Important Entities under NIS2: Thresholds, Sectors and Lighter Supervision

Directive (EU) 2022/2555 of 14 December 2022 creates the category in Article 3(2). The Directive binds the Member States (Article 46), so a company follows the national law that transposes the NIS2 Directive and its two categories.

The sections below cover who qualifies, how the category differs from the essential one, supervision, fines, five national laws and one pending proposal.

What Is an Important Entity under NIS2?

Article 3(2) of Directive (EU) 2022/2555 defines important entities as entities of a type referred to in Annex I or II that do not qualify as essential entities under Article 3(1), including those a Member State identifies as important under Article 2(2)(b) to (e). The Directive text on EUR-Lex sets the scope in Article 2.

Three conditions of Article 2(1) come first: an Annex I or II type, at least medium size unless Article 2(2) to (4) applies, and services or activities in the Union. The parent page explains the sequence as who NIS2 applies to and the entity test.

How the Category Is Assigned: Residual Rule and Designation

The important category is residual: an in-scope entity is important unless one of the seven routes of Article 3(1)(a) to (g) makes it essential. Entities assess their own status, and only the Article 2(2)(b) to (e) cases need a Member State decision. National lists were due by 17 April 2025 (Article 3(3)).

Which Organisations Are Important Entities?

Four groups of organisations are important entities: medium-sized Annex I entities, medium-sized or larger Annex II entities, two digital types classified as important below set sizes, and entities a Member State identifies as important. The table lists each route with its legal basis.

Annex I and Annex II Types by Size Class

An Annex I entity that reaches but does not exceed the medium-sized ceilings is important, and an Annex II entity is important whether it is medium-sized or exceeds those ceilings, unless a Member State designates it essential. An entity is at least medium-sized with 50 or more persons, or with a turnover and a balance sheet total each above EUR 10 million. It exceeds the medium-sized ceilings with 250 or more persons, or with a turnover above EUR 50 million and a balance sheet total above EUR 43 million (Recommendation 2003/361/EC, Annex Article 2). Annex II lists 7 sectors (postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research), so an Annex position alone never fixes the category. Counting rules follow the NIS2 size thresholds and the size-cap rule.

Size-Independent Routes into the Important Category

Two digital entity types are in scope at any size and classified as important below a size limit: small and micro providers of public electronic communications networks or services (Article 3(1)(c)), and non-qualified trust service providers that do not exceed the medium-sized ceilings. Qualified trust service providers, TLD name registries and DNS service providers are essential at any size (Article 3(1)(b)), while domain name registration service providers are in scope under Article 2(4) but fall into neither category.

Identification by a Member State

A Member State can bring an entity of any size into scope on one of four grounds in Article 2(2)(b) to (e), and such an entity is important unless the Member State designates it essential under Article 3(1)(e). The grounds are sole provider of a service, impact on public safety, security or health, systemic risk, and national or regional importance.

Important vs Essential: Same Duties, Different Supervision and Fines

Important and essential entities carry the same obligations under Articles 20, 21 and 23 of NIS2, and they differ only in supervision (Article 32 ex ante and ex post against Article 33 ex post) and in the fine maximum (Article 34(4) against Article 34(5)). The category of essential entities under NIS2 covers Annex I entities above the medium-sized ceilings, central government and the other Article 3(1) routes.

Both categories apply the same 10 measures of Article 21(2)(a) to (j), the same incident clock (early warning within 24 hours, incident notification within 72 hours, final report one month after the incident notification) and the same registration duty under Article 3(4).

How Are Important Entities Supervised?

Competent authorities supervise important entities ex post: under Article 33(1) of NIS2 they act when they are provided with evidence, indication or information that an important entity does not comply with the Directive. Recital 122 calls this supervision light and ex post, never absent.

Ex-Post Triggers and Targeted Audits

Once triggered, the authority can carry out on-site inspections and off-site ex post supervision and order targeted security audits, but Article 33(2) gives it no regular or ad hoc audits for important entities. The full powers are set out under NIS2 supervision and enforcement.

The audited entity pays for a targeted audit by an independent body, unless the authority decides otherwise in duly substantiated cases (Article 33(2), third subparagraph), and the authority can request evidence of compliance with the registry duty of Article 27 (Article 33(2)(d)). Germany applies the same logic in § 62 BSIG: checks of important entities take place only where facts justify the assumption of non-compliance.

