Who Does NIS2 Apply To? Essential vs Important Entities and the Annex I/II Sectors

Directive (EU) 2022/2555 (NIS2) applies to organisations that fall into covered sectors and size classes as essential or important entities. Classification drives supervisory intensity and the Article 34 fine ceiling — not whether Article 21 measures apply (both tiers must implement them).

Classification, not exemption: Essential and important entities both implement Article 21’s 10 minimum cybersecurity risk-management measure categories. Essential entities typically face stricter supervisory powers and higher administrative-fine ceilings under the Directive’s penalty framework.

Essential vs Important

Essential entities — primarily Annex I sectors at large-enterprise scale (and certain specially designated operators). Stronger ex ante supervision is typical.
Important entities — primarily Annex II sectors and many medium-sized operators in Annex I sectors (exact cut-overs depend on national law).

Size thresholds typically / often track the EU medium-sized enterprise concept (commonly cited as 50+ employees with turnover or balance-sheet thresholds around €10 million). Member State transposition may refine lists, designations, and registration mechanics — confirm national law rather than treating a blog table as definitive.

Annex I themes (high-criticality sectors)

Descriptive sector themes include energy, transport, banking, financial market infrastructures, health, drinking water, wastewater, digital infrastructure, ICT service management (B2B), public administration, and space. Exact entity types and carve-outs sit in the Directive annexes and national registers.

Annex II themes

Descriptive themes include postal and courier, waste management, manufacture of certain critical products, digital providers (e.g. online marketplaces, search engines, social networking platforms), and research. Again — use national competent-authority guidance for whether your legal entity is listed or designated.

MSPs and digital providers

Managed service providers and many digital/ICT providers are squarely in the NIS2 conversation — see NIS2 for MSPs / MSSPs.

How CyberSilo Helps

Article 21 evidence map and gap tracking in CSA for NIS2
Article 23 reporting clocks with ThreatHawk SIEM detection workflows
Advisory scoping — contact CyberSilo

Confirm Scope Before You Build Controls

Map sector, size, and Member State registration duties, then evidence the 10 Article 21 categories.

Talk to CyberSilo NIS2 Hub

Frequently Asked Questions

Do important entities skip Article 21?

No. Both essential and important entities must take appropriate and proportionate technical, operational and organisational measures covering the 10 Article 21(2) categories.

Are employee counts identical in every Member State?

Not safely assumed. The Directive uses size criteria tied to enterprise definitions, but national transposition and designations can refine who is listed — confirm national law.

Can a non-EU HQ still be in scope?

Yes in practice when EU operations, services, or designations bring you under national NIS2 rules — see our non-EU companies guide.

NIS2 hub · Fines · Checklist · CSA

Who Does NIS2 Apply To? Essential vs Important Entities and the Annex I/II Sectors

Essential vs Important

Annex I themes (high-criticality sectors)

Annex II themes

MSPs and digital providers