Classify NIS2 entities with the Article 3 tier rules, Annex I and II sector checks, size-cap evidence, Member State designations, and registration facts.
Use the comparison to avoid a common mistake: important entities still carry Article 21 risk-management and Article 23 reporting duties, even though their supervision is generally ex post.
NIS2 uses essential and important as legal entity tiers, not informal severity labels. First decide whether the entity is in scope under Article 2, including the medium-size gate and the regardless-of-size cases. Then apply Article 3: an meets an Article 3(1) route, while an is another covered Annex I or Annex II entity classified under Article 3(2). Both tiers share the Article 21 and Article 23 duties; their main EU-level difference is the supervision model.
Side-by-side scope test
NIS2 essential entities vs important entities
This comparison helps classify the entity tier, assign evidence, and understand which obligations are shared and which supervision expectations differ.
Essential entities are the higher NIS2 tier under Article 3(1), usually tied to large Annex I entities, size-independent critical digital actors, certain public administration entities, critical entities, or Member State identification.
Second framework
Important entities
Important entities are covered NIS2 entities under Article 3(2) that do not qualify as essential entities, including Annex I or Annex II entities and some Member State-identified entities.
Essential entities are classified under Article 3(1): Annex I entities above the medium-enterprise ceilings, size-independent actors such as TLD registries, DNS service providers, and qualified trust service providers, medium-sized or larger public electronic communications providers, central-government public administration entities, CER critical entities, Member-State-designated essential entities, and preserved legacy operators where national law provides.
Binding source for the Article 3(1) essential-entity criteria.
the following entities shall be considered to be essential entities
Important entities are in scope under Article 3(2): covered Annex I or Annex II entities that do not qualify as essential entities, including medium-sized Annex I entities and Annex II entities not already in the essential tier, plus entities Member States identify under Article 2(2)(b) to (e) special-risk criteria.
Essential entities and their management bodies must prepare for proactive supervision and keep evidence ready for competent authority review under Article 32, including management approval of risk measures and training. Competent authorities can also act before a problem is identified.
Binding source for management-body responsibility for essential entities.
members of the management bodies of essential and important entities
Important entities and their management bodies must still implement the Article 21 and Article 23 duties, but the competent authorities generally act only after evidence, indication, or information suggests non-compliance under Article 33.
Binding source for management-body responsibility for important entities.
essential and important entities
Assign the management-body accountability, Article 21 control owner, and Article 23 incident-reporting owner at the entity level before deciding how the national authority interaction differs between tiers.
Essential-entity status is triggered by meeting any one of the Article 3(1) criteria: exceeding the medium-sized enterprise threshold in an Annex I sector as a large entity, being a size-independent critical digital actor, public administration entity, CER critical entity, or Member-State-identified .
Binding source for size-dependent and size-independent essential-entity categories.
regardless of their size
Important-entity status is triggered by being in scope under Article 2 but not meeting an Article 3(1) criterion. This generally includes medium-sized Annex I and medium-sized-or-larger Annex II entities that are not essential, plus entities identified under Article 2(2)(b) to (e). A small Annex II entity is not automatically important.
Binding source for important entities that do not qualify as essential.
which do not qualify as essential entities
Keep size evidence separate from special-case evidence so a later headcount, turnover, service, or designation change can be reassessed cleanly without rebuilding the entire classification memo.
Essential entities must implement Article 21 appropriate and proportionate cybersecurity risk-management measures across the listed areas, maintain management-body oversight, and report significant incidents under Article 23 within the 24-hour early-warning and 72-hour notification clocks. The incident-notification limit is 24 hours for a trust service provider when the significant incident affects its trust services.
Binding source for shared risk-management and reporting obligations.
essential and important entities notify
Important entities carry the same Article 21 risk-management, management-body, and Article 23 significant-incident reporting obligations. The obligation baseline is identical; the proportionality calibration reflects the entity size, sector, likelihood, and impact of risks.
Binding source for shared risk-management and reporting obligations.
essential and important entities take appropriate
Do not create a weaker control baseline for important entities; both tiers use the same Article 21 risk and proportionality framework, and both must notify significant incidents under Article 23.
