NIS 2: essential vs important entities, what actually changes
Under NIS 2, essential and important entities have the same obligations: the governance duties of Article 20, the ten risk-management measures of Article 21 and the reporting duties of Article 23 of Directive (EU) 2022/2555, published in the Official Journal on 27 December 2022. What changes is supervision and the fine ceiling. Essential entities are subject to ex ante and ex post supervision, with random checks and regular audits that do not wait for an incident (Article 32, recital 122); important entities are supervised ex post only, when the authority has evidence, indication or information of non-compliance (Article 33). The fine ceiling Member States must provide for is at least EUR 10,000,000 or 2% of worldwide annual turnover, whichever is higher, for essential entities, and at least EUR 7,000,000 or 1.4% for important entities (Article 34).
One set of measures, two supervisory regimes
Article 2 sets the scope and Article 3 sorts in-scope entities into two groups; Chapter IV (Articles 20 to 25) imposes the same obligations on both, while Chapter VII (Articles 31 to 37) treats them differently.
| Same for both groups | Different between the groups |
|---|---|
| Management body approves and oversees the measures, can be held liable, follows training (Article 20) | Ex ante and ex post supervision versus ex post only (Articles 32 and 33) |
| The ten risk-management measures (Article 21(2)) | Random checks, regular and ad hoc audits, monitoring officer: essential entities only (Article 32) |
| 24-hour early warning, 72-hour incident notification, final report within one month (Article 23(4)) | Suspension of a certification, temporary ban of the chief executive: essential entities only (Article 32(5)) |
| Registration data, changes notified within two weeks (Article 3(4)) | Fine ceilings (Article 34) |
How an entity is classified (Article 3)
Essential entities
Article 3(1) lists seven ways to be an essential entity:
- Annex I entities (eleven sectors of high criticality, such as energy, transport, health and digital infrastructure) above the medium-sized ceilings;
- qualified trust service providers, top-level domain name registries and DNS service providers, regardless of size;
- medium-sized providers of public electronic communications networks or services;
- public administration entities of central government;
- entities a Member State identifies as essential under Article 2(2), points (b) to (e);
- critical entities under Directive (EU) 2022/2557;
- if the Member State so provides, operators of essential services identified before 16 January 2023 under the first NIS Directive.
Important entities
Article 3(2): Annex I or II entities that are not essential are important. In practice: medium-sized Annex I entities and in-scope entities of the seven Annex II sectors (postal services, waste, chemicals, food, manufacturing, digital providers, research), unless a special case of Article 3(1)(b) to (g) applies.
Size thresholds
The Commission's SME definition page (consulted on 19 October 2026) gives the ceilings of Recommendation 2003/361/EC: medium-sized means fewer than 250 staff and a turnover of at most EUR 50 million or a balance sheet total of at most EUR 43 million; small means fewer than 50 staff and a turnover or balance sheet total of at most EUR 10 million. A firm belonging to a group may have to include the group's figures.
| Sector and size | Classification |
|---|---|
| Annex I sector, above the medium-sized ceilings | Essential entity (Article 3(1)(a)) |
| Annex I sector, medium-sized | Important entity (Article 3(2)), unless Article 3(1)(b) to (g) applies, as for public electronic communications providers (Article 3(1)(c)) |
| Annex II sector, medium-sized or larger | Important entity (Article 3(2)), unless Article 3(1)(e) to (g) applies |
| Small or micro enterprise, any sector | Outside the directive, unless Article 2(2) to 2(5) applies |
Two fictitious examples: an industrial food processor outside any group, with 180 staff and EUR 30 million of turnover, is by default an important entity (medium-sized, Annex II); a hospital operator with 1,200 staff is an essential entity (above the ceilings, Annex I).
