NIS2 lists healthcare providers, EU reference laboratories, medicinal product R&D, pharmaceutical manufacturing and critical medical device makers in Annex I, and other medical device makers in Annex II. Each is in scope once at least medium-sized: 50 or more staff, or turnover and balance sheet both above €10 million. Smaller entities are in only if their authority identifies them.
This guide covers the entity types, clinics and radiology, labs, pharmacies, pharma, device makers, essential or important status, what applies, what the law leaves open, and a checklist.
| Organisation | NIS2 entry | If medium-sized | If large |
|---|---|---|---|
| Hospital, clinic, radiology or other practice | Annex I: healthcare provider | Important | Essential |
| Medical laboratory | Annex I: healthcare provider | Important | Essential |
| EU reference laboratory | Annex I | Important | Essential |
| Pharmacy | Arguably Annex I: healthcare provider (not named) | Important | Essential |
| Pharma R&D | Annex I: R&D of medicinal products | Important | Essential |
| Pharma manufacturer | Annex I: NACE Rev. 2 division 21 | Important | Essential |
| Maker of a critical medical device | Annex I: public health emergency critical devices list | Important | Essential |
| Other medical device or IVD maker | Annex II, point 5(a) | Important | Important |
| Medicines wholesaler or distributor | Not listed in the health sector | Check other sectors | Check other sectors |
Small and micro entities are out unless a size-independent case applies, and the Member State can identify any of these as essential. Large means 250 or more staff, or turnover above €50 million and balance sheet above €43 million.
Which healthcare entities does NIS2 cover?
Annex I, point 5 (Health) lists five entity types:
- “Healthcare providers”, as defined in Article 3, point (g), of Directive 2011/24/EU on patients’ rights in cross-border healthcare.
- “EU reference laboratories”, under Article 15 of Regulation (EU) 2022/2371 on serious cross-border threats to health.
- “Entities carrying out research and development activities of medicinal products”, with medicinal products as defined in Article 1, point (2), of Directive 2001/83/EC.
- “Entities manufacturing basic pharmaceutical products and pharmaceutical preparations referred to in section C division 21 of NACE Rev. 2”.
- “Entities manufacturing medical devices considered to be critical during a public health emergency (public health emergency critical devices list) within the meaning of Article 22 of Regulation (EU) 2022/123”.
Annex II, point 5(a) adds entities manufacturing medical devices and in vitro diagnostic medical devices, except those in the fifth Annex I entry above.
The definitions come from other EU law. A healthcare provider is “any natural or legal person or any other entity legally providing healthcare on the territory of a Member State”. That covers public and private providers, and the directive applies to healthcare “regardless of how it is organised, delivered and financed” (Article 1(2)). The size rule in Article 2(1), medium-sized or larger under Recommendation 2003/361/EC, applies to every entry.
Health is not new: NIS1 listed “health care settings (including hospitals and private clinics)” with the same definition. NIS2 replaces national identification with the size rule and adds EU reference laboratories, pharma and device makers.
Are private clinics and radiology practices in scope?
Yes, if they are at least medium-sized. A clinic or radiology practice that legally provides healthcare is a healthcare provider, whatever its legal form. The size rule then decides:
- Headcount: 50 or more staff, in annual work units, puts you in scope.
- Finances: with fewer staff, you are still in if turnover and balance sheet total both exceed €10 million. Imaging is capital-intensive: a 35-person practice with €12 million turnover and an €11 million balance sheet is medium-sized.
- Group: linked enterprises count in full, partner enterprises in proportion. A practice owned by a large imaging group can be large on the group’s figures.
- Public ownership: control by a public body does not by itself make a clinic large; Article 2(1) disapplies that rule of the Recommendation.
Below the line, a practice is out unless the Member State identifies it under Article 2(2): as the sole provider of an essential service, where disruption “could have a significant impact on public safety, public security or public health”, for significant systemic risk, or for its importance at national or regional level. CER Directive critical entities are in regardless of size (Article 2(3)). The national authority decides these cases. No NIS2 rule sets a bed count or a patient volume.
Check that your national law is in force: on 8 July 2026 the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice for not notifying transposition. The NIS2 scope checker gives a first answer from sector, headcount and turnover.
Are laboratories in scope?
There are three routes, and most labs take the second.