Essential-entity evidence should include the Article 3(1) classification memo, Annex I sector mapping, size or special-case analysis, Member State registration, Article 21 control records, management approvals, incident notifications, and supplier-risk documentation.
Binding source for the information Member States require for essential-entity lists.
address and up-to-date contact details
Important-entity evidence should cover the same families with a clear note explaining why Article 3(1) does not apply, the Annex I or Annex II basis, registration in national entity lists, Article 21 controls, incident files, and any national-authority correspondence.
Commission guidance and template for entity-list information.
for the purposes of establishing the list
Treat classification details, contact information, sector mapping, and country footprint as maintained compliance records, not a one-time scoping exercise, because they are inputs to the national entity-list update process.
Essential entities should maintain evidence as if a proactive supervisory review could occur at any time under Article 32, which authorises regular and targeted audits, random checks, and security scans without requiring a prior incident or complaint.
Important entities should be ready to produce evidence on short notice after an incident, complaint, authority scan, or other signal of alleged non-compliance under Article 33, which triggers ex post supervisory action.
Article 33 frames important-entity supervision as ex post after a trigger event.
through ex post supervisory measures
Reassess classification evidence after acquisitions, entity-size changes, service launches, new Member State operations, authority notices, or critical-entity designation because these change the tier result.
Essential-entity enforcement under Article 32 can include warnings, binding instructions, a monitoring officer, publication orders, and, after specified measures prove ineffective, temporary suspension or management-function prohibition routes. For Article 21 or 23 infringements, Article 34 requires national maximum fines of at least EUR 10 million or 2 percent of worldwide annual turnover, whichever is higher.
Article 32 enforcement powers for essential entities.
off-site supervision
Important-entity enforcement under Article 33 can include warnings, binding instructions, orders, audit recommendations, publication orders, and fines. For Article 21 or 23 infringements, Article 34 requires national maximum fines of at least EUR 7 million or 1.4 percent of worldwide annual turnover, whichever is higher.
Article 33 enforcement powers for important entities.
ex post supervisory measures
Use NIS2 fine thresholds only with the Article 34 context and national-implementation caveat; confirm actual fine ranges, procedure, and authority with local legal counsel before advising on exposure.
Essential entities can reuse Article 21 control evidence, incident records, and management-body documentation for multiple Member State registrations, national authority requests, and customer-assurance purposes, as long as the cited requirement and scope boundary are consistent.
Articles 20 and 21 apply shared governance and risk-management duties across both tiers.
essential and important entities
Important entities can reuse the same Article 21 evidence framework and Article 23 incident-notification playbook as the essential tier, with proportionality adjustments for size and risk. A shared control baseline reduces duplication if the legal entity boundary and Annex coverage are the same.
Article 21 proportionality supports evidence reuse calibrated to risk rather than to the tier label.
appropriate and proportionate technical, operational and organisational measures
Document overlap explicitly when the same control, incident record, or management approval satisfies both tiers or multiple Member States so a future reviewer can see the shared basis and the non-shared elements.
Close the essential-entity classification by recording: Article 3(1) paragraph used, Annex row, size or special-case basis, Member State evidence, national registration status, Article 21 control owner, Article 23 reporting route, and Article 32 supervision readiness.
Binding source for the essential-entity classification decision record.
For the purposes of this Directive
Close the important-entity classification by recording: why Article 3(1) does not apply, the Article 3(2) and Annex basis, Member State evidence, national registration status, Article 21 control owner, Article 23 reporting route, and Article 33 ex post supervision readiness.
Binding source for the important-entity classification decision record.
shall be considered to be important entities
Close the scope review only when a future reviewer can rerun the tier decision from the cited source, entity facts, and dated evidence without relying on project memory.
Commission guidance for information collection and entity-list maintenance.
review and, where appropriate, update
Scope and covered activity
Essential entities
Essential entities are classified under Article 3(1): Annex I entities above the medium-enterprise ceilings, size-independent actors such as TLD registries, DNS service providers, and qualified trust service providers, medium-sized or larger public electronic communications providers, central-government public administration entities, CER critical entities, Member-State-designated essential entities, and preserved legacy operators where national law provides.
