NIS2 for Waste management
Two tests settle scope: waste management as the Waste Framework Directive defines it — the collection, transport, recovery (including sorting) and disposal of waste, the supervision of such operations, the after-care of disposal sites, and actions taken as a dealer or broker (Directive 2008/98/EC, art. 3(9), as replaced by Directive (EU) 2018/851) — and the principal-activity exclusion of the annex.
Which entities are covered
Undertakings carrying out waste management as defined in Article 3, point (9), of Directive 2008/98/EC, excluding undertakings for whom waste management is not their principal economic activity.
Sub-sectors named in the annex
None. Annex II divides this sector into no sub-sectors: it names the types of entity directly.
Essential or important
An entity of this Annex II sector that is medium-sized or larger is important (art. 3(2)); a small or micro one is covered only under article 2(2) or 2(3). Whatever its size, an entity is essential where article 3(1)(e) to (g) applies: identification by the member state as an essential entity under article 2(2)(b) to (e), critical-entity status under Directive (EU) 2022/2557, or, where the member state so provides, earlier identification as an operator of essential services. An entity the member state identifies as an important entity under the same points is important (art. 3(2)).
Essential entities face ex ante and ex post supervision (art. 32, recital 122) and, for infringing article 21 or 23, administrative fines with a maximum of at least EUR 10,000,000 or 2% of the total worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs, whichever is higher (art. 34(4)); important entities face ex post supervision only (art. 33) and a maximum of at least EUR 7,000,000 or 1.4% of that turnover (art. 34(5)).
Traps specific to this sector
Trap 1
An undertaking whose principal economic activity is not waste management is excluded from this entry, whatever its size.
Trap 2
Dealers and brokers are inside the definition the annex borrows, alongside collection, transport, recovery and disposal (Directive 2008/98/EC, art. 3(9)).
Trap 3
Public control does not alter the size test: NIS2 disapplies the rule that an enterprise 25 % or more controlled by public bodies cannot be an SME (art. 2(1), second subparagraph; Recommendation 2003/361/EC, Annex, art. 3(4)).
What else applies to you
Directive 2008/98/EC (Waste Framework Directive), as amended by Directive (EU) 2018/851, which defines waste management (art. 3(9)); it lays down no cybersecurity risk-management or incident-notification requirement, so article 4 displaces no NIS2 provision here. The CER annex has no waste management row.
Article 4 disapplies a NIS2 provision only where a sector-specific Union act requires cybersecurity risk-management measures or incident notification at least equivalent in effect — and only for the entities that act covers.