NIS2: are you an essential entity or an important entity?

Why the distinction matters

Both categories have the same substantive obligations (risk management measures under Article 21, incident notification under Article 23, governance under Article 20). They differ on three points:

Misidentifying one's category is not trivial: an essential entity that declares itself as important is exposed to a breach of the registration obligation, and conversely an important entity that believes itself to be essential over-invests. The consequences for management are detailed in our article on management liability under NIS2.

Question 1: does your activity fall within a sector listed in Annex I or II?

Annex I, highly critical sectors (11): energy (electricity, heating and cooling, oil, gas, hydrogen); transport (air, rail, water, road); banking; financial market infrastructures; health (healthcare establishments, reference laboratories, manufacturers of critical medical devices, pharmaceutical industry); drinking water; wastewater; digital infrastructure (internet exchange points, DNS, domain name registries, cloud, data centres, CDN, trust services, electronic communications networks and services); business-to-business ICT service management (managed services and managed security services); public administration; space.

Annex II, other critical sectors (7): postal and courier services; waste management; manufacture, production and distribution of chemicals; production, processing and distribution of food; manufacturing (medical devices, computer and electronic products, electrical equipment, machinery, motor vehicles, other transport equipment); digital providers (online marketplaces, search engines, social networking platforms); research.

If none of your activities falls within these lists, you are not directly subject to NIS2 (but read question 5).

Question 2: what is your size within the meaning of Recommendation 2003/361/EC?

NIS2 refers to the European definition of SMEs. The thresholds are assessed at the enterprise level, taking into account partner and linked enterprises (the group), which brings many subsidiaries into scope.

General rule: large enterprise in Annex I = essential; medium-sized enterprise in Annex I or II, and large enterprise in Annex II = important; small and micro-enterprise = out of scope, except in the case of question 3.

Question 3: do you carry out a covered activity regardless of size?

The directive (Article 2(2) and Article 3) includes certain entities regardless of their size:

• qualified trust service providers, top-level domain name registries and DNS service providers (essential);
• providers of public electronic communications networks or services (essential if medium-sized, important otherwise);
• central government administration entities (essential);
• entities that are the sole provider of an essential service in a Member State, or whose disruption would have a significant impact on public security, public safety or public health, or a systemic risk;
• entities identified as critical under the REC Directive (2022/2557).

Question 4: are you established in France or do you provide your services there?

The principle is that of the Member State of establishment. For providers of digital services (cloud, data centres, CDN, managed services, online marketplaces, search engines, social networks, DNS), it is the main establishment in the Union that counts; an entity outside the EU that provides these services in the Union must designate a representative. A foreign group with a French subsidiary of 60 employees in the chemicals sector is therefore covered in France for that subsidiary.

Question 5: are you a supplier to an essential or important entity?

Even if out of scope, you can be caught by contract. Article 21 requires regulated entities to manage 'the security of the supply chain', including relationships with their direct suppliers. In practical terms, your regulated customers will ask you for security guarantees, incident notification clauses and audits. It is not NIS2 that imposes this on you, it is your customer, and refusing may cost you the contract. See also the notion of supply chain attack in our glossary.

What to do once the category has been determined?

1. Register with the French cybersecurity agency (ANSSI) via MonEspaceNIS2 (pre-registration open since November 2025), indicating sector, sub-sector, size and contact point details.
2. Inform the management body and have the category and resulting obligations formally acknowledged (see the article on the responsibility of the manager).
3. Map the information systems that support the relevant activities; the NIS2 scope does not necessarily cover the entire IS.
4. Launch a diagnostic of the 10 measures in Article 21 and a plan over 12 to 36 months, in line with the French cybersecurity agency (ANSSI)'s compliance timeline. Our NIS2 regulation fact sheet details the content.
5. Complete the NIS2 self-assessment to obtain an initial gap measurement.

Sources

• Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 20, 21, 23, 26, 32 to 34 and Annexes I and II, EUR-Lex.
• Commission Recommendation 2003/361/EC concerning the definition of micro, small and medium-sized enterprises.
• French cybersecurity agency (ANSSI), MesServicesCyber, 'Directive NIS 2' and MonEspaceNIS2 platform.