NIS2 for Health
Health manufacturers sit in two annexes: makers of medical devices on the public health emergency critical devices list are in Annex I, point 5, while every other manufacturer of medical devices or in vitro diagnostic medical devices is in Annex II, point 5(a), where a large manufacturer is important rather than essential.
Which entities are covered
Healthcare providers as defined in Article 3, point (g), of Directive 2011/24/EU; EU reference laboratories referred to in Article 15 of Regulation (EU) 2022/2371; entities carrying out research and development activities of medicinal products as defined in Article 1, point (2), of Directive 2001/83/EC; entities manufacturing basic pharmaceutical products and pharmaceutical preparations referred to in section C division 21 of NACE Rev. 2; entities manufacturing medical devices considered to be critical during a public health emergency (public health emergency critical devices list) within the meaning of Article 22 of Regulation (EU) 2022/123.
Sub-sectors named in the annex
None. Annex I divides this sector into no sub-sectors: it names the types of entity directly.
Essential or important
A large entity of this sector — one exceeding the ceilings for medium-sized enterprises of Recommendation 2003/361/EC — is essential (art. 3(1)(a)); a medium-sized one is important (art. 3(2)). A small or micro entity is covered only under article 2(2) or 2(3). Whatever its size, an entity is essential where article 3(1)(e) to (g) applies: identification by the member state as an essential entity under article 2(2)(b) to (e), critical-entity status under Directive (EU) 2022/2557, or, where the member state so provides, earlier identification as an operator of essential services. An entity the member state identifies as an important entity under the same points is important (art. 3(2)).
Essential entities face ex ante and ex post supervision (art. 32, recital 122) and, for infringing article 21 or 23, administrative fines with a maximum of at least EUR 10,000,000 or 2% of the total worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs, whichever is higher (art. 34(4)); important entities face ex post supervision only (art. 33) and a maximum of at least EUR 7,000,000 or 1.4% of that turnover (art. 34(5)).
Traps specific to this sector
Trap 1
A significant incident that is also a personal data breach runs two clocks to two authorities: an early warning to the CSIRT or competent authority within 24 hours (NIS2 art. 23(4)(a)), and notification to the data protection supervisory authority without undue delay and, where feasible, within 72 hours, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons (GDPR art. 33(1)).
Trap 2
Device manufacturers carry information security requirements in the device regulations too — software developed under risk management ‘including information security’, minimum requirements on IT security measures ‘including protection against unauthorised access’ (Regulation (EU) 2017/745, Annex I, 17.2, 17.4 and 18.8; Regulation (EU) 2017/746, Annex I, 16.2 and 16.4). They apply alongside NIS2: article 4 disapplies NIS2 only where a sector-specific act is at least equivalent in effect.
Trap 3
Read literally, an entity holding a distribution authorisation as referred to in Article 79 of Directive 2001/83/EC is not an Annex I type, but the CER annex lists it (point 5): one identified as a critical entity is brought into NIS2 by article 2(3) and is essential (art. 3(1)(f)).
What else applies to you
Regulation (EU) 2016/679 (GDPR), article 33, for personal data breaches; Regulation (EU) 2017/745 (MDR) and Regulation (EU) 2017/746 (IVDR), for device manufacturers; Directive (EU) 2022/2557 (CER), for critical entities.
Article 4 disapplies a NIS2 provision only where a sector-specific Union act requires cybersecurity risk-management measures or incident notification at least equivalent in effect — and only for the entities that act covers.