Decide whether an entity belongs in a NIS2 Annex I or Annex II sector, then classify it as essential, important, or out of scope.
Use the Directive, Commission Article 3(4) guidance, and the SME recommendation to record the sector, subsector, entity type, size-cap analysis, Member State registration facts, and reassessment trigger.
An industry label does not establish NIS2 scope. Match each service to the exact sector, subsector, and type-of-entity row in Annex I or II. Then calculate SME status, test size-independent and Member State identification paths, and apply Article 3 to classify the legal entity as essential or important.
The scoping record should answer four questions: which Annex I or Annex II row applies, whether the entity meets the Article 2 scope rule, whether any regardless-of-size or Member State identification rule applies, and whether Article 3 classifies the entity as essential or important.
Do not treat the Annex labels as broad industry tags. Annex I and Annex II name specific types of entities, and several rows include exclusions or references to other EU definitions. Record the exact row used and the facts that support it.
Sources (3)
Primary NIS2 legal text for Article 2 scope, Article 3 classification, and Annex I and II sector tables.
This Directive applies to public or private entities
Commission policy overview describing NIS2 as a framework for cybersecurity across 18 critical sectors.
18 critical sectors across the EU
SME definition referenced by NIS2 Article 2 for the medium-sized enterprise size-cap analysis.
employ fewer than 250 persons
Annex I covers sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management for business-to-business services, public administration, and space.
Annex II covers other critical sectors: postal and courier services; waste management where it is the undertaking's principal economic activity; specified chemical activities; food businesses engaged in wholesale distribution and industrial production or processing; listed manufacturing divisions; online marketplaces, online search engines, and social networking services platforms; and research organisations.
The rows are narrower than their headings. Examples include electricity suppliers and system operators rather than every energy-adjacent business; healthcare providers, EU reference laboratories, and entities carrying out medicinal-product research, development, or manufacturing rather than every health supplier; and manufacturers in the listed categories for medical devices, computers and electronics, electrical equipment, machinery, motor vehicles, and other transport equipment rather than manufacturing generally.
Sources (3)
Annex I lists sectors of high criticality and Annex II lists other critical sectors.
SECTORS OF HIGH CRITICALITY
Commission template repeats Annex I and Annex II sector categories for Member State entity-list collection.
Sector of activity under Directive
Commission overview for NIS2 scope and sector policy context.
wider scope, clearer rules
Article 3 treats some entities as essential and classifies the remaining in-scope Annex I or Annex II entities as important. Annex I entities that exceed the medium-sized-enterprise ceilings are essential. Qualified trust service providers, TLD registries, and DNS service providers are essential regardless of size.
Other Article 3 essential-entity paths include medium-sized public electronic communications network or service providers, central-government public administration entities, Member State identification under Article 2(2)(b) to (e), entities identified as critical entities under Directive (EU) 2022/2557, and, if a Member State provides for it, former operators of essential services identified before 16 January 2023.
Sources (3)
Article 3 defines essential and important entities and links classification to Annex I, Annex II, size, and special cases.
shall be considered to be essential entities
Provides the SME size thresholds referenced by NIS2 Article 2 and Article 3.
annual turnover not exceeding EUR 50 million
Explains information collection for Member State lists of essential and important entities.
list of essential and important entities
The evidence should let a reviewer reconstruct the classification without guessing. Keep the legal entity name, establishment and service countries, business service description, Annex row, customer-facing service, size-cap data, special-case analysis, and final classification.
For size, keep the latest approved accounting-period data, , turnover excluding VAT and other indirect taxes, balance-sheet total, ownership and voting relationships, proportional partner data, and 100% of linked-enterprise data unless already consolidated. Under the Recommendation, crossing or falling below a ceiling normally changes SME status only when it occurs over two consecutive accounting periods, so keep both periods and document any case-specific calculation issue.
Article 3(4) guidance points to practical list data: entity name, address, contact details, email addresses, IP ranges, telephone numbers, relevant sector and subsector, and Member States where in-scope services are provided. Use that as an evidence model, then follow the applicable national mechanism.
Sources (3)
Source for information Member States should collect when establishing and updating essential and important entity lists.
name, address and up-to-date contact details
Article 3 requires Member States to establish and update lists of essential and important entities.
review and, where appropriate, update
Commission country transposition hub for national implementation context and authority follow-up.
implementation of the NIS2 Directive
Review this checklist before relying on a NIS2 sector classification in a control plan, registration response, customer answer, or board report.
Keep a narrow, cited classification that can be reassessed after changes in service scope, Member State implementation, or corporate size.
No. The Annex row identifies a covered type of entity, but Article 2 still requires medium-sized or larger status, a regardless-of-size path, critical-entity status, domain name registration services, or an applicable Member State choice or identification. The entity must also provide the service or carry out the activity in the Union.
Article 3 lists the essential-entity paths, including Annex I entities above the ceilings and several special categories. In-scope Annex I or Annex II entities that do not qualify as essential are treated as important entities.
Sources (3)
Primary legal source for the checklist's scope and classification steps.
entities of a type referred to in Annex I or II
Registration and entity-list template source for evidence fields.
template for the collection of that information
SME definition source for headcount, turnover, and balance-sheet evidence.
annual balance sheet total not exceeding EUR 43 million
Sorena can turn Annex I and Annex II scoping into cited entity classifications, evidence requests, registration data checks, and review triggers for NIS2 implementation work.
Ask questions tied to cited sources about Annex I and Annex II sectors, Article 2 scope, Article 3 classification, and registration evidence using the cited sources on this page.
