Essential Entities under NIS2: Which Organisations Qualify and What It Means

Directive (EU) 2022/2555 of 14 December 2022 (CELEX 32022L2555, OJ L 333, 27.12.2022, p. 80) has been in force since 16 January 2023 (Article 45), and Member States have had to apply their national measures from 18 October 2024 (Article 41(1)). It binds the Member States (Article 46), so an organisation is classified under the national law that transposes the NIS2 Directive.

The category keeps the duties but adds Article 32 supervision, the Article 32(5) escalation and the higher fine maximum, and eight national laws add further essential entities. The table below summarises it.

What Is an Essential Entity under NIS2?

Under Article 3(1) of Directive (EU) 2022/2555, an essential entity is any entity that meets one of seven conditions, (a) to (g), and every other Annex I or II entity in scope is an important entity under Article 3(2). The Directive text on EUR-Lex uses the category in place of the operator of essential services of Directive (EU) 2016/1148 (NIS1, Article 5), which was repealed with effect from 18 October 2024 (Article 44 NIS2).

Classification is the second step: an entity first checks whether NIS2 applies under Article 2 (an Annex I or II type, at least medium-sized, active in the Union) or under a size-independent route, as explained under who NIS2 applies to.

Why the Category Matters: Same Duties, Stricter Oversight

Essential and important entities carry the same duties under Articles 20, 21 and 23; the category changes how they are supervised and how high the fines can go. The two regimes compare as listed below.

• Important entities: ex post supervision only, triggered by evidence, indication or information of non-compliance (Article 33(1)), and a maximum fine of at least EUR 7,000,000 or 1.4 % of total worldwide annual turnover, whichever is higher (Article 34(5)); see important entities under NIS2.
• Both categories: the powers of Articles 32 and 33 side by side are set out under NIS2 supervision and enforcement.

Which Organisations Qualify as Essential Entities?

Seven routes in Article 3(1) make an entity essential: size above the medium-sized ceilings for Annex I types (a), three digital infrastructure types at any size (b), medium-sized telecoms providers (c), central government (d), Member State designation (e), critical entities (f) and, where national law keeps them, former operators of essential services (g). One route is enough; the table below names the entity types and size condition of each.

Annex I Entities above the Medium-Sized Ceilings

An entity of an Annex I type is essential under Article 3(1)(a) when it exceeds the medium-sized ceilings of Article 2(1) of the Annex to Recommendation 2003/361/EC: 250 or more persons, or an annual turnover above EUR 50 million and a balance sheet total above EUR 43 million. A medium-sized Annex I entity is important (Article 3(2)).

Annex position alone never decides the category. Annex II entities, such as online marketplaces, online search engines and social networking services platforms, stay important at any size unless a Member State designates them (Article 3(1)(e)). Partner and linked enterprises count towards the figures, as explained under NIS2 size thresholds.

Providers That Are Essential at Any Size

Qualified trust service providers, top-level domain name registries and DNS service providers are essential whatever their size (Article 3(1)(b)); root name server operators are not DNS service providers (Annex I point 8). Providers of public electronic communications networks or services are essential when medium-sized (Article 3(1)(c)) or above the medium-sized ceilings (Article 3(1)(a)), while small and micro providers are important (Article 3(2)). Domain name registration service providers are in scope regardless of size (Article 2(4)), but Article 3 classifies them neither as essential nor as important.

Central Government Public Administration

Public administration entities of central government, as defined by the Member State, are essential regardless of size (Articles 2(2)(f)(i) and 3(1)(d)). Regional administration enters scope only after a risk-based assessment (Article 2(2)(f)(ii)), and local public administration and education institutions only where national law opts in (Article 2(5)). Entities active in national security, public security, defence or law enforcement are excluded (Article 2(7)).

