We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Classifier WorkflowEU NIS2

NIS2 entity classifier workflow

Decide whether a legal entity and service line is out of scope, an important entity, an , or an escalation case under NIS2.

Use the directive text, and sector lists, SME size rules, Article 3 category rules, and registration guidance before assigning security, reporting, or evidence work.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
4 sections4 primary sources
Overview

Classify one legal entity and one service or activity at a time. An in-scope entity above the medium-sized enterprise ceilings, or an entity that meets another Article 3(1) route, is an . Other in-scope Annex I or entities are generally important unless a Member State identification changes the result. This workflow separates those scope and classification facts from the later work of implementing cybersecurity risk-management measures and incident reporting.

Section 1

Classifier goal: record the NIS2 scope decision before control work starts

The first output is a classification record for one legal entity and one service or activity. Do not classify a whole group, brand, platform, or supplier relationship unless the legal entity, EU presence, service, and sector facts are the same.

A useful record answers four questions: whether the entity provides services or carries out activities in the Union, whether its type appears in or , whether a size or regardless-of-size rule applies, and whether Article 3 makes the entity essential or important. Also record exclusions for national security, public security, defence, and law-enforcement public bodies, and any equivalent sector-specific Union act that displaces NIS2 requirements for the same activity.

  • Decision states: out of scope, important entity, , or national-authority review required.
  • Minimum inputs: legal entity name, establishment or representative, Member States served, service description, sector and subsector, size evidence, and any critical-entity or public-administration status.
  • Classify service lines separately when one activity maps to , another maps to , or only part of the business is covered.
  • Keep national transposition notes beside the EU decision because Member States establish and update their lists of essential and important entities.
Section 2

Step-by-step NIS2 classifier workflow

Run the classifier in the same order each time. The workflow should first prove that the activity is the kind of entity NIS2 covers, then decide whether an essential-entity rule applies, and only then assign implementation owners.

Use the Commission Article 3 guidance and template fields to make the record reusable for national registration, customer assurance, management review, and authority questions.

  • 1. Identify the legal entity, main EU establishment or representative, countries served, and the precise service or activity being classified.
  • 2. Match the service to , , domain-name registration services, or no listed category; record the sector, subsector, and type of entity.
  • 3. Check the baseline Article 2 size rule: medium-sized enterprises and entities exceeding the medium-sized ceilings are in scope when they are an or entity type and provide services or carry out activities in the Union. A medium-sized enterprise does not qualify as small or micro under the lower ceilings, employs fewer than 250 people, and has annual turnover not exceeding EUR 50 million or an annual balance-sheet total not exceeding EUR 43 million; apply the Recommendation's partner and linked-enterprise data rules, while noting that NIS2 disapplies Article 3(4) of the Recommendation.
  • 4. Check regardless-of-size triggers, including public electronic communications networks or services, trust service providers, TLD registries, DNS service providers, domain-name registration services, critical entities, and Member State Article 2(2) designations.
  • 5. Apply Article 3: entities above the medium-sized ceilings and the named Article 3(1) categories are essential; covered Annex I or entities that do not qualify as essential are important.
  • 6. Check exclusions, equivalent sector-specific Union rules under Article 4, and Member State designations or extensions before closing the result.
  • 7. Save the decision, source citations, authority or national-law assumptions, owner approvals, and the next review trigger.
Section 3

Evidence table for the classification record

The classifier is only defensible if each decision point has evidence. Keep the table short, but make it specific enough that another reviewer can repeat the classification without asking the business team to reconstruct the facts.

Where national law, authority registration, or a Member State designation affects the answer, label the result as conditional until the country owner confirms the local rule.

