NIS2 essential vs important entities What changes in classification, supervision, and evidence
Essential and both carry NIS2 cybersecurity risk-management and significant-incident reporting duties. The practical distinction is how Article 3 classifies the entity and how national authorities supervise and enforce the tier.
Classify the entity, map the shared Article 21 and Article 23 obligations, and prepare evidence for regular, targeted, or ex post supervision.
Apply Article 2 scope first and Article 3 classification second. If Article 3(1) applies, the entity is essential; if an Annex I or Annex II entity is covered but does not qualify under Article 3(1), it is important under Article 3(2). Both tiers must meet the Articles 20, 21, and 23 governance, risk-management, and reporting duties. Articles 32 and 33 use different supervisory models.
Side-by-side comparison
NIS2 essential entities vs important entities
The same core NIS2 obligations apply to both tiers. Article 3 controls classification; Articles 32 and 33 set the different supervisory models.
Higher NIS2 tier for specified Annex I, critical, public administration, qualified trust, DNS, TLD, communications, and Member-State-designated entities under Article 3(1).
Second framework
Important entities
Covered Annex I or Annex II entities that do not qualify as , including specified Member-State-identified entities under Article 3(2).
are classified through Article 3(1): Annex I entities above the medium-enterprise ceilings, qualified trust service providers, TLD registries, DNS service providers, medium-sized or larger public communications providers, specified public administrations, CER critical entities, Member-State-identified essential entities, and preserved legacy operators.
are in scope through Article 3(2): covered Annex I or Annex II entities that do not qualify as under Article 3(1), including entities identified by Member States under the Article 2(2) special-risk grounds.
Article 3(2) defines important entities by reference to covered Annex I or II entities that are not essential.
shall be considered to be important entities
Keep the sector, subsector, entity type, size analysis, special-case analysis, and Member State activity in each legal entity's classification file. A corporate group can contain entities in different tiers.
Within an essential entity, the management body must approve and oversee cybersecurity risk-management measures and its members must follow training. Operational teams implement Article 21 controls, Article 23 incident reporting, and supplier-risk records.
Article 20 addresses management-body responsibilities for essential and important entities.
essential and important entities
carry the same management-body, Article 21, and Article 23 obligation chains. The actor structure is the same; the difference is the supervisory route the competent authority follows when reviewing compliance.
Articles 20, 21, and 23 apply to both essential and important entities.
essential and important entities
Assign Article 21 control ownership and Article 23 reporting ownership at the entity level, not at the tier level; both essential and need named owners for each obligation family.
Essential-entity status follows when an Article 3(1) limb applies: an Annex I entity exceeds the medium-enterprise ceilings, a named size-independent category applies, a communications provider is medium-sized or larger, a specified public-administration or critical-entity rule applies, or a Member State identification or preserved legacy rule applies.
Article 3(1) trigger conditions for essential entities.
regardless of their size
Important-entity status follows when an Annex I or Annex II entity is covered but does not meet Article 3(1). Many medium-sized Annex I entities are important, but named categories such as medium-sized public communications providers and qualified trust, TLD, and DNS providers follow the essential rules instead.
Run the essential-entity test first; important-entity status is not a separate opt-in but is the result of being in scope without satisfying Article 3(1).
Articles 20, 21, and 23 apply to essential and important entities.
essential and important entities
Do not split the control baseline into strong and weak versions only because of the entity tier; calibrate proportionality to risk, size, likelihood, severity, and impact.
Keep the Article 3 classification memo, Annex I or II mapping, size and special-case analysis, Article 21 control evidence, Article 23 incident files, management approvals, supplier-risk records, and authority correspondence.
Article 32 allows requests for information, documents, and evidence of policy implementation for essential entities.
requests for evidence
Keep the same evidence families, with clear labels showing why the entity is important rather than essential and where ex post review evidence would be found.
should maintain current evidence because Article 32 allows regular and targeted supervision, including random checks, audits, security scans, information requests, document access, and implementation-evidence requests.
