecurity risk-management measures or incident notification at least equivalent in effect — and only for the entities that act covers.