Quick summary
NIS2 applies to medium and large companies in critical sectors.
Annex I entities are generally classified as essential; Annex II as important.
Both must meet the same cybersecurity obligations.
Essential entities face stricter audits and enforcement.
Fines and penalties differ based on classification.
What is the scope of the NIS2 Directive?
The first step for any company embarking in its NIS2 compliance journey is to assess whether it falls within the scope of the NIS2 legislation and whether it qualifies as an essential or important entity.
To support you in this endeavor, this blog post outlines the sectors and organizations within the Directive’s scope, as well as the different supervision and enforcement powers of competent authorities over essential and important entities.
Which sectors and companies does the NIS2 Directive apply to?
The sectors falling into the scope of the NIS2 Directive are listed in its Annexes I and II. Annex I covers “sectors of high criticality” and Annex II covers “other critical sectors”.
Not all the entities belonging to these sectors fall into the scope of the NIS2 Directive: only companies that exceed the threshold to be considered a medium-sized enterprise (i.e., employing more than 50 people or with an annual turnover/balance sheet total exceeding EUR 10 million) are impacted.
However, the Directive lists some cases where entities fall into its scope regardless of their size. A company that doesn’t reach the size threshold is subject to the Directive if:
- is the sole provider of a critical service in a Member State;
- the disruption of the service provided could have a significant impact on public safety, public security, or public health, or it could induce a significant systemic risk;
- is critical because of its specific importance at a national or regional level for the particular sector or type of service;
- is a public administration entity at a national or regional level.
Essential and important entities
All entities belonging to the sectors listed in these Annexes and meeting the size requirement fall within the scope of the NIS2 Directive. While they are all obliged to fulfill the same legal requirements, not all are subject to the same supervisory and enforcement measures.
The Directive classifies the entities falling into its scope into two categories — essential entities and important entities — each subject to a different regime. The categorization is based on how critical the entities are to the sector or service they provide, as well as on their size.
As general guidance, entities belonging to the sectors of high criticality listed in Annex I are considered essential, while those belonging to the other critical sectors listed in Annex II are considered important.
However, an entity belonging to one of the other critical sectors listed in Annex II is considered an essential entity if it is the sole provider in a Member State, or if the disruption of its service could have a significant negative impact, or if it holds specific importance at a national level.
The different regime essential and important entities are subject to
All companies within the scope of the NIS2 Directive are mandated to comply with the same cybersecurity requirements, regardless of whether they are qualified as essential or important entities.
However, different rules apply to these two categories when it comes to the power given to competent authorities to audit companies and issue fines.
In essence, essential entities face more proactive and intensive supervision and enforcement measures due to their critical importance, while important entities are subject to similar measures but with a focus on ex-post supervision and slightly less extensive enforcement powers.
Supervisory and enforcement measures
Essential entities can be subject to on-site and off-site inspections, regular security audits, ad hoc audits, and security scans on essential entities to assess their compliance.
Competent authorities have extensive powers to gather information and broad enforcement powers, including issuing warnings, adopting binding instructions, ordering cessation of infringing conduct, imposing fines, and temporarily suspending certifications or authorizations.
Important entities, on the other hand, are only subject to ex-post supervisory measures, meaning actions are taken after evidence or indications of non-compliance have been identified or after a security incident has occurred.
The enforcement powers of competent authorities are slightly more limited. They mainly focus on issuing warnings, adopting binding instructions, ordering the cessation of infringing conduct, and imposing fines.
Both essential and important entities are entitled to procedural safeguards, including the right to be informed of preliminary findings, submit observations, and appeal enforcement measures.
Fines and personal liability
The NIS2 Directive establishes that fines for non-compliance must be effective, proportionate, and dissuasive.
Companies violating the requirements set by the NIS2 Directive can be issued financial penalties – along with enforcement measures, such as warnings, instructions, orders, and so on.
Fines for essential entities can be up to €10,000,000 or 2% of the total worldwide annual turnover, whichever is higher.
For important entities, fines can be up to €7,000,000 or 1.4% of the total worldwide annual turnover, whichever is higher.
If the compliance violation can lead to a personal data breach under GDPR, competent authorities must inform the relevant supervisory authorities, who can impose fines under GDPR for the same conduct.
Additionally, to further strengthen the effectiveness and dissuasiveness of the enforcement measures applicable to essential entities, the competent authorities are also empowered to:
- temporarily suspend a certification or authorization concerning part or all of the relevant services provided or activities carried out by the entity, and
- temporarily prohibit the Chief Executive Officer or other legal representative from exercising managerial functions. The natural persons holding senior management positions or the power to represent the entity, control it, and take decisions on its behalf (and consequently be able to ensure its compliance) can be held liable for breach of their duties to ensure compliance with the NIS2 Directive.
The power given to competent authorities | ||
Essential entities | Important entities | |
Scope and focus of supervisory measures | • Proactive and random supervision • On-site and off-site inspections, regularly scheduled security audits, ad hoc audits, and security scans. • Authorities can assess compliance even without an incident | • Ex-post supervisory measures (after a security incident has occurred). |
Competent authorities can request access to data, documents, and information necessary to carry out their supervisory tasks, as well as request evidence of the implementation of cybersecurity policies. | ||
Enforcement Powers | • Warnings • binding instructions • orders of cessation of infringing conduct • order of informing customers potentially affected by a significant cyber threat • designation of a monitoring officer to oversee the compliance of the entity • fines • temporary suspension of certifications or authorizations to provide services or carry out activities • temporary prohibition from exercising managerial functions for natural persons • personal liability for breach of duty to ensure compliance with the NIS2 Directive. | • Warnings • binding instructions • orders of cessation of infringing conduct • fines |
Financial penalties | Up to €10,000,000 or 2% of the total worldwide annual turnover, whichever is higher. | Up to €7,000,000 or 1.4% of the total worldwide annual turnover, whichever is higher. |
Procedural Safeguards | Both essential and important entities are entitled to procedural safeguards, including the right to be informed of preliminary findings, the right to submit observations, and the right to appeal enforcement measures. | |
Summary checklist: Does NIS2 apply to your organization?