Binding source for the Article 3(1) essential-entity criteria.
the following entities shall be considered to be essential entities
Important entities
Important entities are in scope under Article 3(2): covered Annex I or Annex II entities that do not qualify as essential entities, including medium-sized Annex I entities and Annex II entities not already in the essential tier, plus entities Member States identify under Article 2(2)(b) to (e) special-risk criteria.
Commission overview of essential vs important entity classification and sector scope.
wider scope, clearer rules and stronger supervision tools
Who must act
Essential entities
Essential entities and their management bodies must prepare for proactive supervision and keep evidence ready for competent authority review under Article 32, including management approval of risk measures and training. Competent authorities can also act before a problem is identified.
Binding source for management-body responsibility for essential entities.
members of the management bodies of essential and important entities
Important entities
Important entities and their management bodies must still implement the Article 21 and Article 23 duties, but the competent authorities generally act only after evidence, indication, or information suggests non-compliance under Article 33.
Binding source for management-body responsibility for important entities.
essential and important entities
Operational implication
Assign the management-body accountability, Article 21 control owner, and Article 23 incident-reporting owner at the entity level before deciding how the national authority interaction differs between tiers.
Commission overview of top-management accountability under NIS2.
accountability of the top management
Trigger or threshold
Essential entities
Essential-entity status is triggered by meeting any one of the Article 3(1) criteria: exceeding the medium-sized enterprise threshold in an Annex I sector as a large entity, being a size-independent critical digital actor, public administration entity, CER critical entity, or Member-State-identified .
Binding source for size-dependent and size-independent essential-entity categories.
regardless of their size
Important entities
Important-entity status is triggered by being in scope under Article 2 but not meeting an Article 3(1) criterion. This generally includes medium-sized Annex I and medium-sized-or-larger Annex II entities that are not essential, plus entities identified under Article 2(2)(b) to (e). A small Annex II entity is not automatically important.
Binding source for important entities that do not qualify as essential.
which do not qualify as essential entities
Operational implication
Keep size evidence separate from special-case evidence so a later headcount, turnover, service, or designation change can be reassessed cleanly without rebuilding the entire classification memo.
Recital 16 context for partner and linked enterprise considerations when applying SME ceilings.
partner enterprises or that are linked enterprises
Core obligations
Essential entities
Essential entities must implement Article 21 appropriate and proportionate cybersecurity risk-management measures across the listed areas, maintain management-body oversight, and report significant incidents under Article 23 within the 24-hour early-warning and 72-hour notification clocks. The incident-notification limit is 24 hours for a trust service provider when the significant incident affects its trust services.
Binding source for shared risk-management and reporting obligations.
essential and important entities notify
Important entities
Important entities carry the same Article 21 risk-management, management-body, and Article 23 significant-incident reporting obligations. The obligation baseline is identical; the proportionality calibration reflects the entity size, sector, likelihood, and impact of risks.
Binding source for shared risk-management and reporting obligations.
essential and important entities take appropriate
Operational implication
Do not create a weaker control baseline for important entities; both tiers use the same Article 21 risk and proportionality framework, and both must notify significant incidents under Article 23.
Binding source for risk-based and proportionate security measures.
appropriate and proportionate technical, operational and organisational measures
Evidence and records
Essential entities
Essential-entity evidence should include the Article 3(1) classification memo, Annex I sector mapping, size or special-case analysis, Member State registration, Article 21 control records, management approvals, incident notifications, and supplier-risk documentation.
Binding source for the information Member States require for essential-entity lists.
address and up-to-date contact details
Important entities
Important-entity evidence should cover the same families with a clear note explaining why Article 3(1) does not apply, the Annex I or Annex II basis, registration in national entity lists, Article 21 controls, incident files, and any national-authority correspondence.
Commission guidance and template for entity-list information.
for the purposes of establishing the list
Operational implication
Treat classification details, contact information, sector mapping, and country footprint as maintained compliance records, not a one-time scoping exercise, because they are inputs to the national entity-list update process.
