NIS2 for Transport
Transport is cross-border by nature, but the reporting chain runs through the member state of establishment: a significant incident goes to its CSIRT or competent authority (art. 23(1), 26(1)), the early warning says whether the incident could have a cross-border impact (art. 23(4)(a)), and informing the other affected member states and ENISA falls to the authorities (art. 23(6)).
Which entities are covered
Air: air carriers (Regulation (EC) No 300/2008) used for commercial purposes; airport managing bodies, airports — including the core airports listed in Regulation (EU) No 1315/2013 — and entities operating ancillary installations contained within airports (Directive 2009/12/EC); traffic management control operators providing air traffic control (ATC) services (Regulation (EC) No 549/2004). Rail: infrastructure managers, and railway undertakings including operators of service facilities (Directive 2012/34/EU). Water: inland, sea and coastal passenger and freight water transport companies (Regulation (EC) No 725/2004), not including the individual vessels operated by those companies; managing bodies of ports (Directive 2005/65/EC), including their port facilities and entities operating works and equipment contained within ports; operators of vessel traffic services (VTS) (Directive 2002/59/EC). Road: road authorities (Delegated Regulation (EU) 2015/962) responsible for traffic management control, excluding public entities for which traffic management or the operation of intelligent transport systems is a non-essential part of their general activity; operators of Intelligent Transport Systems (Directive 2010/40/EU).
Sub-sectors named in the annex
- Air
- Rail
- Water
- Road
Essential or important
A large entity of this sector — one exceeding the ceilings for medium-sized enterprises of Recommendation 2003/361/EC — is essential (art. 3(1)(a)); a medium-sized one is important (art. 3(2)). A small or micro entity is covered only under article 2(2) or 2(3). Whatever its size, an entity is essential where article 3(1)(e) to (g) applies: identification by the member state as an essential entity under article 2(2)(b) to (e), critical-entity status under Directive (EU) 2022/2557, or, where the member state so provides, earlier identification as an operator of essential services. An entity the member state identifies as an important entity under the same points is important (art. 3(2)).
Essential entities face ex ante and ex post supervision (art. 32, recital 122) and, for infringing article 21 or 23, administrative fines with a maximum of at least EUR 10,000,000 or 2% of the total worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs, whichever is higher (art. 34(4)); important entities face ex post supervision only (art. 33) and a maximum of at least EUR 7,000,000 or 1.4% of that turnover (art. 34(5)).
Traps specific to this sector
Trap 1
Air traffic enters through one type only: traffic management control operators providing air traffic control (ATC) services as defined in Regulation (EC) No 549/2004, art. 2(1). Air carriers are listed only when used for commercial purposes.
Trap 2
Water transport companies are listed ‘not including the individual vessels operated by those companies’; port managing bodies come with their port facilities and the entities operating works and equipment contained within ports.
Trap 3
Road authorities are listed only where responsible for traffic management control, and public entities for which traffic management or the operation of intelligent transport systems is a non-essential part of their general activity are excluded.
Trap 4
Part-IS does not switch NIS2 off. Recital 29 lets the NIS2 competent authority consider compliance with the security requirements adopted under Regulations (EC) No 300/2008 and (EU) 2018/1139 — Part-IS is adopted under the latter — as compliance with the corresponding NIS2 requirements; NIS2 provisions are disapplied only where the equivalence test of article 4 is met.
Trap 5
Read literally, a public transport operator identified as a critical entity under Directive (EU) 2022/2557 (CER, Annex point 2(e)) is brought into NIS2 by article 2(3) and is essential (art. 3(1)(f)), although Annex I of NIS2 lists no public transport.
What else applies to you
Implementing Regulation (EU) 2023/203 and Delegated Regulation (EU) 2022/1645 (Part-IS), on information security risks with a potential impact on aviation safety; Directive (EU) 2022/2557 (CER), for critical entities; Regulation (EC) No 725/2004 and Directive 2005/65/EC on ship, port facility and port security, which also define the water transport types.
Article 4 disapplies a NIS2 provision only where a sector-specific Union act requires cybersecurity risk-management measures or incident notification at least equivalent in effect — and only for the entities that act covers.