Under NIS2, an organization is classified either as an essential entity or as an important entity. It is not just a label: on it depend the supervision regime, the frequency of inspections and the penalty ceilings. The classification results from the combination of the sector in which you operate and the size of the company, with a few important exceptions, including the impact on critical infrastructure.
The sector: the two annexes
The law uses two lists. Annex 1 covers the sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, management of business-to-business ICT services, public administration and space. Annex 2 covers other critical sectors: postal and courier services, waste management, the manufacture and distribution of chemicals, the production and distribution of food, manufacturing (for example devices, computers, equipment), digital service providers and research.
Size: the thresholds
The usual rule: you fall under NIS2 if you are at least a medium-sized enterprise, that is you have at least 50 employees or an annual turnover or balance sheet of over 10 million euro. Below these thresholds, as a general rule you are not covered, but pay attention to the exceptions, especially the one related to impact.
How the essential vs important distinction is made
In simple terms: large entities (over 250 employees or over 50 million euro in turnover) in the high-criticality sectors (Annex 1) tend to be essential. Medium-sized entities, as well as large ones in the Annex 2 sectors, tend to be important. The practical difference: essential entities are supervised proactively (including inspections carried out on the authority's own initiative), important ones rather reactively, and the fine ceilings are higher for essential ones. Likewise, the implementation of the security requirements differs, depending on the entity classification.
The exceptions that are covered regardless of size
Some categories are covered by the nature of the service, even if they are small: providers of public electronic communications networks or of electronic communications services intended for the public, qualified trust service providers, top-level domain name registries and DNS service providers, as well as, under certain conditions, entities that are the sole provider of an essential service or whose disruption would have a major impact.
Why it matters to know correctly
Incorrect classification affects you in both directions: if you do not fall under NIS2, you have no obligation, but if you do fall under it, you risk penalties and lose precious time; if you overestimate yourself, you spend on implementing measures excessively, beyond what is required of you; if you underestimate yourself, you risk not reaching the required level of compliance. The official identification decision is issued by DNSC, but you can find out in advance where you are classified.
If you are not sure, our free classification tool gives you an indicative answer in a few minutes, starting precisely from sector and size.