Binding source for the review and update duty for entity lists.
update that list on a regular basis
Timing and cadence
Essential entities
Essential entities should maintain evidence as if a proactive supervisory review could occur at any time under Article 32, which authorises regular and targeted audits, random checks, and security scans without requiring a prior incident or complaint.
Important entities should be ready to produce evidence on short notice after an incident, complaint, authority scan, or other signal of alleged non-compliance under Article 33, which triggers ex post supervisory action.
Article 33 frames important-entity supervision as ex post after a trigger event.
through ex post supervisory measures
Operational implication
Reassess classification evidence after acquisitions, entity-size changes, service launches, new Member State operations, authority notices, or critical-entity designation because these change the tier result.
Commission template context for regular entity-list and registration updates.
review and, where appropriate, update
Enforcement and supervisory powers
Essential entities
Essential-entity enforcement under Article 32 can include warnings, binding instructions, a monitoring officer, publication orders, and, after specified measures prove ineffective, temporary suspension or management-function prohibition routes. For Article 21 or 23 infringements, Article 34 requires national maximum fines of at least EUR 10 million or 2 percent of worldwide annual turnover, whichever is higher.
Article 32 enforcement powers for essential entities.
off-site supervision
Important entities
Important-entity enforcement under Article 33 can include warnings, binding instructions, orders, audit recommendations, publication orders, and fines. For Article 21 or 23 infringements, Article 34 requires national maximum fines of at least EUR 7 million or 1.4 percent of worldwide annual turnover, whichever is higher.
Article 33 enforcement powers for important entities.
ex post supervisory measures
Operational implication
Use NIS2 fine thresholds only with the Article 34 context and national-implementation caveat; confirm actual fine ranges, procedure, and authority with local legal counsel before advising on exposure.
Essential entities can reuse Article 21 control evidence, incident records, and management-body documentation for multiple Member State registrations, national authority requests, and customer-assurance purposes, as long as the cited requirement and scope boundary are consistent.
Articles 20 and 21 apply shared governance and risk-management duties across both tiers.
essential and important entities
Important entities
Important entities can reuse the same Article 21 evidence framework and Article 23 incident-notification playbook as the essential tier, with proportionality adjustments for size and risk. A shared control baseline reduces duplication if the legal entity boundary and Annex coverage are the same.
Article 21 proportionality supports evidence reuse calibrated to risk rather than to the tier label.
appropriate and proportionate technical, operational and organisational measures
Operational implication
Document overlap explicitly when the same control, incident record, or management approval satisfies both tiers or multiple Member States so a future reviewer can see the shared basis and the non-shared elements.
Commission guidance on entity-list information supports consistent registration across Member States.
Member States may establish national mechanisms
Practical decision rule
Essential entities
Close the essential-entity classification by recording: Article 3(1) paragraph used, Annex row, size or special-case basis, Member State evidence, national registration status, Article 21 control owner, Article 23 reporting route, and Article 32 supervision readiness.
Binding source for the essential-entity classification decision record.
For the purposes of this Directive
Important entities
Close the important-entity classification by recording: why Article 3(1) does not apply, the Article 3(2) and Annex basis, Member State evidence, national registration status, Article 21 control owner, Article 23 reporting route, and Article 33 ex post supervision readiness.
Binding source for the important-entity classification decision record.
shall be considered to be important entities
Operational implication
Close the scope review only when a future reviewer can rerun the tier decision from the cited source, entity facts, and dated evidence without relying on project memory.
Commission guidance for information collection and entity-list maintenance.
review and, where appropriate, update
Practical decision rule
How should teams decide between NIS2 essential and important status?
Identify the legal entity, service, Member States, and Annex I or Annex II row.
Apply Article 3(1) first and document any size-independent, critical-entity, public-administration, communications-provider, or Member State identification rule.
If Article 3(1) does not apply but the entity is still a covered Annex I or Annex II type, document the Article 3(2) important-entity basis.
Attach registration/list evidence, Article 21 control ownership, Article 23 incident reporting route, and the Article 32 or Article 33 supervision playbook.
Commission source for the information template used to support entity-list decisions.
Template for the information required
1
Section 1
What is the difference between NIS2 essential and important entities?
