Does NIS2 apply to our manufacturing business?
If a customer, contract or national authority now asks whether NIS2 applies to your manufacturing business, the short answer is that manufacturers listed in Annex II are covered when they meet the size test, and they are usually important entities rather than essential ones. The Annex II manufacturing sector covers medical devices and in vitro diagnostic devices, plus NACE Rev. 2 divisions 26 to 30: computer, electronic and optical products; electrical equipment; machinery and equipment n.e.c.; motor vehicles, trailers and semi-trailers; and other transport equipment. NIS2 creates no certificate of compliance, so no one can confirm coverage with a document. You establish it yourself by checking the criteria against your own facts.
Three questions decide the answer. First, does your size exceed the ceilings that make you a small enterprise under Recommendation 2003/361/EC, which the directive uses to set the medium-sized threshold? Second, does one of your activities fall within the NACE divisions or the medical and in vitro diagnostic devices definition, so that the sector applies to you at all? Third, does your Member State treat you as essential under the national transposition law, which Article 2(2)(b) to (e) and Article 3(2) allow it to do for Annex II entities. Confirm the last point with the national competent authority or the national transposition text, because the entity classification and the supervisory regime both depend on it. Also check whether you provide services or carry out activities in the Union, since that is part of the Article 2(1) test.
Document the answer before a customer or regulator asks for it. Record your headcount, annual turnover and balance sheet total, the NACE codes for each site and product line, and the national law you relied on. Ask your legal counsel or your national authority to confirm the classification in writing if your position is borderline, such as a group entity or a contract manufacturer with a different legal form. Recheck the answer when the proposed amendments to NIS2 published in January 2026 move through the European Parliament and the Council, because they include a new small mid-cap category that could change where some manufacturers sit.
Which manufacturing activities fall within NIS2 scope
NIS2 places manufacturing in Annex II, and the sector covers medical and in vitro diagnostic devices alongside NACE Rev. 2 divisions 26 to 30. Scope follows what a company actually does, so each activity below should be checked against the entity's own registration and product lines.
Medical and in vitro diagnostic devices
The manufacturing sector explicitly includes medical devices and in vitro diagnostic devices, so a company making either can fall within the sector even if its wider business looks like electronics or plastics. Check each product line against the device classes and regulatory status that apply in your market, and confirm with your national competent authority how it reads the definition. Clinical and hospital-facing obligations are covered on the healthcare sector page.
NACE division 26 electronics and optics
Division 26 covers computer, electronic and optical products, including sensors, measuring instruments, communication equipment and optical instruments. Manufacturers in this division often ship firmware and connected components, which makes their product security a live question alongside their own corporate systems. Confirm the division against your statistical registration and list every product family that falls under it.
NACE division 27 electrical equipment
Division 27 covers electrical equipment such as motors, batteries, lighting and power distribution components. Many of these products now contain networked controllers, so the question for a manufacturer is whether its equipment is only a physical good or also a digital system its customers depend on. Review each product line against the division and note which lines contain software or network connectivity.
NACE division 28 machinery and equipment
Division 28 covers machinery and equipment not elsewhere classified, including industrial machines, pumps, valves and material handling equipment. Industrial machinery is frequently operated through control systems and remote maintenance access, which links the manufacturer's own environment to the risk picture of its customers. Map each machine family to division 28 and identify which ones are sold with connected controls.
NACE divisions 29 and 30 vehicles and transport
Division 29 covers motor vehicles, trailers and semi-trailers, and division 30 covers other transport equipment such as ships, aircraft-related parts, railway stock and cycles. Vehicle and transport manufacturers face complex supply chains and connected components, so their scope review should include both finished products and major subassemblies. Confirm these divisions against your registration and record which entities in your group carry each code.
Mixed businesses and activity checks
A company is classified by its activities, so a group with several business lines must check each one against the sector list. A holding entity, a sales subsidiary or a contract assembler may sit in a different position from the production site. Document the activity mapping per legal entity, and confirm the NACE codes and the entity's status with the national authority or your legal advisers before concluding on scope.
How the size cap decides whether we are in scope
For a manufacturer, the size cap is the first test of whether NIS2 applies at all. Article 2(1) brings in entities of the Annex I and Annex II types that qualify as medium-sized enterprises under Recommendation 2003/361/EC, or that exceed those ceilings, provided they provide services or carry out activities in the Union. Entities below the medium-sized threshold fall outside the general rule unless a size-independent provision or a national designation applies, so a manufacturer should first establish its own size band before reading any sector annex. The Recommendation defines a small enterprise as one with fewer than 50 staff and an annual turnover or balance sheet total of no more than EUR 10 million. It caps SMEs at fewer than 250 staff, with turnover up to EUR 50 million or a balance sheet up to EUR 43 million.