  • Legal entity evidence: registered name, address, main EU establishment or representative, and any group relationship that affects SME sizing.
  • Service evidence: customer-facing service description, country coverage, systems supporting the service, and whether the activity is principal or incidental where the Annex wording requires it.
  • Sector evidence: or row, sector, subsector, type of entity, and any reason an adjacent sector was rejected.
  • Size evidence: staff calculated as annual work units, annual turnover and balance-sheet data, reference periods, and the partner or linked-enterprise aggregation applied.
  • Authority evidence: registration submission fields, local authority correspondence, Member State designation, critical-entity status, and date of the next review.
Section 4

Quality checks before closing the classifier

Close the workflow only when the legal entity, service description, sector mapping, size evidence, regardless-of-size checks, exclusions, Article 3 result, and national assumptions point to the same conclusion. Inclusion on a Member State list is important evidence, but the classification record should still retain the facts and legal route behind the result.

Reopen the classifier when a new country is served, a service changes, ownership or group sizing changes, an entity is designated by a Member State, a critical-entity decision changes, or the relevant national register asks for updated information.

Does being a small enterprise always place an organisation outside NIS2?

No. The baseline rule generally captures medium-sized and larger or entity types, but Article 2 contains regardless-of-size routes. These include specified communications, trust, DNS and TLD providers, domain name registration services, critical entities, sole providers of an essential service in a Member State, entities whose disruption could create specified public or systemic impacts, and certain public administrations or Member State designations.

Is every in-scope entity an ?

No. An entity that meets the baseline medium-sized threshold but does not exceed the medium-sized ceilings is generally important unless another Article 3(1) rule makes it essential. Annex I entities above those ceilings are essential, as are the other categories specifically listed in Article 3(1). National identification can also affect the result.

  • The record names the exact or row used, or explains why no listed category fits.
  • The size calculation records staff and financial data, the reference period, partner or linked-enterprise adjustments, and the NIS2 exception to Recommendation Article 3(4).
  • The record distinguishes essential and important entity logic instead of using one generic in-scope label.
  • The record separates EU directive logic from Member State transposition or authority-registration assumptions.
  • The final decision assigns owners for legal review, country confirmation, security implementation, incident reporting setup, and evidence storage.
Recommended next step

Review this classifier before assigning NIS2 controls

Sorena can help convert a NIS2 scope question into a cited decision record with sector mapping, size evidence, national assumptions, owner assignments, and review triggers.

Research workflow
Open Research Copilot for NIS2

Ask questions tied to cited sources about Annex I and II sectors, Article 3 classification, registration evidence, and country-specific follow-up.

Explore next step
Talk to Sorena
Talk through implementation

Review your NIS2 classification record, evidence gaps, and next implementation steps with Sorena.

Explore next step
Primary sources

References and citations

Directive (EU) 2022/2555 (NIS2)
eur-lex.europa.eu5 citations
Referenced sections
  • Primary directive text for NIS2 scope, essential and important entity classification, registration information, and Annex I and II sectors.
  • Primary directive text for NIS2 scope, Article 3 entity categories, registration information, and Annex I and II sectors.
  • Article 2 and Article 3 provide the scope and essential-versus-important classification rules.
Show 2 more
  • Requires Member States to establish and regularly update lists of essential and important entities and domain-name registration service entities.
  • Primary source for NIS2 classification logic and later security and reporting obligations once an entity is in scope.
"Essential and important entities"
More quoted passages
"entities of a type referred to in Annex I or II"
"at least every two years thereafter"
"cybersecurity risk-management measures and reporting obligations"
Commission Guidelines on NIS2 Article 3(4)
eur-lex.europa.eu4 citations
Referenced sections
  • Commission guidance and template context for Member State lists of essential and important entities.
  • Commission guidance and template fields for establishing lists of essential and important entities.
  • Lists the information Member States should require for entity lists, including name, address, contacts, IP ranges, sector, subsector, and Member States served.
Show 1 more
  • Commission source for registration templates and Member State list-maintenance evidence.
"guidelines and templates"
More quoted passages
"the name, address and up-to-date contact details"
"national mechanisms for entities to register themselves"
Commission Recommendation 2003/361/EC on SME definitions
eur-lex.europa.eu4 citations
Referenced sections
  • Referenced SME definition used to assess medium-sized status and the size-cap rule in NIS2.
  • Referenced SME definition used by NIS2 for the medium-sized enterprise size-cap rule.
  • Source for the staff, turnover, and balance-sheet thresholds referenced by the NIS2 size-cap rule.
Show 1 more
  • Defines SME categories and explains staff headcount and financial ceiling evidence used in the NIS2 size check.
"fewer than 250 persons"
More quoted passages
"annual turnover not exceeding EUR 50 million"
"staff headcount criterion"
European Commission - NIS2 Directive FAQs
digital-strategy.ec.europa.eu3 citations
Referenced sections
  • Commission public FAQ explaining NIS2 background, scope expansion, and cybersecurity policy context.
  • Commission public explanation of the NIS2 Directive, policy background, and practical context for affected organisations.
  • Commission FAQ context for why NIS2 expands coverage and strengthens cybersecurity requirements across the EU.
"high common level of cybersecurity"
More quoted passages
"boost the overall level of cybersecurity"