Article 32 authorises proactive supervisory actions including random checks and regular audits.
off-site supervision
also need current evidence of ongoing compliance. Article 33 supervision is ex post: competent authorities act when they receive evidence, an indication, or information that an important entity allegedly does not comply.
Article 33 frames important-entity supervision around ex post action.
ex post supervisory measures
Keep Article 21 control evidence current for both tiers and tag it with the review date, owner, and change trigger. The ex post model changes when supervision begins, not when the underlying duty starts.
Essential-entity enforcement can include warnings, binding instructions, orders, monitoring officers, publication orders, administrative fines, and temporary suspension or management-function prohibition routes where specified measures are ineffective.
Article 32(4) and 32(5) list enforcement measures for essential entities.
monitoring officer
Important-entity enforcement can include warnings, binding instructions, orders, audit recommendations, publication orders, and administrative fines, with Article 32 procedural safeguards applying with the necessary adjustments.
can use Article 21 controls and Article 23 incident-notification records as shared evidence, reusing the same cybersecurity baseline and incident playbook across both obligation families where the cited requirement is identical.
Article 21 proportionality applies to both tiers, supporting a shared control baseline.
appropriate and proportionate
can use the same Article 21 control baseline and Article 23 incident-notification workflow as , adjusting only for proportionality and the ex post supervisory posture rather than creating a separate weaker programme.
Articles 21 and 23 duties are the same for both essential and important entities.
essential and important entities take appropriate
Document the control-reuse rationale explicitly when the same measure satisfies multiple Article 21 points or supports both tiers, so the scope decision and the control evidence can be reviewed independently.
The final answer should say: covered sector, size or special case, Article 3 tier, Member State authority route, Article 21 evidence owner, and Article 23 incident-reporting owner.
Articles 3, 21, 23, 32, and 33 provide the classification and operations path.
Articles 21 and 23
Scope and covered activity
Essential entities
are classified through Article 3(1): Annex I entities above the medium-enterprise ceilings, qualified trust service providers, TLD registries, DNS service providers, medium-sized or larger public communications providers, specified public administrations, CER critical entities, Member-State-identified essential entities, and preserved legacy operators.
are in scope through Article 3(2): covered Annex I or Annex II entities that do not qualify as under Article 3(1), including entities identified by Member States under the Article 2(2) special-risk grounds.
Article 3(2) defines important entities by reference to covered Annex I or II entities that are not essential.
shall be considered to be important entities
Operational implication
Keep the sector, subsector, entity type, size analysis, special-case analysis, and Member State activity in each legal entity's classification file. A corporate group can contain entities in different tiers.
Commission overview of the wider sector scope and two-tier classification.
wider scope, clearer rules and stronger supervision tools
Who must act
Essential entities
Within an essential entity, the management body must approve and oversee cybersecurity risk-management measures and its members must follow training. Operational teams implement Article 21 controls, Article 23 incident reporting, and supplier-risk records.
Article 20 addresses management-body responsibilities for essential and important entities.
essential and important entities
Important entities
carry the same management-body, Article 21, and Article 23 obligation chains. The actor structure is the same; the difference is the supervisory route the competent authority follows when reviewing compliance.
Articles 20, 21, and 23 apply to both essential and important entities.
essential and important entities
Operational implication
Assign Article 21 control ownership and Article 23 reporting ownership at the entity level, not at the tier level; both essential and need named owners for each obligation family.
Commission overview of management accountability under NIS2.
accountability of the top management
Trigger or threshold
Essential entities
Essential-entity status follows when an Article 3(1) limb applies: an Annex I entity exceeds the medium-enterprise ceilings, a named size-independent category applies, a communications provider is medium-sized or larger, a specified public-administration or critical-entity rule applies, or a Member State identification or preserved legacy rule applies.
Article 3(1) trigger conditions for essential entities.
regardless of their size
Important entities
Important-entity status follows when an Annex I or Annex II entity is covered but does not meet Article 3(1). Many medium-sized Annex I entities are important, but named categories such as medium-sized public communications providers and qualified trust, TLD, and DNS providers follow the essential rules instead.