Review your NIS2 sector scoping, entity classification, country registration questions, and evidence gaps with Sorena.
"measures for a high common level of cybersecurity"
"This Directive applies to public or private entities"
"SECTORS OF HIGH CRITICALITY"
"shall be considered to be essential entities"
"review and, where appropriate, update"
"entities of a type referred to in Annex I or II"
"list of essential and important entities"
"Sector of activity under Directive"
"name, address and up-to-date contact details"
"template for the collection of that information"
"employ fewer than 250 persons"
"annual turnover not exceeding EUR 50 million"
"annual balance sheet total not exceeding EUR 43 million"
"18 critical sectors across the EU"
"wider scope, clearer rules"
"implementation of the NIS2 Directive"
Stepwise NIS2 applicability test for Annex I and Annex II sectors, medium and large entities, size-independent cases, essential or important classification, jurisdiction, and evidence.
NIS2 compliance calendar for EU transposition, Article 3 and 27 registration updates, Article 23 incident reports, technical measures, and the 2027 review.
Build a NIS2 Article 21 control baseline from the Directive's minimum cybersecurity risk-management measures, proportionality test, supplier duties, and evidence expectations.
Map NIS2 Article 21 risk-management measures to evidence records for governance, incident handling, continuity, supply chain, testing, cyber hygiene, cryptography, access, assets, and authentication.
Assess NIS2 Article 21 cybersecurity risk-management gaps by mapping current controls to Article 21(2), ownership, evidence, supplier risk, and management review.
Map NIS2 Article 23 reporting duties for significant incidents: 24-hour early warning, 72-hour notification, intermediate reports, final report, recipients, and evidence.
This NIS2 compliance checklist helps confirm scope, entity classification, management-body duties, Article 21 controls, Article 23 reporting, and evidence.
A practical NIS2 compliance guide for mapping entity scope, Article 21 risk measures, Article 23 incident reporting, management accountability, and evidence records.
Build an operational NIS2 country matrix for applicable national law, competent authorities, registration, incident portals, local implementation deltas, evidence, and review dates.
Classify whether an EU service is out of scope, an important entity, an essential entity, or needs national-authority review under the NIS2 Directive.
Compare NIS2 essential and important entities by scope, Article 21 and 23 duties, Article 32 and 33 supervision, evidence, jurisdiction, and penalties.
Classify NIS2 essential and important entities using Article 3, Annex I and II sector scope, size-cap rules, registration evidence, and the Article 32/33 supervision split.
NIS2 FAQ on entity scope, essential and important classification, Article 21 measures, Article 23 reporting, national implementation, and evidence.
Triage a possible NIS2 significant incident by recording awareness time, severity, impact, authority route, recipient communications, and Article 23 reporting clocks.
Build a NIS2 Article 23 incident reporting workflow with significance triage, CSIRT or authority notification steps, recipient communication, cross-border checks, and evidence records.
A guide to NIS2 Article 20 management body accountability: approval of Article 21 measures, oversight, national liability rules, training, reporting lines, and evidence.
Track NIS2 national transposition with Commission country pages, Article 41 dates, reasoned-opinion flags, source wording, authority contacts, and legal review triggers.
NIS2 Article 34 fine levels, calculation factors, enforcement measures, GDPR overlap, and national-law checks for essential and important entities.
Map NIS2 Article 3 entity lists, Article 27 registry submissions, competent authorities, national filing routes, required data, and change-notification deadlines.
Map NIS2 requirements for essential and important entities: scope classification, management-body duties, Article 21 cybersecurity measures, Article 23 incident reporting, and evidence records.
Apply the NIS2 medium-size test, group-data rules, regardless-of-size cases, exclusions, and essential-versus-important classification.
Apply NIS2 Article 21 to direct suppliers and service providers, and distinguish its general duty from Regulation 2024/2690's digital-entity controls.
Compare NIS2 and the CER Directive using cited rows for scope, triggers, evidence, incident handling, supervision, and shared critical-entity work.
Compare NIS2 and DORA for EU cyber compliance: covered entities, when DORA replaces NIS2 duties for financial entities, incident reporting, evidence, and supervisory handoffs.
Compare NIS2 significant-incident reporting with GDPR personal-data-breach reporting, including scope, 24-hour and 72-hour clocks, evidence, and overlap.
Compare NIS2 legal obligations with ISO/IEC 27001 ISMS requirements: scope, Article 21 controls, incident clocks, SoA evidence, audits, and certification reuse.
Compare NIS2 legal obligations with ISO/IEC 27017 cloud-service controls: entity scope, Article 21 measures, incident clocks, shared responsibility, evidence, and assurance limits.
Compare NIS2 with the repealed NIS1 Directive: expanded sectors, essential and important entities, management-body duties, Article 21 controls, Article 23 reporting, and supervision.
NIS2 scope answer for managed service providers and managed security service providers, including service definition, size-cap checks, entity status, and jurisdiction evidence.
Under NIS2 Article 23, covered essential and important entities submit an early warning within 24 hours of becoming aware of a significant incident.
NIS2 incident-notification deadline, required initial assessment, evidence, follow-up, and the 24-hour trust-service-provider exception.
Plain-English FAQ comparing NIS2 essential entities and important entities, with Article 3 classification rules, shared Article 21 and 23 duties, supervision differences, and evidence to keep.
How to handle NIS2 Member State transposition: use Article 41 as the EU baseline, then verify national law, authority routing, registration, and incident-reporting details.
Plain-language FAQ on the NIS2 size-cap rule: medium and large Annex I or II entities, SME thresholds, regardless-of-size exceptions, and evidence to keep.