Essential entities are the higher NIS2 tier. Article 3(1) includes Annex I entities above the medium-enterprise ceilings, qualified trust service providers, TLD name registries, DNS service providers, medium-sized or larger public electronic communications providers, certain public administration entities, critical entities under Directive (EU) 2022/2557, some entities identified by Member States, and legacy operators preserved by national law.
Important entities are not outside NIS2. Article 3(2) covers in-scope entities of a type listed in Annex I or Annex II that do not qualify as essential, including entities identified under Article 2(2)(b) to (e). An Annex II activity alone is not enough: the entity must normally qualify as medium-sized or exceed the medium-sized ceilings, unless a regardless-of-size or Member State identification rule applies.
Start with the entity type and service actually provided, not the business label used in sales or procurement.
Check Annex I first because it contains sectors of high criticality; then check Annex II for other critical sectors.
Record whether the entity is large, medium-sized, size-independent, a critical entity, or specifically identified by a Member State.
Treat the classification as a legal-scope record that may change when the service, country footprint, entity size, or designation status changes.
wider scope, clearer rules and stronger supervision tools
2
Section 2
Which facts decide the NIS2 tier?
The tier decision should be built from four evidence groups: Annex sector and entity type, enterprise size, special inclusion rules, and national implementation. Do not collapse those into a single yes-or-no answer, because the same organisation may have different services, subsidiaries, or Member State footprints.
Article 3 required Member States to establish their lists of essential and important entities and domain name registration service providers by 17 April 2025 and review and update them at least every two years. The Commission's Article 3(4) guidelines provide a template for collecting name, address, contact details, IP ranges, sector, subsector, and Member State service footprint. A national list or registration process is evidence, but the entity should still retain its own Article 2 and Article 3 analysis.
Save the Annex I or Annex II row used for the decision.
Save the annual-work-unit, turnover, balance-sheet, partner-enterprise, and linked-enterprise calculations, or the Article 2 reason size does not control the result.
Save any Member State designation, critical-entity status, or national registration evidence.
Save contact details, affected Member States, sector, subsector, and IP ranges where the national mechanism asks for them.
Commission guidelines and template for information used to establish and update national entity lists.
template for the collection of that information
3
Section 3
Do important entities have weaker cybersecurity obligations?
No. Both tiers have the same baseline for risk management and incident reporting, while their supervision and enforcement models differ. Article 21 requires both essential and important entities to take appropriate and proportionate technical, operational, and organisational measures. Article 23 requires both tiers to notify significant incidents.
The classification still matters because essential entities can be supervised through broader proactive tools under Article 32, while Article 33 frames important-entity supervision around ex post action when evidence, indication, or information suggests non-compliance.
Use one Article 21 control baseline for both tiers, adjusted for risk and proportionality.
Use one significant-incident workflow for both tiers, including the 24-hour early warning and 72-hour notification clocks. For a significant incident affecting trust services, a trust service provider must send the incident notification within 24 hours.
Keep separate supervision playbooks because authority interaction can differ by tier.
Avoid describing important-entity status as a compliance exemption.
Binding source for the risk-management and incident-reporting duties that apply to both tiers and for their different supervisory and enforcement regimes.
essential and important entities take appropriate and proportionate
4
Section 4
Who should maintain the classification record?
Legal or compliance should own the Article 3 interpretation, but the evidence cannot sit only in legal notes. Security, incident response, procurement, public-policy, country operations, and the management body need enough context to understand why a service is essential, important, or out of scope.
A usable record names the entity, legal entity boundary, Member States, service, Annex row, size evidence, special inclusion rule, registration status, Article 21 control baseline, Article 23 reporting route, and the trigger for reassessment.
Assign one owner for the legal classification and one owner for operational evidence retrieval.
Link the scope decision to management-body accountability, training, and Article 21 control evidence.
Keep country transposition notes beside the EU-level classification because NIS2 is a directive and national law controls registration procedures, authority routes, and applicable enforcement detail.
Reassess after acquisitions, entity-size changes, service launches, new Member State operations, authority notices, or critical-entity designation.
Binding source for the risk-management and incident-reporting duties that apply to both tiers and for their different supervisory and enforcement regimes.
"essential and important entities take appropriate and proportionate"