Who NIS2 applies to

Article 2(1) covers entities of a type in Annex I or Annex II that qualify as medium-sized enterprises under Recommendation 2003/361/EC, or that exceed the ceilings for medium-sized enterprises in that recommendation, and that provide their services or carry out their activities within the Union.

The annexes name the types. This page does not reprint them. A sector that is not in the annex is not brought in by a summary.

Article 2(2) adds entities of an annex type regardless of size in listed cases. The service-provider case includes providers of public electronic communications networks or of publicly available electronic communications services, trust service providers, and top-level domain name registries and DNS service providers.

Article 2(4) adds entities providing domain name registration services, again regardless of size. Other regardless-of-size cases are the sole provider of an essential service, a disruption with a significant impact on public safety, security, or health, systemic risk, national or regional importance, and named public-administration entities.

Article 3(1) lists who is essential. It includes annex I entities that exceed the medium-sized ceilings, qualified trust service providers, TLD name registries, and DNS service providers regardless of size, plus further cases in that paragraph.

Article 3(2) says entities of a type in Annex I or II that are not essential under paragraph 1 are important. Member States had until 17 April 2025 to establish a list of essential and important entities and of entities providing domain name registration services.