NIS2 essential vs important entities: how you are classified and what changes for you

Under NIS2, an entity is essential mainly when it is in an Annex I sector and exceeds the medium-sized ceilings: 250 or more staff, or turnover above €50 million and a balance sheet above €43 million. Every in-scope Annex I or II entity that is not essential is important. Both have the same obligations; what differs is supervision, enforcement and the maximum fine.

This guide covers classification, who is essential regardless of size, what is identical, supervision, enforcement, fines, entity lists, management training, reclassification and a checklist.

	Essential entity	Important entity
Who (Article 3)	Annex I above the medium-sized ceilings, plus the categories in Article 3(1)	Every other Annex I or II entity in scope
Management body duties and training (Art. 20)	Yes	Same
Risk-management measures (Art. 21)	Ten minimum measures	Same
Incident reporting (Art. 23)	24 hours, 72 hours, one month	Same
Supervision	No trigger needed: inspections, random checks, regular, targeted and ad hoc audits (Art. 32)	On evidence, indication or information of non-compliance: targeted audits, no regular or ad hoc audits (Art. 33)
Monitoring officer, suspension of authorisation, temporary management ban	Possible (Art. 32(4)(g) and 32(5))	Not available
Liability of legal representatives	Art. 32(6)	Same, via Art. 33(5)
Maximum fine (Art. 34)	At least €10M or 2% of worldwide turnover	At least €7M or 1.4%

How does NIS2 classify essential and important entities?

Three tests, in order: sector, size, special categories. Scope details are in the NIS2 scope guide.

Sector. Annex I lists 11 sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (B2B), public administration and space. Annex II lists 7 other critical sectors: postal and courier, waste management, chemicals, food, manufacturing, digital providers and research.

Size. Size follows Commission Recommendation 2003/361/EC. A medium-sized enterprise has fewer than 250 staff and turnover up to €50 million and/or a balance sheet up to €43 million. You exceed those ceilings with 250 or more staff, or when turnover and balance sheet are both above their limits. Staff count in annual work units, and partner and linked enterprise data is aggregated. Smaller companies are covered in NIS2 for SMEs.

For groups, recital 16 lets Member States weigh an entity’s independence from its group, in its systems and services, when aggregating. Article 2(1) switches off the Recommendation’s 25% public-control rule, so public ownership alone does not make a utility large.

NIS2 CLASSIFICATION CHECK (Directive (EU) 2022/2555, Art. 2 and 3)

1. Sector   Which services match an Annex I or II sector and
            subsector? None -> out of scope, unless CER, domain
            name registration or national extension
            (Art. 2(3), 2(4), 2(5)).
2. Size     Staff (annual work units), turnover, balance sheet,
            incl. partner and linked enterprises.
3. Special  Qualified TSP, TLD registry, DNS provider, public
            ECN/ECS, central government, CER critical entity,
            identified by the Member State?
4. Result   Annex I + above medium ceilings ..... essential
            Annex I + medium-sized .............. important *
            Annex II + medium-sized or larger ... important *
            Small or micro ...................... out of scope *
            * unless step 3 applies
5. Record   Date, figures, sources, who decided.

Which entities are essential regardless of size?

Article 3(1) adds these categories to the Annex I size rule:

• qualified trust service providers, top-level domain name registries and DNS service providers, regardless of size;
• medium-sized providers of public electronic communications networks or publicly available electronic communications services (large ones are already essential under Annex I);
• central government public administration;
• entities a Member State identifies as essential under Article 2(2), points (b) to (e): sole providers of an essential service, or entities whose disruption could significantly affect public safety, security or health, create systemic risk, or that are critical nationally or regionally;
• critical entities under the CER Directive (EU) 2022/2557;
• if the Member State so provides, operators of essential services identified under NIS1 before 16 January 2023.

A Member State can also identify such an entity as important (Article 3(2)). No turnover threshold makes an Annex II entity, such as an online marketplace or a machinery manufacturer, essential.

Do essential and important entities have different obligations?

No. The same articles apply to both:

• Article 20: the management body approves the Article 21 measures, oversees their implementation and can be held liable for infringements of Article 21.
• Article 21: the same ten minimum risk-management measures.
• Article 23: early warning within 24 hours of becoming aware of a significant incident, notification within 72 hours, final report within one month.
• Article 3(4): the same registration details.

Size shows in the depth of the measures, not the list: Article 21(1) makes them proportionate to exposure, size, and the likelihood and severity of incidents.

How is supervision different?

Essential entities: Article 32

Authorities must be able to subject essential entities at least to inspections and off-site supervision, including random checks; regular, targeted and ad hoc security audits; security scans; information requests, including documented policies; access to data; and evidence of implementation, “such as the results of security audits carried out by a qualified auditor and the respective underlying evidence”.

No trigger is needed, but the directive gives powers, not a calendar: Article 31(2) lets Member States allow risk-based prioritisation.

Important entities: Article 33

Authorities act “when provided with evidence, indication or information” that an important entity allegedly does not comply, “where necessary, through ex post supervisory measures”. In practice the trigger is often a reported incident or a complaint. The powers are narrower: inspections, targeted audits, security scans and the same information and evidence requests, but no random checks, regular audits or ad hoc audits.