Entities Designated by a Member State

A Member State can make an entity of any Annex I or II type essential, whatever its size, when it identifies the entity under Article 2(2)(b) to (e) (Article 3(1)(e)). The grounds are sole provision of an essential service, impact on public safety, security or health, systemic risk, and national or regional importance. These are the only cases that need a decision by the Member State; on every other route the entity checks its own status.

Critical Entities and Former Operators of Essential Services

Critical entities identified under Directive (EU) 2022/2557 are essential under NIS2 regardless of size (Articles 2(3) and 3(1)(f)), and Member States had to identify them by 17 July 2026 (Article 6(1) of that Directive). An identification under the CER Directive text on EUR-Lex therefore also fixes the NIS2 category.

Route (g) is a Member State option: where national law so provides, entities identified before 16 January 2023 as operators of essential services under Directive (EU) 2016/1148 or national law are essential (Article 3(1)(g)), and the national section below shows which laws use it.

How Are Essential Entities Supervised?

Essential entities are subject to comprehensive supervision under Article 32 of NIS2, ex ante and ex post, which means the competent authority can inspect and audit them without any prior indication of a breach (recital 122). Before a decision, the authority notifies its preliminary findings and allows time for observations unless immediate action is needed (Article 32(8)). Important entities meet these powers only ex post, as compared under NIS2 supervision and enforcement.

Supervisory Powers: Inspections, Audits and Security Scans

Article 32(2) gives the authority four groups of supervisory powers over an essential entity: on-site inspections and off-site supervision including random checks, security audits (regular, targeted and ad hoc, including after a significant incident or an infringement), security scans, and requests for information, access and evidence. The audited entity pays for a targeted audit by an independent body, except in duly substantiated cases when the authority decides otherwise (Article 32(2), third subparagraph). Poland adds a fixed rhythm: essential entities are audited at least once every three years (Article 15(1) of the amended KSC).

Enforcement Measures and the Monitoring Officer

Article 32(4) lets the authority warn an essential entity, issue binding instructions and orders, appoint a monitoring officer and publish the infringement, in addition to fines. The monitoring officer exists only for essential entities (Article 32(4)(g)); Article 33(4) has no equivalent. Fines come on top of these measures (Article 34(2)). Repeated violations, failures to notify or remedy significant incidents, obstruction of audits and false information count as serious infringements in any event (Article 32(7)(a)).

Suspension of Authorisations and Temporary Management Bans

The authority can have a certification or authorisation suspended and can request a temporary ban on the chief executive or legal representative exercising managerial functions when the measures under Article 32(4)(a) to (d) and (f) are ineffective and a set deadline is missed (Article 32(5)). Courts or other bodies impose them on request, only until the breach is remedied, and never on public administration entities.

The Belgian authority may impose it itself (Article 60 2° of the Law of 26 April 2024), a Dutch civil court suspends board members (Article 78 Cbw), the German sector authority keeps it as a last resort (§ 61(9) BSIG), and Italy extends its incapacity sanction to important entities (Article 38(6) D.Lgs. 138/2024). The liability of legal representatives (Article 32(6)) is covered under NIS2 management liability.

What Is the Maximum Fine for an Essential Entity?

For infringements of Article 21 or Article 23, Member States must set a maximum fine for essential entities of at least EUR 10,000,000 or at least 2 % of the total worldwide annual turnover of the undertaking in the preceding financial year, whichever is higher (Article 34(4)). Turnover is that of the undertaking to which the entity belongs (recital 130), and other breaches, such as a missed registration, fall under national penalties (Article 36).

Germany sets EUR 10,000,000 with the 2 % alternative only where total turnover exceeds EUR 500 million (§ 65(5) No. 1 lit. a and § 65(6) BSIG), Italy a minimum of one twentieth of the maximum (Article 38(9) D.Lgs. 138/2024), and Belgium EUR 500 to EUR 10,000,000 or 2 %, whichever is higher, doubled on a repeat within three years (Article 59 of the Law of 26 April 2024).

Fines on public administration entities are a national choice (Article 34(7)), and every national cap is compared under NIS2 fines.

