NIS2 — essential and important entities

• Directive (EU) 2022/2555 — NIS2, Art. 26

Who has to appoint one

DNS providers, TLD registries, cloud computing and data centre services, CDNs, managed service and managed security service providers, online marketplaces, search engines and social platforms that are not established in the Union but offer services in it.

Thresholds and exemptions

Generally entities with 50 or more staff or €10 million turnover, but some digital infrastructure providers are covered regardless of size.

What must appear on the label

Not a labelling obligation. The entity must be registered with the authority of the member state where the representative is established.

Marketplace fields

Not applicable, but enterprise procurement now routinely asks whether the supplier is NIS2 registered.

Documentation you must hold

Risk management measures, incident handling procedures, supply chain security policy, business continuity plan and the registration record.

Standards and testing

Not applicable, though audits can be imposed on essential entities.

Language requirements

Reporting in the language accepted by the CSIRT concerned.

When it applies

Early warning within 24 hours of a significant incident, incident notification within 72 hours and a final report within one month.

How long records are kept

For the duration of the registration.

What happens if you do not comply

Up to €10 million or 2% of worldwide turnover for essential entities, and management can be held personally accountable in several member states.

Who enforces it

National competent authorities and CSIRTs.

Where the boundary lies

NIS2 reporting and CRA Article 14 reporting are separate obligations with different triggers: NIS2 is about incidents affecting your service, CRA is about vulnerabilities in your product.

Questions we are asked

We are a small SaaS with EU customers — are we in scope?

Only if you fall in one of the listed sectors and meet the size criteria, or you are a digital infrastructure provider covered regardless of size.