NIS2 Essential vs Important Entities

Annex I of NIS2 lists the sectors of high criticality. Large entities (as defined by Article 2 of Commission Recommendation 2003/361/EC) operating in these sectors are automatically classified as essential entities under Article 3(1)(a). The eleven sectors of high criticality are: Energy (electricity, district heating and cooling, oil, gas, hydrogen), Transport (air, rail, water, road), Banking, Financial market infrastructures, Health (healthcare providers, EU reference laboratories, entities engaged in research and development of medicinal products, manufacturers of basic pharmaceutical products, and entities manufacturing medical devices considered critical during a public health emergency), Drinking water, Wastewater, Digital infrastructure (Internet Exchange Point providers, DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, trust service providers, providers of public electronic communications networks, providers of publicly available electronic communications services), ICT service management (B2B) (managed service providers and managed security service providers), Public administration (central government entities), and Space.

The Energy sector is the most granular, encompassing electricity undertakings, distribution system operators, transmission system operators, producers, nominated electricity market operators, market participants providing aggregation, demand response, or energy storage services, and operators of electric vehicle charging points. Transport similarly covers a broad range of sub-sectors, from air carriers and airport managing bodies to inland waterway transport operators and traffic management control operators.

It is important to note that not every entity operating in an Annex I sector is automatically essential. The size-cap rule still applies: only large entities meeting the relevant thresholds qualify as essential under Article 3(1)(a). Medium-sized entities in Annex I sectors are generally classified as important entities under Article 3(2), subject to the same cybersecurity risk management and incident reporting obligations but a less intensive supervisory regime. However, certain entity types — such as qualified trust service providers, TLD registries, DNS service providers, and providers of public electronic communications networks or services — are classified as essential regardless of their size under Article 3(1)(b)-(f).

NIS2 employs the EU definition of small and medium-sized enterprises from Commission Recommendation 2003/361/EC to determine which entities fall within its scope. Article 2(1) of NIS2 applies the directive to entities that operate in the Annex I or Annex II sectors and that qualify as at least medium-sized enterprises under that recommendation. A medium-sized enterprise is one that employs 50 or more persons or whose annual turnover or annual balance sheet total exceeds EUR 10,000,000. Entities below both thresholds — fewer than 50 employees and turnover and balance sheet total not exceeding EUR 10M — are generally excluded from NIS2's scope.

Within the entities that meet the size-cap threshold, the distinction between essential and important turns on whether the entity qualifies as large. A large enterprise employs 250 or more persons or has an annual turnover exceeding EUR 50,000,000 or an annual balance sheet total exceeding EUR 43,000,000. Large entities in Annex I sectors are essential; large entities in Annex II sectors, and medium-sized entities in either Annex, are important. This creates a clear hierarchy: large Annex I entities face the most intensive supervision, while medium-sized Annex II entities face the least — though all remain subject to the core Article 21 and Article 23 obligations.

There are important exceptions to the size-cap rule. Article 2(2) lists categories of entities that fall within NIS2's scope regardless of their size. These include providers of public electronic communications networks or services, trust service providers, TLD registries and DNS service providers, entities that are the sole provider of a service in a Member State, entities whose disruption could have a significant impact on public safety or public health, and entities identified as critical under Directive (EU) 2022/2557 (the Critical Entities Resilience Directive, or CER). Member States may also designate additional entities under Article 2(2)(b)-(e), which provides a mechanism to capture small but critical entities that the size-cap would otherwise exclude.

While NIS2's criteria-based classification system is largely automated, Member States retain several important designation powers that introduce national discretion. Article 2(2)(b) allows Member States to bring entities below the size-cap threshold into scope if the entity is the sole provider of a service that is essential for the maintenance of critical societal or economic activities, a disruption of the entity's service could have a significant impact on public safety, public health, or public security, or a disruption could induce significant systemic risk, in particular for sectors where such disruption could have a cross-border impact. This allows Member States to capture, for example, a small but strategically critical technology provider that serves a national infrastructure operator.

Article 3(1)(e) provides that entities identified as critical entities under the CER Directive are automatically classified as essential entities under NIS2. Since CER and NIS2 share overlapping sector coverage and were adopted as a package, this ensures alignment between physical and cyber resilience obligations. An entity designated as critical under CER will face the full essential-entity supervisory and enforcement regime under NIS2, regardless of whether it would otherwise qualify as essential based on the size-cap and Annex I criteria alone.

Member States must establish and maintain a list of essential and important entities by 17 April 2025, and update it at least every two years thereafter under Article 3(3). Entities are generally required to self-register with the competent authority, providing information including their name, sector, sub-sector, size, and contact details. The registration obligation, combined with the self-assessment of classification status, places a compliance burden on entities themselves — they cannot simply wait to be notified by the competent authority. Organisations that are uncertain about their classification status should conduct a formal scoping assessment, considering their sector, size, and any applicable Member State designations, and seek legal advice where the outcome is not clear-cut.