NIS2 Sectors: All 18 Sectors of Annex I and II and the Entity Types in Each

At least medium-sized means 50 or more persons, or an annual turnover above EUR 10 million and a balance sheet total above EUR 10 million, and types such as DNS service providers are covered regardless of size.

The Annexes list entity types, not industries, mostly by reference to another EU act. The Directive is addressed to the Member States (Article 46), whose national laws had to apply from 18 October 2024 (Article 41(1)), so organisations are bound by the national law that transposes it. How the law itself works is explained under NIS2 Directive on the home page.

This page gives one table of all 18 sectors, the test that turns sector and size into a category, the sector rules that displace or add to NIS2, ENISA's 2026 risk picture and the Annex changes pending as of 23 October 2026.

Which Sectors Does NIS2 Cover?

NIS2 covers 18 sectors, listed in two annexes of Directive (EU) 2022/2555: Annex I names 11 sectors of high criticality and Annex II names 7 other critical sectors. Each sector is a group of entity types, and three sectors split their types into subsectors: energy, transport and manufacturing.

The third annex, Annex III, is only the correlation table between NIS1 (Directive (EU) 2016/1148) and NIS2 and lists no sector. The annex decides the sector; the size of the entity decides whether it is in scope and which category it receives.

NIS1 covered seven sectors of operators of essential services (energy, transport, banking, financial market infrastructures, health, drinking water supply and distribution, and digital infrastructure) plus three types of digital service: online marketplaces, online search engines and cloud computing services. NIS2 keeps all of them and adds new sectors in both annexes, and the full scope shift is compared under NIS2 vs NIS1.

Annex I: The 11 Sectors of High Criticality

Annex I lists 11 sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business-to-business), public administration and space. Four of them are new against NIS1: waste water (point 7), ICT service management (point 9), public administration (point 10) and space (point 11).

Health (point 5) now reaches beyond the health care settings of NIS1 to EU reference laboratories, medicinal research, pharmaceutical manufacturing and makers of critical medical devices. Energy (point 1) has 5 subsectors and 19 entity types: seven in electricity, one in district heating and cooling, three in oil, seven in gas and one in hydrogen. Transport (point 2) has 4 subsectors (air, rail, water and road) and 10 entity types.

Annex II: The 7 Other Critical Sectors

Annex II lists 7 other critical sectors: postal and courier services, waste management, the manufacture, production and distribution of chemicals, the production, processing and distribution of food, manufacturing, digital providers and research. Online marketplaces and online search engines were already digital service types under NIS1; every other Annex II entry is new, social networking services platforms included.

Every essential and important entity submits its name, contact details, sector and subsector, among other data, and reports changes within two weeks (Article 3(4)). Member States had to establish their lists of essential and important entities by 17 April 2025 and review them at least every two years (Article 3(3)). What that data covers is set out under NIS2 registration.

All 18 NIS2 Sectors and Their Entity Types

The table lists all 18 NIS2 sectors in Annex order, with the Annex point, the subsectors and entity types as the Annex names them, the EU act that defines each type, and whether the sector was already in NIS1. Entity types are shortened from the Annex wording.

Read each row by entity type, not by industry label. An organisation matches a row when it meets the definition in the "Defined by" column; the size test in the category section then decides whether it is in scope and which category applies.

How the Annexes Define Each Entity Type

Each Annex entry defines its entity types by pointing to another EU act or to an Article 6 definition, so an entity is in a sector when it meets that act's definition, not when it shares an industry label. NACE Rev. 2, the EU statistical classification of economic activities, decides only two entries: pharmaceutical manufacturing in Annex I point 5 (division C21) and Annex II point 5(b) to (f) (divisions C26 to C30). Every other type rests on a legal definition, and how activities map to the codes is explained under NIS2 and NACE codes.

Banking (Annex I point 3) covers credit institutions as defined in Article 4(1)(1) of Regulation (EU) No 575/2013. Research (Annex II point 7) covers research organisations under Article 6(41) of NIS2, a definition that expressly does not include educational institutions.

The defining act also separates look-alike sectors: medicinal research (Article 1(2) of Directive 2001/83/EC) and C21 manufacturing belong to Annex I health, not to Annex II manufacturing. Manufacturers of medical devices and in vitro diagnostic medical devices fall under Annex II point 5(a), unless their devices are on the critical devices list under Article 22 of Regulation (EU) 2022/123, which places them in Annex I point 5.