Run the essential-entity test first; important-entity status is not a separate opt-in but is the result of being in scope without satisfying Article 3(1).
Articles 20, 21, and 23 apply to essential and important entities.
essential and important entities
Operational implication
Do not split the control baseline into strong and weak versions only because of the entity tier; calibrate proportionality to risk, size, likelihood, severity, and impact.
Article 21 uses proportionality factors for risk-management measures.
appropriate and proportionate
Evidence to keep
Essential entities
Keep the Article 3 classification memo, Annex I or II mapping, size and special-case analysis, Article 21 control evidence, Article 23 incident files, management approvals, supplier-risk records, and authority correspondence.
Article 32 allows requests for information, documents, and evidence of policy implementation for essential entities.
requests for evidence
Important entities
Keep the same evidence families, with clear labels showing why the entity is important rather than essential and where ex post review evidence would be found.
Articles 21, 23, 32, and 33 define the evidence a reviewer may need to reconstruct.
cybersecurity risk-management measures
Timing and cadence
Essential entities
should maintain current evidence because Article 32 allows regular and targeted supervision, including random checks, audits, security scans, information requests, document access, and implementation-evidence requests.
Article 32 authorises proactive supervisory actions including random checks and regular audits.
off-site supervision
Important entities
also need current evidence of ongoing compliance. Article 33 supervision is ex post: competent authorities act when they receive evidence, an indication, or information that an important entity allegedly does not comply.
Article 33 frames important-entity supervision around ex post action.
ex post supervisory measures
Operational implication
Keep Article 21 control evidence current for both tiers and tag it with the review date, owner, and change trigger. The ex post model changes when supervision begins, not when the underlying duty starts.
Articles 32 and 33 distinguish the supervisory cadence between tiers.
Supervisory and enforcement measures
Enforcement exposure
Essential entities
Essential-entity enforcement can include warnings, binding instructions, orders, monitoring officers, publication orders, administrative fines, and temporary suspension or management-function prohibition routes where specified measures are ineffective.
Article 32(4) and 32(5) list enforcement measures for essential entities.
monitoring officer
Important entities
Important-entity enforcement can include warnings, binding instructions, orders, audit recommendations, publication orders, and administrative fines, with Article 32 procedural safeguards applying with the necessary adjustments.
Articles 32 and 33 set tier-specific enforcement powers.
effective, proportionate and dissuasive
Overlap and reuse
Essential entities
can use Article 21 controls and Article 23 incident-notification records as shared evidence, reusing the same cybersecurity baseline and incident playbook across both obligation families where the cited requirement is identical.
Article 21 proportionality applies to both tiers, supporting a shared control baseline.
appropriate and proportionate
Important entities
can use the same Article 21 control baseline and Article 23 incident-notification workflow as , adjusting only for proportionality and the ex post supervisory posture rather than creating a separate weaker programme.
Articles 21 and 23 duties are the same for both essential and important entities.
essential and important entities take appropriate
Operational implication
Document the control-reuse rationale explicitly when the same measure satisfies multiple Article 21 points or supports both tiers, so the scope decision and the control evidence can be reviewed independently.
The final answer should say: covered sector, size or special case, Article 3 tier, Member State authority route, Article 21 evidence owner, and Article 23 incident-reporting owner.
Commission overview for sector scope, reporting, supervision, enforcement, and management accountability.
critical sectors
Search this module
Find a question or answer quickly
3 of 3 questions
Question 1
What is the difference between NIS2 essential and important entities?
include Annex I entities that exceed the Recommendation 2003/361/EC ceilings for medium-sized enterprises; qualified trust service providers, TLD registries, and DNS service providers regardless of size; medium-sized or larger providers of public electronic communications networks or publicly available electronic communications services; covered central-government public administrations; critical entities under Directive (EU) 2022/2557; entities identified by a Member State as essential under Article 2(2)(b) to (e); and legacy operators where national law preserves that status.
are covered Annex I or Annex II entities that do not qualify as under Article 3(1), including entities that Member States identify under the specified Article 2(2) special-risk grounds. They are still in scope and still need cybersecurity risk-management, management-body oversight, and significant-incident reporting.