The test is applied to the enterprise, not to the site or product line. Check headcount and financials at the level the Recommendation uses, which means consolidating partner and linked enterprise data where the rules require it, and not relying on a single factory's payroll. A group that looks small on its legal entity may fall above the ceilings once linked enterprises are counted. Confirm the calculation method with your national competent authority or a qualified adviser, and record the figures and the date you took them, because headcount and turnover move from year to year.
The Commission proposed targeted amendments to NIS2 on 20 January 2026 (COM(2026) 13), including a new small mid-cap category. That proposal has not yet been approved by the European Parliament and the Council, so it cannot be relied on for scoping today. Before planning around it, confirm its current status on the Commission's pages and in your national transposition law. Until then, treat the size bands above as the operative rule and plan for a manufacturer that sits near a ceiling to be in scope.
Important or essential: what changes for a manufacturer
Manufacturers in the medical device and in vitro diagnostic device categories, and in NACE Rev. 2 divisions 26 to 30 listed in Annex II, are generally treated as important entities. Annex II entities are important entities unless a Member State identifies them as essential under Article 2(2)(b) to (e). That national identification is the step that can move a manufacturer into the essential category, so a classification that looks settled at EU level may differ once the national transposition law is applied.
- Starting point: Annex II manufacturers are important entities by default under Article 3.
- National override: A Member State can identify an entity as essential under the points of Article 2(2) that it has adopted.
- Size condition: The entity must still fall within scope under Article 2(1), meaning it is at least a medium-sized enterprise or exceeds those ceilings, and it must provide services or carry out activities in the Union.
- Group structures: Check each legal entity separately, since a group may contain companies with different sizes and national footprints.
- Record the decision: Keep a written classification memo with the national law cited.
Confirm your national classification with the competent authority or a qualified legal adviser in each Member State where you operate, and do not rely on the sector label alone.
Important and essential entities carry the same core obligations. The Article 21 risk-management measures and the Article 23 reporting duties apply to both categories. The difference lies in how supervisors check compliance, not in the content of the duties. A manufacturer classified as important cannot treat Article 21 as optional or lighter because its status is lower.
- Risk management: Article 21 requires proportionate, all-hazards measures for network and information systems, weighed against the state of the art, relevant standards, implementation cost, risk exposure, entity size and the likelihood and severity of incidents.
- Incident reporting: Article 23 sets reporting duties for significant incidents, which apply in the same way to both categories.
- Technical detail: For many manufacturing entities, the EU-level technical requirements of Implementing Regulation (EU) 2024/2690 do not apply directly, so the national transposition rules and the Article 21 text set the bar.
- Proportionality: Proportionality does not reduce the list of required measures. It shapes how each measure is implemented.
- Documentation: Keep evidence of how each measure was chosen and why.
Check that your national law does not add stricter measures for your sector, because Article 5 allows Member States to keep or adopt higher levels of cybersecurity.
Important entities face ex post supervision. Authorities do not normally audit an important entity in advance. They act when they receive evidence, indications or information that an entity allegedly does not comply, in particular with Articles 21 and 23, as set out in Article 33(1). Essential entities face ex ante supervision, which is the key practical difference between the two categories.
- Triggers: Supervisory action can follow a complaint, a reported incident, a press report, or information shared by another authority.
- Measures: National authorities can request information, order security scans or security audits, and issue binding instructions, depending on national law.
- Evidence on hand: Being able to produce current risk assessments, policies, asset records and incident logs quickly shortens any inquiry.
- Cross-border cases: Entities operating in several Member States may face inquiries from more than one authority.
- No certificate: NIS2 creates no certificate of compliance, so a clean certificate does not close a supervisory question.
Ask your national authority how it notifies entities, what powers it uses and how it expects documents to be produced.
Article 34(5) sets the maximum administrative fine for infringing Article 21 or 23 for important entities. The ceiling is at least EUR 7,000,000 or at least 1.4% of total worldwide annual turnover in the preceding financial year, whichever is higher. The Article describes the ceiling as a minimum for the Member State maximum, so national law can set higher limits. The fine is a maximum, not an assessed amount, and any fine depends on the facts of the case.
