NIS2 for Research
Recital 36 explains the inclusion: entities that share, disseminate or exploit the results of their research for commercial purposes can be important players in value chains, which makes the security of their network and information systems part of the overall cybersecurity of the internal market.
Which entities are covered
Research organisations: an entity ‘which has as its primary goal to conduct applied research or experimental development with a view to exploiting the results of that research for commercial purposes, but which does not include educational institutions’ (art. 6(41)). The primary goal is the research; commercial exploitation is its purpose.
Sub-sectors named in the annex
None. Annex II divides this sector into no sub-sectors: it names the types of entity directly.
Essential or important
An entity of this Annex II sector that is medium-sized or larger is important (art. 3(2)); a small or micro one is covered only under article 2(2) or 2(3). Whatever its size, an entity is essential where article 3(1)(e) to (g) applies: identification by the member state as an essential entity under article 2(2)(b) to (e), critical-entity status under Directive (EU) 2022/2557, or, where the member state so provides, earlier identification as an operator of essential services. An entity the member state identifies as an important entity under the same points is important (art. 3(2)).
Essential entities face ex ante and ex post supervision (art. 32, recital 122) and, for infringing article 21 or 23, administrative fines with a maximum of at least EUR 10,000,000 or 2% of the total worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs, whichever is higher (art. 34(4)); important entities face ex post supervision only (art. 33) and a maximum of at least EUR 7,000,000 or 1.4% of that turnover (art. 34(5)).
Traps specific to this sector
Trap 1
Educational institutions are outside this definition (art. 6(41)), but not necessarily outside the directive: a member state may apply it to education institutions, in particular where they carry out critical research activities (art. 2(5)(b)), and another entry without that exclusion can reach them — entities carrying out research and development activities of medicinal products (Annex I, point 5) — subject to the size rule.
Trap 2
Recital 36 reads the definition as including entities which focus the essential part of their activities on applied research or experimental development within the meaning of the OECD Frascati Manual 2015, with a view to commercial exploitation such as the manufacturing or development of a product or process, the provision of a service, or the marketing thereof.
What else applies to you
Regulation (EU) 2016/679 (GDPR), where research processes personal data: article 89(1) requires appropriate safeguards, including technical and organisational measures, for processing for scientific research purposes; article 9(2)(j) lifts the prohibition on special categories of data for those purposes only on the basis of Union or Member State law, in accordance with article 89(1), and a lawful basis under article 6 is still needed (recital 51). No sector-specific Union act on the cybersecurity of research organisations is among the texts this page was checked against.
Article 4 disapplies a NIS2 provision only where a sector-specific Union act requires cybersecurity risk-management measures or incident notification at least equivalent in effect — and only for the entities that act covers.