Who draws up the list
Member States had to establish the list of essential and important entities by 17 April 2025 and must review it at least every two years (Article 3(3)); entities submit their identification data and notify changes within two weeks (Article 3(4)). The Commission's page "NIS2 Directive transposition in EU countries" (consulted on 19 October 2026) records that on 7 May 2025 it sent a reasoned opinion to 19 Member States for failing to notify full transposition: national rules may still be settling.
A pending change to the size rule
On 20 January 2026 the Commission proposed amending NIS 2 (COM(2026) 13 final). Under recital 2 of the proposal, Annex I entities qualifying as small mid-caps would, as a main rule, be important entities. EUR-Lex showed procedure 2026/0012(COD) as ongoing on 20 October 2026: the current Article 3 still applies.
Ex ante vs ex post supervision
Minimum powers Member States must give their competent authorities:
| Point | Essential entities (Article 32) | Important entities (Article 33) |
|---|---|---|
| When | Ex ante and ex post (recital 122): no prior incident or complaint needed | Ex post only, "when provided with evidence, indication or information" of alleged non-compliance (Article 33(1)) |
| Supervisory powers | Inspections with random checks; regular, targeted and ad hoc audits; security scans; requests for information and evidence (Article 32(2)) | Inspections; targeted audits; security scans; requests for information and evidence (Article 33(2)) |
| Enforcement powers | Warnings, binding instructions, compliance orders, publication of infringements, a monitoring officer, fines (Article 32(4)) | The same, without the monitoring officer (Article 33(4)) |
| If those measures fail | Temporary suspension of a certification or authorisation; temporary ban of the chief executive or legal representative (Article 32(5), not for public administration) | No equivalent |
Maximum fines in the directive
Article 34 says "a maximum of at least": it sets a floor for each national ceiling, and a Member State may go higher.
| Infringement of Article 21 or 23 | Essential entities (Article 34(4)) | Important entities (Article 34(5)) |
|---|---|---|
| Fixed amount | A maximum of at least EUR 10,000,000 | A maximum of at least EUR 7,000,000 |
| Turnover-based amount | At least 2% of the total worldwide annual turnover, in the preceding financial year, of the undertaking to which the entity belongs | At least 1.4% of the same turnover |
| Which applies | Whichever is higher | Whichever is higher |
Member States may add periodic penalty payments (Article 34(6)) and decide whether public administration entities can be fined (Article 34(7)). Under Article 32(7), applied to important entities by Article 33(5), repeated violations, failure to notify or remedy significant incidents, ignored binding instructions, obstructed audits or monitoring, and false or grossly inaccurate information are serious infringements "in any event".
Does the classification change your plan?
For the work itself, almost nothing: both groups implement the same measures, incident timeline and governance duties, so the NIS 2 compliance checklist applies to either. What changes is the order and depth of the evidence.
- Essential entity: expect requests for proof before anything goes wrong (Article 32(2)); keep evidence ready, dated and findable.
- Important entity: supervision is triggered by evidence, indication or information of non-compliance (Article 33(1)), which a significant incident can provide, so the incident procedure comes first; see NIS 2 incident reporting deadlines.
- Both: management liability under Article 20 is identical; the temporary ban of Article 32(5) applies to essential entities only. See NIS 2 and management bodies.
FAQ
Can an important entity become essential?
Yes: by growing past the medium-sized ceilings in an Annex I sector (Article 3(1)(a)), or by being identified as essential by its Member State (Article 3(1)(e)) or as a critical entity under Directive (EU) 2022/2557 (Article 3(1)(f)). Lists are reviewed at least every two years (Article 3(3)).
Are the ten measures lighter for important entities?
No. Article 21 applies in identical terms to both groups; the proportionality test of Article 21(1) depends on exposure to risk, size, and the likelihood and severity of incidents, not on the label.
Who tells me whether I am essential or important?
The Member State, which builds the list (Article 3(3)) from the information entities submit and may let them register themselves (Article 3(4)). Meanwhile, apply Article 3 yourself, keep the reasoning and check your national law; the Commission's transposition page links to a state-of-play page for each Member State.