NIS2 for Manufacturing
Two regimes meet here: NIS2 governs the network and information systems a manufacturer uses for its operations (art. 21(1)), while the security of the products it places on the market is a matter for Regulation (EU) 2024/2847 (Cyber Resilience Act) — NIS2 does not directly cover mandatory requirements for the security of products with digital elements (CRA recital 3).
Which entities are covered
(a) Entities manufacturing medical devices as defined in Article 2, point (1), of Regulation (EU) 2017/745, and entities manufacturing in vitro diagnostic medical devices as defined in Article 2, point (2), of Regulation (EU) 2017/746, with the exception of entities manufacturing the medical devices referred to in Annex I, point 5, fifth indent; (b) to (f) undertakings carrying out any of the economic activities referred to in section C, divisions 26, 27, 28, 29 and 30 respectively, of NACE Rev. 2.
Sub-sectors named in the annex
- Manufacture of medical devices and in vitro diagnostic medical devices
- Manufacture of computer, electronic and optical products
- Manufacture of electrical equipment
- Manufacture of machinery and equipment n.e.c.
- Manufacture of motor vehicles, trailers and semi-trailers
- Manufacture of other transport equipment
Essential or important
An entity of this Annex II sector that is medium-sized or larger is important (art. 3(2)); a small or micro one is covered only under article 2(2) or 2(3). Whatever its size, an entity is essential where article 3(1)(e) to (g) applies: identification by the member state as an essential entity under article 2(2)(b) to (e), critical-entity status under Directive (EU) 2022/2557, or, where the member state so provides, earlier identification as an operator of essential services. An entity the member state identifies as an important entity under the same points is important (art. 3(2)).
Essential entities face ex ante and ex post supervision (art. 32, recital 122) and, for infringing article 21 or 23, administrative fines with a maximum of at least EUR 10,000,000 or 2% of the total worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs, whichever is higher (art. 34(4)); important entities face ex post supervision only (art. 33) and a maximum of at least EUR 7,000,000 or 1.4% of that turnover (art. 34(5)).
Traps specific to this sector
Trap 1
Points (b) to (f) reach ‘undertakings carrying out any of the economic activities’ of NACE Rev. 2 divisions 26 to 30. Unlike waste management (point 2), the entry sets no principal-activity filter, but whether a secondary manufacturing activity suffices is not settled by the text: recital 21 notes entities that carry out activities some of which fall within and some outside the scope, and leaves guidance to the Commission. A registered activity code does not decide it — Regulation (EC) No 1893/2006 applies only to the use of NACE for statistical purposes (art. 1(2)).
Trap 2
Manufacturers of medical devices on the public health emergency critical devices list are excluded from point 5(a) because they are in Annex I, point 5 — where a large one is essential.
Trap 3
Manufacturers of medical devices and in vitro diagnostic medical devices also carry information security requirements in the device regulations (Regulation (EU) 2017/745, Annex I, 17.2, 17.4 and 18.8; Regulation (EU) 2017/746, Annex I, 16.2 and 16.4).
What else applies to you
Regulation (EU) 2024/2847 (Cyber Resilience Act), for products with digital elements; Regulation (EU) 2017/745 (MDR) and Regulation (EU) 2017/746 (IVDR), for medical device and in vitro diagnostic medical device manufacturers.
Article 4 disapplies a NIS2 provision only where a sector-specific Union act requires cybersecurity risk-management measures or incident notification at least equivalent in effect — and only for the entities that act covers.