Carve-Outs Written into the Annex Entries

Seven Annex entries exclude part of their own entity type, and each carve-out is listed below with its Annex point.

• DNS service providers: not operators of root name servers (Annex I point 8).
• Water transport companies: not the individual vessels (Annex I point 2(c)).
• Road authorities: not public entities for which traffic management or intelligent transport systems are non-essential (Annex I point 2(d)).
• Drinking water distributors: not those for which it is a non-essential part of distributing other goods (Annex I point 6).
• Waste water undertakings: not those for which it is a non-essential activity (Annex I point 7).
• Ground-based space infrastructure operators: not providers of public electronic communications networks (Annex I point 11).
• Waste management undertakings: not those for which it is not the principal economic activity (Annex II point 2).

These carve-outs narrow a type from within. Exclusions that remove whole groups of bodies from scope are covered under NIS2 exclusions.

Recital 12 limits postal services: transport without a step of the postal delivery chain, such as sorting or distribution, is not a postal service.

From Sector to Category: How Size Decides Essential or Important

An entity of an Annex I or II type is in scope when it is at least medium-sized, and its category follows from annex and size: Annex I entities above the medium-sized ceilings are essential, and every other in-scope Annex entity is important unless the law names it essential regardless of size. A medium-sized Annex I entity is therefore important (Article 3(2)), and a large Annex II entity becomes essential only by designation (Article 3(1)(e)).

The size test applies Article 2 of the Annex to Recommendation 2003/361/EC (Article 2(1) NIS2). An entity exceeds the medium-sized ceilings with 250 or more persons, or with a turnover above EUR 50 million and a balance sheet total above EUR 43 million (Article 3(1)(a)). Public ownership does not make an entity large, because Article 3(4) of that Annex does not apply. Partner and linked enterprises count under the size-cap rule.

Table 2 gives the category for each case, with its legal basis.

The category changes supervision and the maximum fine, not the Article 20, 21 and 23 duties. Essential entities are supervised ex ante and ex post (Article 32), important entities ex post (Article 33). The maximum fine is at least EUR 10,000,000 or 2 % of total worldwide annual turnover, whichever is higher, for essential entities (Article 34(4)) and at least EUR 7,000,000 or 1.4 %, whichever is higher, for important entities (Article 34(5)). Regional public administration enters scope only after a risk-based assessment (Article 2(2)(f)(ii)).

Sector Rules That Replace or Add to the NIS2 Baseline

All 18 sectors carry the same NIS2 baseline of management duties, risk-management measures and incident reporting, and two kinds of EU rule change it per sector: a sector-specific Union act that displaces NIS2 (Article 4), and Implementing Regulation (EU) 2024/2690 for 11 digital entity types. Article 4 removes NIS2 provisions only where the sector act is at least equivalent in effect, and the Implementing Regulation adds directly applicable technical requirements for the types it lists.

When a Sector-Specific Union Act Takes Over

Under Article 4(1), where a sector-specific Union act requires measures at least equivalent to Article 21(1) and (2) or reporting at least equivalent to Article 23(1) to (6), the matching NIS2 provisions, including supervision under Chapter VII, do not apply.

The Commission's non-binding Guidelines 2023/C 328/02 on Article 4(1) and (2), published on 14 September 2023 (OJ C 328, 18.9.2023, p. 2), discuss only one such act: DORA, Regulation (EU) 2022/2554, which has applied to financial entities such as credit institutions since 17 January 2025. DORA displaces NIS2 Articles 20, 21 and 23 and Chapter VII for them, while Articles 7, 9 and 16 still apply, and the overlap is compared under NIS2 vs DORA.

Where a sector act covers risk management, the guidelines state that registration and Article 20 should not apply, although Member States may still list such entities. The electricity network code on cybersecurity (Delegated Regulation (EU) 2024/1366) and aviation Part-IS (Delegated Regulation (EU) 2022/1645 and Implementing Regulation (EU) 2023/203) add rules but are not Article 4 equivalents, so the NIS2 duties still apply.