Enforcement Orders and Management Accountability

Article 33(4) gives authorities the enforcement measures of points (a) to (g), including orders to meet the Article 23 reporting duties in a specified manner and period (point (d)), but no monitoring officer and none of the Article 32(5) measures, which are the suspension of a certification or authorisation and the temporary ban on managerial functions.

Article 33(5) applies Article 32(6) to (8) mutatis mutandis: natural persons acting as legal representatives must have the power to ensure compliance and can be held liable for a breach of their duties, the Article 32(7) rules on serious infringements apply, and preliminary findings come with time for observations. Management liability under Article 20(1) remains; see NIS2 management liability.

What Fines Can Important Entities Face?

Article 34(5) of NIS2 requires Member States to provide for a maximum fine for important entities of at least EUR 7,000,000 or at least 1.4 % of the total worldwide annual turnover of the undertaking in the preceding financial year, whichever is higher.

These fines apply only to infringements of Article 21 or 23, and other breaches fall under the national penalty rules of Article 36. Fines come on top of the Article 33(4) measures (Article 34(2)).

A calculated example shows the arithmetic: an undertaking with a worldwide annual turnover of EUR 2,000,000,000 faces a maximum of at least EUR 28,000,000, because 1.4 % of that turnover exceeds EUR 7,000,000. See NIS2 fines and how Member States apply them for both maximums.

No published fine at the Article 34 level is known as of 23 October 2026, and the national maximums follow in the next section.

How National Laws Treat Important Entities

Five national laws (Germany, Austria, Belgium, Italy and Poland) keep the important category and the Article 34(5) fine amounts of EUR 7,000,000 and 1.4 % of turnover, and each attaches national conditions to them. The widest departures are the German turnover rule, the Austrian Länder rule and the Italian minimum fine; the statuses are as of 23 October 2026.

The national act binds the company, not the Directive (Article 46), so the country page of each Member State concerned decides the exact rule. The NIS2 transposition tracker lists the status of all 27 Member States.

How to Prepare as an Important Entity

Prepare for important-entity status in five steps, in this order, and keep the legal basis and the evidence of each step on file for an ex-post request.

1. Confirm type, size and category with the NIS2 scope check and the routes of Article 3(1) and 3(2).
2. Register with the national authority and submit the Article 3(4) data (NIS2 registration).
3. Have the management body approve the measures and oversee their implementation (NIS2 Article 20 management bodies).
4. Put the 10 measures of Article 21(2)(a) to (j) in place (NIS2 Article 21 risk-management measures).
5. Set up the three-stage incident reporting (NIS2 incident reporting).

What Changes Are Proposed for Important Entities?

One pending proposal would enlarge the important category: under COM(2026) 13 of 20 January 2026 (procedure 2026/0012(COD)), Annex I small mid-caps would become important entities instead of essential ones, and as of 23 October 2026 the proposal is pending, with the European Parliament at the stage "Awaiting committee decision". The Legislative Observatory dates the ITRE draft report PE792.221 to 24 September 2026 and the amendments PE796.471 to 13 October 2026.

A small mid-cap follows Recommendation (EU) 2025/1099 of 21 May 2025: it is not an SME, has fewer than 750 persons, and has a turnover not exceeding EUR 150 million or a balance sheet total not exceeding EUR 129 million. The Commission press release IP/26/105 says the proposal would ease compliance for 28,700 companies, including 6,200 micro and small enterprises, and the proposal would extend the ENISA registry to all essential and important entities. See NIS2 amendments and review for each pending change.

Important Entity Questions

Five questions recur about important entities.

Do important entities have lighter obligations?

No: Articles 20, 21 and 23 apply to important entities exactly as to essential entities, and only supervision and the fine maximum are lighter.

Can a Member State move an important entity into the higher category?

Yes: on the grounds of Article 2(2)(b) to (e) a Member State can designate an entity essential (Article 3(1)(e)), which applies to Annex II entities as well.

Must important entities register with the authority?

Yes: important entities submit the Article 3(4) data (name, contact details including IP ranges, sector and the Member States served) and report changes within two weeks.

Are important entities audited on a regular cycle?

No: Article 33(2)(b) allows only targeted security audits after a trigger, while regular and ad hoc audits are reserved for essential entities (Article 32(2)(b) and (c)). See NIS2 audits.

Can managers of important entities be held personally liable?

Yes: management bodies can be held liable under Article 20(1), and Article 33(5) applies the Article 32(6) liability of legal representatives, but the temporary management ban of Article 32(5)(b) does not apply.