Run the Article 3(1) essential-entity test first.
If the entity is covered by Annex I or Annex II but does not meet Article 3(1), treat it as important under Article 3(2).
Do not use the word important to mean optional or low priority.
Check national transposition and any identification decision. Member States establish and update entity lists, but list administration does not replace the Article 2 and Article 3 legal analysis.
Are NIS2 exempt from Article 21 controls or Article 23 reporting?
No. NIS2 applies Article 21 cybersecurity risk-management measures and Article 23 significant-incident reporting to essential and . The main tier difference is classification and supervision, not whether the core obligations exist.
Commission overview explaining the wider NIS2 sector scope, reporting duties, supervision, enforcement, and management accountability.
wider scope, clearer rules and stronger supervision tools
Question 2
What obligations are the same for both tiers?
Both essential and need management-body involvement. NIS2 requires management bodies to approve cybersecurity risk-management measures and oversee implementation, while their members must follow training, with Member States deciding the national liability framework.
Both tiers also need appropriate and proportionate technical, operational, and organisational measures under Article 21. The listed measures cover risk analysis and security policies, incident handling, business continuity, supply-chain security, secure acquisition and maintenance, control effectiveness, cyber hygiene, cryptography, access control and asset management, and authentication or secure communications where appropriate.
For significant incidents, both tiers follow Article 23 notification duties, including the 24-hour early warning, 72-hour incident notification, status updates on request, and final reporting route. A trust service provider must send the incident notification within 24 hours when the significant incident affects its trust services.
Keep one shared Article 21 control map, but tag which legal entity and tier it supports.
Keep one incident-notification playbook, but confirm the national CSIRT or competent authority route for each Member State.
Keep management approvals, training evidence, and supplier-risk records with the classification memo.
Use the Commission implementing regulation where it applies to covered digital and trust-service entities.
Technical and methodological requirements for specified digital infrastructure, digital provider, managed service, managed security service, and trust-service entities.
technical and methodological requirements
Question 3
What changes in supervision and enforcement?
Article 32 permits both regular and targeted supervision of , including on-site inspections, off-site supervision, random checks, regular and targeted audits, ad hoc audits, security scans, information requests, document access, and evidence requests. Essential-entity enforcement can also include a monitoring officer and, where specified measures are ineffective, temporary suspension or temporary management-function prohibition routes under national law.
are mainly supervised reactively (ex post). Article 33 says competent authorities act when they have evidence, indication, or information that an important entity allegedly does not comply, especially with Articles 21 and 23. Ex post tools still include inspections, targeted audits, scans, information requests, document access, evidence requests, warnings, binding instructions, orders, and fines.
The Directive-level minimums for maximum fines differ for Article 21 or 23 infringements. Article 34 requires national maximum fines for of at least EUR 10 million or 2 percent of the total worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs, and for of at least EUR 7 million or 1.4 percent, whichever is higher in each tier. National law controls the authority, procedure, and final fine rules.
Keep essential-entity evidence ready for Article 32 regular or targeted supervisory requests.
Keep important-entity evidence current as part of ongoing compliance and ready for Article 33 ex post review after evidence or indications of alleged non-compliance emerge.
Do not treat important-entity status as low enforcement exposure.
Confirm national law before quoting final procedure, authority, remedy, or fine details to a customer or board.
Binding source for Article 32 essential-entity supervision, Article 33 important-entity supervision, and Article 34 administrative fine conditions.
ex post supervisory measures
Recommended next step
Record the NIS2 tier and supervisory model
Sorena can help convert the Article 3 tier decision into owner assignments, Article 21 evidence requests, Article 23 incident-reporting steps, and national-supervision readiness checks.
Technical and methodological requirements for Article 21 measures and significant-incident criteria for specified digital and trust-service entities.
Technical and methodological requirements for specified digital infrastructure, digital provider, managed service, managed security service, and trust-service entities.
Implementing Regulation applies the same technical measures to specified digital entities in both tiers.