Which Sectors Have EU-Level Technical Rules

Implementing Regulation (EU) 2024/2690 sets the technical measures and significant-incident thresholds for 11 digital entity types only: DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking services platforms and trust service providers.

The 11 entity types of Regulation (EU) 2024/2690 sit in three sectors: digital infrastructure (Annex I point 8), ICT service management (Annex I point 9) and digital providers (Annex II point 6). Internet exchange point providers, telecoms providers, domain name registration service providers and every entity in the other 15 sectors fall outside it. No implementing act under Article 21(5) exists for them, so they follow the national list of Article 21(2) measures. The annex and the thresholds are explained under Implementing Regulation (EU) 2024/2690.

How Critical and Mature the Sectors Are: ENISA NIS360

ENISA's NIS360 report, whose third edition was published on 28 May 2026, rates the Annex I sectors of high criticality by criticality and cybersecurity maturity and places health, railway, maritime, ICT service management, space, public administrations, drinking water and waste water in its risk zone. The rating is ENISA's assessment, not a legal category: an entity in a risk-zone sector carries the same NIS2 duties as any other entity of its category.

Three of the eight moved into the risk zone in the 2026 edition: railway, drinking water and waste water. Gas started moving out of it, and space joined banking, electricity, aviation and digital-by-default services among the most critical sectors. The previous edition, NIS360 2024, was published on 5 March 2025, and ENISA summarises the 2026 changes in its NIS360 news release.

Pending Changes to the Sector Annexes as of 2026-10-23

As of 23 October 2026, the Commission proposal COM(2026) 13 of 20 January 2026 would change entries in both Annexes, but it is pending: the European Parliament lists it as "Awaiting committee decision" (procedure 2026/0012(COD)). The ITRE committee's draft report is dated 24 September 2026 and the amendments 13 October 2026.

The proposal would make the nine changes to the sector map listed below.

• Electricity producers of 1 MW or less out of the energy sector.
• Hydrogen redefined around Directive (EU) 2024/1788.
• Providers of intelligent transport system services added to transport.
• A narrower healthcare-provider entry.
• European Digital Identity Wallet and European Business Wallet providers added.
• Submarine data transmission infrastructure added.
• DNS service providers moved under the size test.
• Chemicals renamed "Manufacture and production of chemicals", with distribution removed.
• Annex I entities essential only above the small mid-cap ceilings of Recommendation (EU) 2025/1099.

Each proposal is tracked under NIS2 amendments and review.

The Commission estimates that the proposal would ease compliance for 28,700 companies, including 6,200 micro and small enterprises; manufacturing, postal services and public administration would stay unchanged. Article 40 separately requires a Commission review by 17 October 2027, then every 36 months, that assesses entity size and the Annex sectors.

What the Sector List Does Not Decide

A listed sector names the entity types NIS2 can reach, but it does not settle on its own whether a given organisation is in scope, what its suppliers must do, or which extra bodies a Member State adds. The three questions below take each point in turn.

Is Every Organisation in a Listed Sector in Scope?

No: a listed entity type is in scope only when the size test is met or the law covers it regardless of size, and it must provide services or carry out activities in the Union (Article 2(1)). The full test is set out under who NIS2 applies to. Public administration entities active in national security, public security, defence or law enforcement are excluded (Article 2(7)).

Are Suppliers to a Listed Sector Covered?

Not directly: NIS2 obliges the in-scope entity to address security in its relationships with its direct suppliers and service providers (Article 21(2)(d)), so a supplier meets NIS2 through contracts unless its own type is listed. Supply chain security is one of the 10 minimum measures of Article 21(2), and a medium-sized managed service provider, for example, is in scope in its own right under Annex I point 9.

Can a Member State Add Sectors or Entity Types?

Yes: the Directive sets minimum harmonisation (Article 5) and lets Member States cover local public administration (Article 2(5)(a)) and education institutions (Article 2(5)(b)), and designate further entities on the grounds of Article 2(2)(b) to (e).

Italy's Legislative Decree (D.Lgs.) 138/2024 covers, in Allegato III, metropolitan cities, municipalities with more than 100,000 inhabitants, regional capitals and local health authorities (ASL). Germany sets out its sectors in Anlage 1 and Anlage 2 of the BSIG. Each national law is tracked in the NIS2 transposition tracker.