Which Entities Do Member States Add as Essential?

The eight national laws in the table below restate the seven routes and adjust them in four ways: they make more public bodies essential, keep former operators of essential services as essential, add a national category such as German KRITIS operators or Romanian medium-sized managed security service providers, or draw the public administration line at federal level.

National terms differ: besonders wichtige Einrichtung ("particularly important entity") in the German BSIG, wesentliche Einrichtung in Austria and in the German text of the Directive, entité essentielle in French, soggetto essenziale in Italian, essentiële entiteit in Dutch and podmiot kluczowy ("key entity") in Polish.

The BSI counted 6,837 particularly important entities among 20,373 registrations on 30 September 2026, and Italy's ACN listed over 20,000 entities, of which over 5,000 essential, on 15 April 2025. The national law binds the organisation, and every Member State's status is tracked in the NIS2 transposition tracker.

What Essential Entities Must Do and How to Prepare

An essential entity has the same core duties as any NIS2 entity and can be asked to prove them at any time: register, involve the management body, apply the ten minimum measures, report significant incidents and keep audit evidence ready. The six steps are listed below.

1. Confirm the route and the national law with the NIS2 scope check.
2. Complete the NIS2 registration with the Article 3(4) data and report changes within two weeks.
3. Meet the management body duties of Article 20: approval, oversight and training.
4. Implement the ten risk-management measures of Article 21(2); the 11 entity types of Regulation (EU) 2024/2690 also apply Implementing Regulation (EU) 2024/2690.
5. Follow the NIS2 incident reporting clock: 24 hours, 72 hours, and a final report one month after the incident notification (Article 23(4)).
6. Keep evidence ready for inspections and NIS2 audits.

Annex 2 of ACN Determination 379907/2025 lists 43 measures for Italian essential entities, and ANSSI's ReCyF version 2.5 reserves objectives 16 to 20 for them, although France has not adopted its NIS2 law as of 23 October 2026.

What Would the Pending Amendment Change for Essential Entities?

One pending proposal would narrow route (a): COM(2026) 13 of 20 January 2026 (procedure 2026/0012(COD)) would make Annex I entities essential only above the small mid-cap ceilings of Recommendation (EU) 2025/1099, and as of 23 October 2026 it is pending, with the European Parliament at the stage "Awaiting committee decision" according to the EP Legislative Observatory. A small mid-cap has fewer than 750 persons and a turnover not exceeding EUR 150 million or a balance sheet total not exceeding EUR 129 million; such Annex I entities would be important, DNS service providers would follow the size-cap, and EUDI Wallet and European Business Wallet providers would be essential.

The Commission estimated that it would ease compliance for 28,700 companies, including 6,200 micro and small enterprises (IP/26/105); it and the Article 40 review of entity size due by 17 October 2027 are tracked under NIS2 amendments and review.

Essential Entity Questions

Five questions recur about essential entities under NIS2.

Are all Annex I entities essential entities?

No: an Annex I entity is essential only when it exceeds the medium-sized ceilings or meets another route of Article 3(1); a medium-sized Annex I entity is important (Article 3(2)).

Can a small company be an essential entity?

Yes, through the routes that ignore size: routes (b), (d), (e), (f) and, where national law keeps them, former operators of essential services under route (g).

Do essential entities have more obligations than important entities?

No: both have the same duties under Articles 20, 21 and 23; essential entities face ex ante supervision, the Article 32(5) escalation and the higher Article 34(4) maximum.

Who decides whether an organisation is essential?

The organisation applies the routes itself, except under Article 2(2)(b) to (e), where the Member State identifies it; the Member State then lists essential and important entities (Article 3(3), first list by 17 April 2025).

Is a former operator of essential services automatically essential?

Only where the Member State uses Article 3(1)(g): Denmark (§ 4(3) NIS 2-loven) and Luxembourg (Article 11(1) 7°) keep them as essential, and the Netherlands may designate them (Article 10 Cbw).