In both regimes the audited entity pays for a targeted audit by an independent body, unless the authority decides otherwise in duly substantiated cases.

Which enforcement powers apply only to essential entities?

Most are shared (Articles 32(4) and 33(4)): warnings, binding instructions, orders to comply with Articles 21 and 23, to inform customers of a significant cyber threat, to implement audit recommendations or to make infringements public, and fines.

Two exist only for essential entities:

1. A monitoring officer (Article 32(4)(g)), designated for a set period to oversee compliance with Articles 21 and 23.
2. Article 32(5). If those measures fail and a deadline passes, the authority can temporarily suspend a certification or authorisation for the services, and ask a court or relevant body to temporarily bar a person at chief executive or legal representative level from managerial functions. Both last only until the entity remedies, and neither applies to public administration.

Personal liability is shared: under Article 32(6), applied to important entities by Article 33(5), people who represent, decide for or control the entity can be held liable for failing to ensure compliance. More in NIS2 board accountability.

What are the maximum fines for essential and important entities?

For infringements of Article 21 or 23, Article 34 requires national law to set maximum fines of at least:

• essential entities: €10 million or 2% of total worldwide annual turnover in the preceding financial year, whichever is higher;
• important entities: €7 million or 1.4%, whichever is higher.

National law may go higher. Turnover is that of the undertaking the entity belongs to, which can mean the group. There is no higher tier: €20 million or 4% is the GDPR ceiling. A GDPR fine for the same conduct rules out a NIS2 fine (Article 35). Penalties for other infringements, such as late registration, are set nationally (Article 36). Details in NIS2 administrative fines.

How do Member States list essential and important entities?

Under Article 3(3), each Member State had to establish a list of essential and important entities by 17 April 2025, and must review it at least every two years. To build it, Article 3(4) requires entities to submit at least:

1. their name;
2. their address and up-to-date contact details, including email addresses, IP ranges and telephone numbers;
3. where applicable, their sector and subsector;
4. where applicable, the Member States where they provide in-scope services.

Changes are due within two weeks. Member States may set up self-registration.

Article 3 does not oblige the authority to tell you your category, so do not wait for a letter: find your authority’s registration channel. The NIS2 checker gives a first answer on scope. Classification applies through national law, and on 8 July 2026 the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice for failing to notify measures transposing NIS2.

I am an essential entity: what training is mandatory for my managers?

Article 20(2) requires the members of the management body to follow training, and the rule is identical for important entities. The aim is sufficient knowledge and skills “to identify risks and assess cybersecurity risk-management practices and their impact on the services provided by the entity”.

NIS2 sets no syllabus, hours or frequency; national law may. Entities are encouraged to offer similar training to employees. In practice, sessions built on your own risk register and incident plan, with attendance recorded, are easier to defend than a generic course. More in NIS2 training requirements.

Can your classification change?

Yes, in four ways.

1. Growth. An Annex I entity that crosses the medium-sized ceilings becomes essential. The Recommendation changes size status only when a ceiling is crossed over two consecutive accounting periods; check how your authority applies this.
2. New services. Adding an Annex I activity, such as managed services for business customers, can bring an Annex II company into Annex I.
3. National identification under Article 2(2), with lists reviewed at least every two years.
4. The law. Proposal COM(2026) 13 of 20 January 2026 would make Annex I small mid-caps (fewer than 750 staff, turnover up to €150 million or balance sheet up to €129 million) important entities as a main rule. It is a proposal, not adopted as of September 2026.

What the category leaves open

The category decides when the authority can ask, not what it asks for: Articles 32 and 33 give the same evidence powers. An important entity is usually asked after something has gone wrong, the worst week to assemble two years of records.

Nor does the category travel down the supply chain. A supplier to essential entities is assessed by its customers under Article 21(2)(d) and 21(3), whatever its own category.

A sensible approach is to build evidence as if you were essential: MFA coverage, patch times, restore tests and management approvals, collected continuously from the systems that hold them, with a person reviewing exceptions. That is how the CloudSoul platform works, and the wider programme is on the NIS2 compliance page.

NIS2 classification checklist

• Map each service to an Annex I or II sector and subsector.
• Calculate size under Recommendation 2003/361/EC, including partner and linked enterprises.
• Check the size-independent categories and any CER or national identification.
• Register with your competent authority and report changes within two weeks.
• Record management body approval of the Article 21 measures and members’ training.
• Test incident reporting against the 24-hour and 72-hour deadlines.
• Keep audit results and their underlying evidence ready for an information request.
• Re-run the classification after each financial year-end and when you add services.

Sources

• Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 20, 21, 23, 31, 32, 33, 34, 35 and 36, recitals 15 and 16, Annexes I and II, EUR-Lex. Article text: Article 3, Article 32, Article 33, Article 34.
• Commission Recommendation 2003/361/EC on the definition of micro, small and medium-sized enterprises, Annex, Articles 2 to 6, EUR-Lex.
• Commission Recommendation (EU) 2025/1099 on the definition of small mid-cap enterprises, EUR-Lex.
• Proposal COM(2026) 13 amending Directive (EU) 2022/2555, 20 January 2026, European Commission.
• Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice, 8 July 2026, European Commission.

Frequently asked questions