NIS2 sorts the organizations it covers into two categories: essential entities and important entities. Teams often read the second label as a lighter regime and plan accordingly. That reading is wrong in a way that matters. The obligations are largely the same. What differs is how you are supervised and how far enforcement can go.
The classification also depends on facts that are easy to get wrong: which sector you are in, how your size is measured, and whether your member state has identified you on other grounds.
This article works through scope first, then the essential and important split under Directive (EU) 2022/2555, what the label changes, and how to document your own classification so it survives scrutiny.
Step one: are you in scope at all
NIS2 asks two questions before it asks which category you are in.
Is your activity listed? The directive's annexes list the sectors covered. Annex I covers sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business to business), public administration and space. Annex II covers other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing of certain products, digital providers and research. Each sector lists specific entity types, and the annex entry is what you match against, not a general sense of your industry.
Are you big enough? Under Article 2, the general rule is that NIS2 applies to entities of a listed type that qualify as medium-sized enterprises, or exceed the ceilings for medium-sized enterprises, under the EU's definition in Commission Recommendation 2003/361/EC. That definition uses headcount together with annual turnover or balance sheet total. Small and micro enterprises are generally out of scope.
The size cap has exceptions. Some entity types are covered regardless of size, including providers of public electronic communications networks or services, trust service providers, top-level domain name registries and DNS service providers. Member states can also bring in smaller entities, for example where an entity is the sole provider of a service essential to society or the economy in that country, or where disruption could have a significant impact. Entities identified as critical under the Critical Entities Resilience Directive are also in scope regardless of size.
One more scope point: financial entities covered by DORA follow DORA's rules on risk management and incident reporting instead of NIS2's equivalents. If that is your situation, read DORA vs NIS2: which applies to you first.
How the directive sorts essential from important
Article 3 defines essential entities. In summary, they include:
Entities of a type listed in Annex I that exceed the ceilings for medium-sized enterprises, in other words large Annex I entities.
Qualified trust service providers, top-level domain name registries and DNS service providers, regardless of size.
Providers of public electronic communications networks or services that qualify as medium-sized enterprises.
Public administration entities of central government, as defined by the member state.
Other Annex I or Annex II entities that the member state identifies as essential.
Entities identified as critical entities under the Critical Entities Resilience Directive.
Where the member state so provides, entities identified as operators of essential services under the original NIS Directive.
Important entities are the in-scope Annex I and Annex II entities that do not qualify as essential, together with entities a member state identifies as important.
The practical shortcut: a large entity in an Annex I sector is usually essential. A medium-sized entity in an Annex I sector, or any in-scope entity in an Annex II sector, is usually important. The exceptions above, and national identification, override the shortcut.
What the label changes
The obligations are largely shared
Both categories must implement the cybersecurity risk management measures in Article 21, meet the governance duties in Article 20, and report significant incidents under Article 23. An important entity does not get a shorter list of measures or longer reporting deadlines. Proportionality under Article 21 depends on your exposure, size and risk, not on the label.
Supervision differs
Article 32 gives authorities ex ante and ex post supervisory powers over essential entities. Authorities can carry out on-site inspections and off-site supervision, regular and targeted security audits, ad hoc audits, security scans, and requests for information and evidence, without waiting for an incident or complaint.
Article 33 applies to important entities and is ex post. Authorities act when they have evidence, an indication or information that an entity may not be complying. The tools are similar, but they are triggered by a reason rather than applied routinely.
Enforcement differs
Article 34 sets maximum administrative fines for both categories, with a higher minimum ceiling for essential entities than for important ones. The ceilings are expressed as a fixed amount or a share of total worldwide annual turnover, whichever is higher, and member states may go further. Check your national law for the actual figures that apply to you.
Essential entities also face measures that important entities do not. Where earlier enforcement steps have not worked, authorities can suspend, or have the relevant body suspend, a certification or authorization covering the entity's services, and request a temporary prohibition on a person discharging managerial responsibilities at chief executive or legal representative level from exercising managerial functions in that entity.
Lists and registration
Article 3 required member states to establish a list of essential and important entities by 17 April 2025, and to review and update it regularly, at least every two years. To build those lists, entities must submit information to the competent authority, including their name, address and contact details, their sector and subsector, the member states where they provide services, and, where relevant, their IP ranges.
Certain digital entity types, such as cloud computing service providers, data center service providers and managed service providers, register through a separate route under Article 27, with information that feeds a registry maintained by ENISA. They fall under the jurisdiction of the member state of their main establishment in the EU.
In practice, registration deadlines and portals follow national law, and they vary. Some member states transposed late. Do not wait for an authority to contact you. Under the directive, the obligation to submit the information sits with the entity.
Working out your own classification
Document the answer as you would any compliance determination, with reasoning and dates. A workable sequence:
List your activities and match each one against the entity types in Annex I and Annex II. Record matches and near-misses.
Calculate your size under Recommendation 2003/361/EC. The recommendation counts partner and linked enterprises, so a small subsidiary of a large group can exceed the ceilings. Check how your national law applies this.
Check the size-independent rules in Articles 2 and 3, and whether you have been identified under the Critical Entities Resilience Directive.
Identify the member states with jurisdiction over you.
Read the national law in each of those member states, since scope and identification can differ from the directive.
Record the result: in scope or not, essential or important, which member states, and the date of the assessment.
Set a review trigger. Revisit when you cross a size threshold, launch a new service line, enter a new member state, or receive a notice from an authority.
The NIS2 framework page summarizes the directive's structure, and the glossary defines common compliance terms. Classification is a legal determination, so confirm yours with counsel before you rely on it.
Common misreadings
"Important means optional." It does not. The measures and reporting duties apply in full.
"We are small, so we are out." Size is measured with linked enterprises, and several entity types are covered regardless of size.
"Our sector is not listed." Check the entity types, not the sector names. Managed service providers, for example, sit under ICT service management.
"The directive is the rule." For any given company, the national law is the rule. The directive is the baseline it was built from.
How TrustLynce helps
TrustLynce's readiness dashboard shows readiness against NIS2 alongside your other frameworks, with the gap analysis recorded per requirement. Control mapping reuses existing ISO 27001 or SOC 2 evidence where it already satisfies a NIS2 measure.