Quick self-assessment: Does NIS2 apply to you? | Yes/No |
Does your company operate in a critical sector (Annex I or II)? |  |
Does your company employ more than 50 people OR exceed €10M in turnover? | |
Are you the sole provider of a critical service in your country? | |
Could a disruption of your service harm public health/safety or create systemic risk? | |
Are you a national/regional public administration entity? | |
Are you new to the scope of NIS2? Secomea can help
Most organizations belonging to high-criticality sectors, as listed in Annex I (Essential Entities), were already familiar with the first NIS Directive. Besides, a significant portion of them have been directly affected by the GDPR, in response to which they have likely already improved their cybersecurity profile and expanded their compliance departments and processes.
On the other hand, the majority of companies included in the other critical sectors listed in Annex II (Important Entities) are new to the situation of having to fulfill the requirements of comprehensive cybersecurity legislation.
For the sectors and entities new to the scope, NIS2 compliance appears to be a particularly daunting task.
To make matters worse, they might not have the skills and resources to prepare themselves properly.
Last but not least, key decision-makers might not be used to actively participating in security conversations.
For these reasons, even knowing where to start can be challenging.
But fear not – Secomea can support you in your compliance journey!
To help you navigate the NIS2 legislation, ensure the fulfillment of all the requirements, and prepare for NIS2 inspections, we have prepared this comprehensive whitepaper.
Has the NIS2 Directive been implemented in my country yet? Which national law do I have to comply with?
While the NIS2 Directive set a clear deadline of 17 October 2024 for national transposition, implementation progress has varied significantly across the EU and EEA.
The whitepaper below offers a practical, country-by-country overview of where things stand as of mid-2025 – highlighting what national laws require, how obligations differ, and what industrial companies must do to comply.
Download it now to find out which local legislation has been implemented in your country and work towards achieving NIS2 compliance.
Frequently asked questions (FAQ)
What is the scope of the NIS2 Directive?
The NIS2 Directive applies to companies in critical sectors, primarily those listed in Annex I (sectors of high criticality) and Annex II (other critical sectors). However, not every organization in these sectors is automatically in scope.
Which companies fall under NIS2?
To fall within the scope of NIS2, your organization must typically meet both of the following criteria:
Belong to one of the sectors in Annex I or II
Qualify as at least a medium-sized enterprise, i.e.:
– more than 50 employees, or
– annual turnover/balance sheet over €10 million
However, even smaller companies may be in scope if they:
Are the sole provider of a critical service in a Member State
Provide services critical to public safety or systemic stability
Have specific national or regional importance
Operate as public administration entities at the national or regional level
Can small companies be in scope of NIS2?
Yes, if they are sole providers, have systemic impact, or hold national significance, they may be classified as essential regardless of size.
What are the fines under NIS2?
Up to €10M or 2% of global turnover for essential entities; up to €7M or 1.4% for important entities.
What’s the difference between essential and important entities?
The NIS2 Directive classifies organizations into two categories:
Essential entities (typically from Annex I sectors)
Important entities (typically from Annex II sectors)
This classification affects the level of oversight and enforcement, not the baseline cybersecurity requirements – which are the same for both.
Even if you’re an important entity, you must still implement the full scope of NIS2 cybersecurity measures.
When is an Annex II entity classified as essential?
An organization from Annex II may still be designated as essential if:
It is the sole provider of a critical service
A disruption could significantly impact public safety or national stability
It holds special national/regional importance
What supervision and enforcement powers are companies subject to under NIS2?
For essential entities:
Proactive supervision, including:
Regular audits (on-site and off-site)
Security scans and inspections
Random compliance checks
Stronger enforcement powers, such as:
Binding instructions and cessation orders
Public warnings
Temporary suspension of certifications
Temporary ban on managerial roles
Personal liability for senior management
Fines up to €10 million or 2% of global turnover
For important entities:
Ex-post supervision only – action occurs after a security incident or signs of non-compliance
Enforcement includes:
Warnings
Binding instructions
Orders to stop non-compliant behavior
Fines up to €7 million or 1.4% of global turnover
Both types of entities are entitled to procedural safeguards, including the right to be heard and to appeal.
Does the NIS2 scope vary in the different EU/EEA countries?
Most countries closely mirror the Directive’s sectoral scope, covering essential sectors (Annex I – e.g., energy, transport, banking, digital infrastructure, public administration) and important sectors (Annex II – e.g., manufacturing, postal services, chemicals, food, waste management).
Manufacturing and industrial operators, especially those in OT-heavy sectors, are now firmly in scope across almost all Member States.
When transposing the NIS2 Directive into local legislation, some countries introduced national classification systems that replace or supplement NIS2’s “essential” and “important” labels with local risk-based scoring (e.g., Hungary’s national risk register).
Also, some countries included public-sector entities, such as municipalities, public healthcare institutions, and education providers (e.g., Italy and Romania).
Have a look at our whitepaper to learn more about local peculiarities and what the NIS2 rules look like in your country.
