Decide whether an entity belongs in a NIS2 Annex I or Annex II sector, then classify it as essential, important, or out of scope.
Use the Directive, Commission Article 3(4) guidance, and the SME recommendation to record the sector, subsector, entity type, size-cap analysis, Member State registration facts, and reassessment trigger.
Structured answer sets in this page tree.
Cited legal and guidance references.
NIS2 sector scoping starts with Article 2 and the Annex I and Annex II tables. The practical question is not simply whether a company works in a critical industry. Teams need to identify the exact sector, subsector, and type of entity, test the size-cap rule and special cases, then decide whether Article 3 treats the entity as essential or important.
A useful scoping record should answer four questions: which Annex I or Annex II row applies, whether the entity meets the Article 2 scope rule, whether any regardless-of-size or Member State identification rule applies, and whether Article 3 classifies the entity as essential or important.
Do not treat the Annex labels as broad industry tags. Annex I and Annex II name specific types of entities, and several rows include exclusions or references to other EU definitions. Record the exact row used and the facts that support it.
Annex I covers sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management for business-to-business services, public administration, and space.
Annex II covers other critical sectors: postal and courier services, waste management, manufacture, production and distribution of chemicals, production, processing and distribution of food, specified manufacturing activities, digital providers, and research organisations.
Article 3 treats some entities as essential and leaves the remaining in-scope Annex I or Annex II entities as important. Annex I entities that exceed the medium-sized enterprise ceilings are essential. Qualified trust service providers, top-level domain name registries, and DNS service providers are essential regardless of size.
Other Article 3 essential-entity paths include medium-sized public electronic communications network or service providers, central-government public administration entities, Member State identification under Article 2(2)(b) to (e), entities identified as critical entities under Directive (EU) 2022/2557, and, if a Member State provides for it, former operators of essential services identified before 16 January 2023.
The evidence should let a reviewer reconstruct the classification without guessing. Keep the legal entity name, establishment and service countries, business service description, Annex row, customer-facing service, size-cap data, special-case analysis, and final classification.
Article 3(4) guidance points to practical registration data: entity name, address, contact details, email addresses, IP ranges, telephone numbers, relevant sector and subsector, and Member States where in-scope services are provided. Use that list as a minimum evidence model even when the local registration process asks for more.
Use this checklist before relying on a NIS2 sector classification in a control plan, registration response, customer answer, or board report.
The goal is a narrow, source-linked classification that survives later changes in service scope, Member State implementation, and corporate size.
No. Article 2 still requires the entity to meet the size-cap rule or a specific regardless-of-size or Member State identification path. The Annex row identifies the sector and type of entity; it does not complete the scope analysis by itself.
Article 3 lists the essential-entity paths, including Annex I entities above the medium-sized enterprise ceilings and several special categories. In-scope Annex I or Annex II entities that do not qualify as essential are treated as important entities.
Sorena can turn Annex I and Annex II scoping into cited entity classifications, evidence requests, registration data checks, and review triggers for NIS2 implementation work.
Ask source-linked questions about Annex I and Annex II sectors, Article 2 scope, Article 3 classification, and registration evidence using the cited sources on this page.
Review your NIS2 sector scoping, entity classification, country registration questions, and evidence gaps with Sorena.
"template for the collection of that information"
"annual balance sheet total not exceeding EUR 43 million"
"entities of a type referred to in Annex I or II"
"wider scope, clearer rules"
"implementation of the NIS2 Directive"