- EU reference laboratory. The Commission designates these by implementing act to support national reference laboratories on diagnostics, testing methods and disease surveillance. Doing reference-level work does not make a lab one.
- Healthcare provider. A medical laboratory that legally provides healthcare to patients, such as diagnostic testing, fits the definition, subject to the size rule. A hospital’s own lab is part of the hospital.
- R&D of medicinal products. A lab doing that research falls under the R&D entry. Annex II also lists research as a sector (point 7).
Are pharmacies in scope?
Some can be, though NIS2 does not name them. Directive 2011/24/EU defines healthcare as health services provided by health professionals, “including the prescription, dispensation and provision of medicinal products and medical devices”, and lists pharmacists among health professionals. On that wording, a pharmacy that legally dispenses medicines can meet the healthcare provider definition.
It must still be at least medium-sized. A single pharmacy is often below both the headcount and the financial test. A company running a chain of pharmacies, or one linked to a larger group, can be above them. Check how your national law and authority apply the definition before assuming you are in or out.
Are pharmaceutical companies in scope?
Yes, through two Annex I entries, if the company is at least medium-sized:
- Research and development of medicinal products: substances presented as treating or preventing disease in human beings, or administered to make a medical diagnosis or to restore, correct or modify physiological functions. On its wording, this reaches biotech companies and contract research organisations doing that R&D.
- Manufacturing under NACE division 21. The test is the activity: a contract manufacturer making pharmaceutical preparations is covered like a brand owner.
A company that only holds marketing authorisations, markets or distributes medicines is not in the health sector list; check the other annex entries before concluding you are out.
Are medical device manufacturers in scope?
- Annex I, critical devices. Under Article 22 of Regulation (EU) 2022/123, the Executive Steering Group on Shortages of Medical Devices, set up within the European Medicines Agency, adopts a public health emergency critical devices list once a public health emergency is recognised. Check with the Agency whether a list is in force and whether your devices are on it.
- Annex II, point 5(a). Manufacturers of medical devices and in vitro diagnostic medical devices. At medium size or above they are important entities, unless the Member State identifies them as essential.
Article 21 covers the systems the manufacturer uses for its operations and services, which is not the same as the security of the device it sells.
Is a healthcare entity essential or important?
Article 3 sets the status. An entity is essential if it is:
- a large Annex I entity, such as a large hospital or pharma manufacturer;
- identified by its Member State as essential under Article 2(2), points (b) to (e);
- a critical entity under the CER Directive;
- if the Member State so provides, an operator of essential services identified under NIS1 before 16 January 2023.
Every other in-scope entity is important: medium-sized Annex I entities, and Annex II device makers.
Both carry the same duties. The difference is supervision and fines. Essential entities face proactive supervision, including on-site inspections and audits (Article 32); important entities are supervised after the fact (Article 33). Maximum fines for infringing Article 21 or 23 must be at least €10 million or 2% of worldwide annual turnover for essential entities, and €7 million or 1.4% for important ones, whichever is higher (Article 34). See essential vs important entities.
Member States had to list their entities by 17 April 2025, and entities must report changes to their details within two weeks. If you are in scope and not registered, register now.
What does NIS2 require of a hospital, lab or pharma company?
- Management (Article 20). The management body approves the measures, oversees them, can be held liable for the entity’s infringements of Article 21, and its members must follow training. See NIS2 board accountability.
- Measures (Article 21). Appropriate and proportionate measures on an all-hazards basis, including ten minimum measures. See the 10 measures of Article 21.
- Reporting (Article 23). For a significant incident, an early warning to the CSIRT or competent authority within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month of that notification. See the NIS2 incident reporting timeline.
Health data is a special category of personal data under GDPR Article 9. A ransomware attack on a hospital is usually both a NIS2 incident and a personal data breach, reported to different authorities on different clocks: see NIS2 and GDPR.
What NIS2 leaves open in a hospital or pharma plant
Article 21 asks for asset management and vulnerability handling. It does not say what to do with a CT scanner, a lab analyser or a production controller running software only the manufacturer may update. In practice these are often the hardest systems to patch and the easiest to reach through vendor remote access.
NIS2 also defines an incident as an event compromising the “availability, authenticity, integrity or confidentiality” of stored, transmitted or processed data or of services (Article 6, point (6)). An altered lab result or batch record is an incident even when nothing is down, and a restore test that only checks the system comes back proves availability, not integrity.