Related guides

EU NIS2 Directive applicability test for entity scope

Stepwise NIS2 applicability test for Annex I and Annex II sectors, medium and large entities, size-independent cases, essential or important classification, jurisdiction, and evidence.

EU NIS2 Directive deadlines and compliance calendar | Article 23 clocks

NIS2 compliance calendar for EU transposition, Article 3 and 27 registration updates, Article 23 incident reports, technical measures, and the 2027 review.

NIS2 Annex I and Annex II Sector Scoping Guide

Map NIS2 Annex I and Annex II sectors, entity types, size-cap rules, and essential versus important entity classification with official EU sources.

NIS2 Article 21 control baseline and evidence checklist

Build a NIS2 Article 21 control baseline from the Directive's minimum cybersecurity risk-management measures, proportionality test, supplier duties, and evidence expectations.

NIS2 Article 21 control-by-control evidence checklist

Map NIS2 Article 21 risk-management measures to evidence records for governance, incident handling, continuity, supply chain, testing, cyber hygiene, cryptography, access, assets, and authentication.

NIS2 Article 21 Gap Assessment Workflow: controls, evidence, and owners

Assess NIS2 Article 21 cybersecurity risk-management gaps by mapping current controls to Article 21(2), ownership, evidence, supplier risk, and management review.

Show all related guides (34)

NIS2 Article 23 incident notification workflow

Map NIS2 Article 23 reporting duties for significant incidents: 24-hour early warning, 72-hour notification, intermediate reports, final report, recipients, and evidence.

NIS2 Compliance Checklist: scope, controls, reporting

This NIS2 compliance checklist helps confirm scope, entity classification, management-body duties, Article 21 controls, Article 23 reporting, and evidence.

NIS2 Compliance Guide: scope, controls, reporting, and evidence

A practical NIS2 compliance guide for mapping entity scope, Article 21 risk measures, Article 23 incident reporting, management accountability, and evidence records.

NIS2 Country Implementation Matrix: Authorities, Portals, and Local Deltas

Build an operational NIS2 country matrix for applicable national law, competent authorities, registration, incident portals, local implementation deltas, evidence, and review dates.

NIS2 entity supervision guide

Compare NIS2 essential and important entities by scope, Article 21 and 23 duties, Article 32 and 33 supervision, evidence, jurisdiction, and penalties.

NIS2 essential vs important entities: Article 3 scope and supervision guide

Classify NIS2 essential and important entities using Article 3, Annex I and II sector scope, size-cap rules, registration evidence, and the Article 32/33 supervision split.

NIS2 FAQ: scope, Article 21 controls, incident reporting, and penalties

NIS2 FAQ on entity scope, essential and important classification, Article 21 measures, Article 23 reporting, national implementation, and evidence.

NIS2 incident clock triage workflow

Triage a possible NIS2 significant incident by recording awareness time, severity, impact, authority route, recipient communications, and Article 23 reporting clocks.

NIS2 Incident Reporting Workflow: 24-hour, 72-hour, and final report steps

Build a NIS2 Article 23 incident reporting workflow with significance triage, CSIRT or authority notification steps, recipient communication, cross-border checks, and evidence records.

