NIS2 for Postal and courier services
The binding test is Annex II, point 1: a postal service provider within the meaning of point (1a) of article 2 of Directive 97/67/EC, inserted by Directive 2008/6/EC — an undertaking that provides one or more postal services, that is services involving the clearance, sorting, transport and distribution of postal items (art. 2(1)) — including providers of courier services. Recital 12 explains the intent: providers that perform at least one step in the postal delivery chain, taking account of their dependence on network and information systems.
Which entities are covered
Postal service providers as defined in Article 2, point (1a), of Directive 97/67/EC, including providers of courier services. (Point (1a), inserted by Directive 2008/6/EC, defines a postal service provider as an ‘undertaking that provides one or more postal services’.)
Sub-sectors named in the annex
None. Annex II divides this sector into no sub-sectors: it names the types of entity directly.
Essential or important
An entity of this Annex II sector that is medium-sized or larger is important (art. 3(2)); a small or micro one is covered only under article 2(2) or 2(3). Whatever its size, an entity is essential where article 3(1)(e) to (g) applies: identification by the member state as an essential entity under article 2(2)(b) to (e), critical-entity status under Directive (EU) 2022/2557, or, where the member state so provides, earlier identification as an operator of essential services. An entity the member state identifies as an important entity under the same points is important (art. 3(2)).
Essential entities face ex ante and ex post supervision (art. 32, recital 122) and, for infringing article 21 or 23, administrative fines with a maximum of at least EUR 10,000,000 or 2% of the total worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs, whichever is higher (art. 34(4)); important entities face ex post supervision only (art. 33) and a maximum of at least EUR 7,000,000 or 1.4% of that turnover (art. 34(5)).
Traps specific to this sector
Trap 1
Recital 12 explains that transport services not undertaken in conjunction with one of those steps ‘should be excluded from the scope of postal services’; the definitions applied are those of Directive 97/67/EC, art. 2(1) and 2(1a).
Trap 2
The entry is not confined to universal service providers: it covers any undertaking that provides one or more postal services (Directive 97/67/EC, art. 2(1a)), and names providers of courier services expressly.
What else applies to you
Directive 97/67/EC (Postal Services Directive), as amended by Directive 2008/6/EC, which defines postal service providers (art. 2(1a)).
Article 4 disapplies a NIS2 provision only where a sector-specific Union act requires cybersecurity risk-management measures or incident notification at least equivalent in effect — and only for the entities that act covers.