NIS2 for Space
The annex defines who is in the sector, not how far the duties reach: an operator qualifies through ground-based infrastructure, owned, managed and operated by Member States or by private parties, that supports the provision of space-based services; once in scope, its measures cover the network and information systems it uses for its operations or for the provision of its services (art. 21(1)).
Which entities are covered
Operators of ground-based infrastructure, owned, managed and operated by Member States or by private parties, that support the provision of space-based services, excluding providers of public electronic communications networks.
Sub-sectors named in the annex
None. Annex I divides this sector into no sub-sectors: it names the types of entity directly.
Essential or important
A large entity of this sector — one exceeding the ceilings for medium-sized enterprises of Recommendation 2003/361/EC — is essential (art. 3(1)(a)); a medium-sized one is important (art. 3(2)). A small or micro entity is covered only under article 2(2) or 2(3). Whatever its size, an entity is essential where article 3(1)(e) to (g) applies: identification by the member state as an essential entity under article 2(2)(b) to (e), critical-entity status under Directive (EU) 2022/2557, or, where the member state so provides, earlier identification as an operator of essential services. An entity the member state identifies as an important entity under the same points is important (art. 3(2)).
Essential entities face ex ante and ex post supervision (art. 32, recital 122) and, for infringing article 21 or 23, administrative fines with a maximum of at least EUR 10,000,000 or 2% of the total worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs, whichever is higher (art. 34(4)); important entities face ex post supervision only (art. 33) and a maximum of at least EUR 7,000,000 or 1.4% of that turnover (art. 34(5)).
Traps specific to this sector
Trap 1
Infrastructure owned, managed or operated by or on behalf of the Union as part of its space programme is outside the entry: the annex names Member States and private parties, and recital 37 states that the entry does not cover it.
Trap 2
The exclusion names providers of public electronic communications networks only — not providers of publicly available electronic communications services. Those network providers appear as a type of their own in Annex I, point 8.
Trap 3
An operator identified as a critical entity under Directive (EU) 2022/2557 (CER) is covered whatever its size and is essential (art. 2(3), 3(1)(f)).
What else applies to you
Directive (EU) 2022/2557 (CER), whose Annex lists space at point 10 with the same operators, for those identified as critical entities.
Article 4 disapplies a NIS2 provision only where a sector-specific Union act requires cybersecurity risk-management measures or incident notification at least equivalent in effect — and only for the entities that act covers.