NIS2 Management Body Accountability: board duties, training, and evidence

A guide to NIS2 Article 20 management body accountability: approval of Article 21 measures, oversight, national liability rules, training, reporting lines, and evidence.

NIS2 National Transposition Tracker: EU Member State Evidence Register

Track NIS2 national transposition with Commission country pages, Article 41 dates, reasoned-opinion flags, source wording, authority contacts, and legal review triggers.

NIS2 penalties and fines: Article 34 maximum levels and factors

NIS2 Article 34 fine levels, calculation factors, enforcement measures, GDPR overlap, and national-law checks for essential and important entities.

NIS2 Registration and Authority Notification Guide

Map NIS2 Article 3 entity lists, Article 27 registry submissions, competent authorities, national filing routes, required data, and change-notification deadlines.

NIS2 Requirements: scope, Article 21 controls, reporting, and evidence

Map NIS2 requirements for essential and important entities: scope classification, management-body duties, Article 21 cybersecurity measures, Article 23 incident reporting, and evidence records.

NIS2 Size Cap Rule and Special Scope Cases

Apply the NIS2 medium-size test, group-data rules, regardless-of-size cases, exclusions, and essential-versus-important classification.

NIS2 Supply Chain Security Program: Article 21 Guide

Apply NIS2 Article 21 to direct suppliers and service providers, and distinguish its general duty from Regulation 2024/2690's digital-entity controls.

NIS2 vs CER Directive comparison: cyber obligations and critical-entity resilience

Compare NIS2 and the CER Directive using cited rows for scope, triggers, evidence, incident handling, supervision, and shared critical-entity work.

NIS2 vs DORA: scope, overlap, and evidence for EU cyber compliance

Compare NIS2 and DORA for EU cyber compliance: covered entities, when DORA replaces NIS2 duties for financial entities, incident reporting, evidence, and supervisory handoffs.

NIS2 vs GDPR breach reporting: EU deadlines and overlap

Compare NIS2 significant-incident reporting with GDPR personal-data-breach reporting, including scope, 24-hour and 72-hour clocks, evidence, and overlap.

NIS2 vs ISO/IEC 27001: legal duties, ISMS evidence, and reuse limits

Compare NIS2 legal obligations with ISO/IEC 27001 ISMS requirements: scope, Article 21 controls, incident clocks, SoA evidence, audits, and certification reuse.

NIS2 vs ISO/IEC 27017: legal duties, cloud controls, and reuse limits

Compare NIS2 legal obligations with ISO/IEC 27017 cloud-service controls: entity scope, Article 21 measures, incident clocks, shared responsibility, evidence, and assurance limits.

NIS2 vs NIS1: what changed in EU cybersecurity compliance

Compare NIS2 with the repealed NIS1 Directive: expanded sectors, essential and important entities, management-body duties, Article 21 controls, Article 23 reporting, and supervision.

Are managed service providers in scope of NIS2?

NIS2 scope answer for managed service providers and managed security service providers, including service definition, size-cap checks, entity status, and jurisdiction evidence.

NIS2 24-hour early warning: what to send and when

Under NIS2 Article 23, covered essential and important entities submit an early warning within 24 hours of becoming aware of a significant incident.

NIS2 72-hour incident notification FAQ

NIS2 incident-notification deadline, required initial assessment, evidence, follow-up, and the 24-hour trust-service-provider exception.

NIS2 entity classification FAQ

Plain-English FAQ comparing NIS2 essential entities and important entities, with Article 3 classification rules, shared Article 21 and 23 duties, supervision differences, and evidence to keep.

NIS2 Member State Transposition: What Teams Must Check

How to handle NIS2 Member State transposition: use Article 41 as the EU baseline, then verify national law, authority routing, registration, and incident-reporting details.

NIS2 size-cap rule: when medium and large entities are in scope

Plain-language FAQ on the NIS2 size-cap rule: medium and large Annex I or II entities, SME thresholds, regardless-of-size exceptions, and evidence to keep.