Decide whether an entity belongs in a NIS2 Annex I or Annex II sector, then classify it as essential, important, or out of scope.
Use the Directive, Commission Article 3(4) guidance, and the SME recommendation to record the sector, subsector, entity type, size-cap analysis, Member State registration facts, and reassessment trigger.
Structured answer sets in this page tree.
Cited legal and guidance references.
An industry label does not establish NIS2 scope. Match each service to the exact sector, subsector, and type-of-entity row in Annex I or II. Then calculate SME status, test size-independent and Member State identification paths, and apply Article 3 to classify the legal entity as essential or important.
The scoping record should answer four questions: which Annex I or Annex II row applies, whether the entity meets the Article 2 scope rule, whether any regardless-of-size or Member State identification rule applies, and whether Article 3 classifies the entity as essential or important.
Do not treat the Annex labels as broad industry tags. Annex I and Annex II name specific types of entities, and several rows include exclusions or references to other EU definitions. Record the exact row used and the facts that support it.
Annex I covers sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management for business-to-business services, public administration, and space.
Annex II covers other critical sectors: postal and courier services; waste management where it is the undertaking's principal economic activity; specified chemical activities; food businesses engaged in wholesale distribution and industrial production or processing; listed manufacturing divisions; online marketplaces, online search engines, and social networking services platforms; and research organisations.
The rows are narrower than their headings. Examples include electricity suppliers and system operators rather than every energy-adjacent business; healthcare providers, EU reference laboratories, and entities carrying out medicinal-product research, development, or manufacturing rather than every health supplier; and manufacturers in the listed categories for medical devices, computers and electronics, electrical equipment, machinery, motor vehicles, and other transport equipment rather than manufacturing generally.
Article 3 treats some entities as essential and classifies the remaining in-scope Annex I or Annex II entities as important. Annex I entities that exceed the medium-sized-enterprise ceilings are essential. Qualified trust service providers, TLD registries, and DNS service providers are essential regardless of size.
Other Article 3 essential-entity paths include medium-sized public electronic communications network or service providers, central-government public administration entities, Member State identification under Article 2(2)(b) to (e), entities identified as critical entities under Directive (EU) 2022/2557, and, if a Member State provides for it, former operators of essential services identified before 16 January 2023.
The evidence should let a reviewer reconstruct the classification without guessing. Keep the legal entity name, establishment and service countries, business service description, Annex row, customer-facing service, size-cap data, special-case analysis, and final classification.
For size, keep the latest approved accounting-period data, annual work units, turnover excluding VAT and other indirect taxes, balance-sheet total, ownership and voting relationships, proportional partner data, and 100% of linked-enterprise data unless already consolidated. Under the Recommendation, crossing or falling below a ceiling normally changes SME status only when it occurs over two consecutive accounting periods, so keep both periods and document any case-specific calculation issue.
Article 3(4) guidance points to practical list data: entity name, address, contact details, email addresses, IP ranges, telephone numbers, relevant sector and subsector, and Member States where in-scope services are provided. Use that as an evidence model, then follow the applicable national mechanism.
Review this checklist before relying on a NIS2 sector classification in a control plan, registration response, customer answer, or board report.
Keep a narrow, cited classification that can be reassessed after changes in service scope, Member State implementation, or corporate size.
No. The Annex row identifies a covered type of entity, but Article 2 still requires medium-sized or larger status, a regardless-of-size path, critical-entity status, domain name registration services, or an applicable Member State choice or identification. The entity must also provide the service or carry out the activity in the Union.
Article 3 lists the essential-entity paths, including Annex I entities above the ceilings and several special categories. In-scope Annex I or Annex II entities that do not qualify as essential are treated as important entities.
Sorena can turn Annex I and Annex II scoping into cited entity classifications, evidence requests, registration data checks, and review triggers for NIS2 implementation work.
Ask questions tied to cited sources about Annex I and Annex II sectors, Article 2 scope, Article 3 classification, and registration evidence using the cited sources on this page.
Review your NIS2 sector scoping, entity classification, country registration questions, and evidence gaps with Sorena.
"template for the collection of that information"
"annual balance sheet total not exceeding EUR 43 million"
"entities of a type referred to in Annex I or II"
"wider scope, clearer rules"
"implementation of the NIS2 Directive"