A sensible approach is to map each clinical or production service to its systems, find the single points of failure, and record what you cannot fix and why:
CLINICAL AND OT DEVICE REGISTER (one entry per device or system)
Device / system: [CT scanner, PACS, lab analyser, MES, ...]
Service supported: [radiology, emergency lab, batch release]
Location / segment: [site, room, network segment]
Manufacturer / model: [vendor, model, software version]
Who can patch: [us / vendor only / nobody, end of support]
Last update: [date, version]
Remote access: [none / vendor VPN / vendor cloud; approved by]
Data held: [images, results, batch records, personal data]
Integrity check: [how an altered record would be noticed]
Fallback if down: [paper process, other site, other supplier]
Risk decision: [accepted / mitigated by ...; owner; review]In practice, also decide in advance what “severe operational disruption” (Article 23(3)) means for you: cancelled procedures, diverted admissions, a halted batch. The call on reporting should not wait for forensics. On the CloudSoul platform, an automated platform with human-in-the-loop expertise, evidence is collected from your systems, and exceptions such as vendor-only devices go to a person for review. A security audit shows where you stand; the programme is on the NIS2 compliance page.
NIS2 healthcare checklist
- Match each legal entity to an Annex I or Annex II entry, using the definition the annex points to.
- Calculate size with linked and partner enterprises, checking finances as well as headcount.
- Check for identification by your authority, CER critical entity status and NIS1 history.
- Register, and report changes within two weeks.
- Record management approval of the Article 21 measures and its members’ training.
- Build the device register, including devices only the vendor can patch.
- Set up the 24-hour, 72-hour and one-month reporting chain, with GDPR reporting alongside.
- Put security and incident notification clauses into device, software and cloud contracts.
Sources
- Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 6, 20, 21, 23, 32, 33 and 34, Annex I point 5 and Annex II point 5, EUR-Lex. Article text: Article 2, Article 3, Article 23.
- Directive 2011/24/EU on the application of patients’ rights in cross-border healthcare, Article 1(2) and Article 3, points (a), (f) and (g), EUR-Lex.
- Regulation (EU) 2022/2371 on serious cross-border threats to health, Article 15, EUR-Lex.
- Directive 2001/83/EC on the Community code relating to medicinal products for human use, Article 1, EUR-Lex.
- Regulation (EU) 2022/123 on a reinforced role for the European Medicines Agency, Articles 2, 21 and 22, EUR-Lex.
- Commission Recommendation 2003/361/EC (SME definition), Annex, EUR-Lex.
- Directive (EU) 2016/1148 (NIS1), Annex II, EUR-Lex.
- Regulation (EU) 2016/679 (GDPR), Article 9, EUR-Lex.
- Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice, 8 July 2026, European Commission.
Frequently asked questions
Does NIS2 apply to hospitals?
Yes, if the hospital is at least medium-sized. Healthcare providers are an Annex I entity type, so a hospital with 50 or more staff, or with turnover and balance sheet both above €10 million, is in scope. A large hospital is an essential entity, a medium-sized one an important entity.
Are private clinics and radiology practices covered by NIS2?
They are healthcare providers, so the size rule decides. A practice with 50 or more staff, or with turnover and balance sheet both above €10 million, is in scope, counting the figures of any group it belongs to. Smaller practices are covered only if the national authority identifies them, for example as the sole provider of an essential service.
Are pharmacies in scope of NIS2?
Only some. NIS2 does not name pharmacies, but Directive 2011/24/EU counts the dispensation of medicinal products as healthcare, so a pharmacy can meet the healthcare provider definition if it is also at least medium-sized, which a single pharmacy often is not and a pharmacy group can be. Check how your national law treats pharmacies.
Are pharmaceutical companies covered by NIS2?
Yes, if they carry out research and development of medicinal products or manufacture basic pharmaceutical products and pharmaceutical preparations (NACE Rev. 2 division 21), and are at least medium-sized. Both are Annex I entries, so a large pharma company is an essential entity. Wholesalers and distributors are not listed in the health sector.
Are medical device manufacturers essential or important under NIS2?
Most are important. Manufacturers of medical devices and in vitro diagnostic medical devices are in Annex II, whose entities are important unless a Member State identifies them as essential. Makers of devices on the public health emergency critical devices list are in Annex I and are essential if large.