- Two tests: The higher of the two figures applies, so for a large group the turnover test usually sets the ceiling.
- Worldwide turnover: The turnover base refers to the whole group's total worldwide annual turnover in the preceding financial year, so group structure matters.
- Factors: Article 34 lists factors such as the gravity of the infringement, the duration, previous infringements and mitigating efforts.
- National limits: Confirm the maximum in your national transposition law, since Member States may set higher ceilings.
- Other penalties: Article 36 requires penalties to be effective, proportionate and dissuasive, which can include non-monetary measures.
Ask your legal adviser to calculate the ceiling from your own consolidated accounts and national law, not from a generic figure.
Why national law decides how the measures apply to us
NIS2 is a directive, so its obligations reach a manufacturer only through the national law of each Member State where it operates. The directive, Directive (EU) 2022/2555, required Member States to adopt and publish their transposition measures by 17 October 2024 and to apply them from 18 October 2024. Where your national law is not yet in force, or differs from the directive's wording, the national text is what your competent authority will enforce. Confirm the transposition law in each country where you provide services or carry out activities, read the full text of the directive in the EUR-Lex copy of Directive (EU) 2022/2555 alongside it, and do not assume that one country's rules apply across the EU.
Article 5 allows Member States to adopt or keep rules that ensure a higher level of cybersecurity than the directive requires. A manufacturer headquartered in one country can therefore face stricter expectations in another, and the stricter rule may apply to the same products or sites. Build a register that lists, for each Member State, the competent authority, the transposition law, any sector-specific rules that overlap with NIS2, and any national duty to register. Ask counsel to confirm which entity in your group is the relevant one for each jurisdiction before you assign owners to the Article 21 measures.
Article 21(1) makes the measures proportionate, not uniform. Your measures must reflect the state of the art, relevant European and international standards where applicable, and the cost of implementation, weighed against your risk exposure, your size, the likelihood and severity of incidents, and their societal and economic impact. Document how you reached each decision, because the proportionality judgment is yours to justify to the authority. Ask your authority or counsel whether it expects a specific standard, such as ISO/IEC 27001, to be used as the reference point for that justification.
How the Cyber Resilience Act applies to our products
NIS2 and the Cyber Resilience Act answer different questions. NIS2 governs how your organization manages risk across its own systems, people and suppliers. Regulation (EU) 2024/2847, the Cyber Resilience Act (CRA), governs the cybersecurity of the products with digital elements you place on the EU market. A manufacturer in scope of both must run its NIS2 risk-management program for its factory and corporate networks while meeting separate CRA duties for each product it sells. Passing a NIS2 supervisory review does not show that a product meets the CRA, and the reverse is also true.
The CRA duty that most often reaches the manufacturer's security team is Article 14 vulnerability reporting. For an actively exploited vulnerability in a product, the manufacturer must send an early warning within 24 hours of becoming aware, a vulnerability notification within 72 hours, and a final report within 14 days after a corrective or mitigating measure is available. The reports go simultaneously to the CSIRT designated as coordinator and to ENISA through the Single Reporting Platform. Your product security team needs a documented triage process that starts the clock, a named decision owner, and a tested way to reach both recipients. Confirm with your national CSIRT which contact channel it expects.
Before you plan these steps, confirm your product scope. Check whether each product falls within the CRA's categories and whether any sector-specific rules already cover it, and read the Cyber Resilience Act text on EUR-Lex for Article 14 and Article 3 together. The Commission's guidance on applying the regulation and Commission Delegated Regulation (EU) 2026/881, which addresses delaying the dissemination of notifications, may change how and when you publish reports, so review both before setting procedures. Ask your legal counsel or a qualified adviser to confirm the classification and reporting path for each product line.
How to confirm scope in four steps
This sequence tells a manufacturer whether NIS2 reaches it, at what classification, and under which national authority, before any control work begins. Each step leaves a written record that the next step relies on.
Confirm NACE activities and device status
Start by listing every legal entity and site, then match each one's principal and secondary activities to NACE Rev. 2 divisions 26 to 30 and to the medical or in vitro diagnostic device categories. Check whether any product line is a medical or IVD device under the applicable EU device rules, since those products bring the entity into the manufacturing sector even outside divisions 26 to 30. The output is a scope memo that maps each entity and site to a sector activity, with the evidence used (registration extracts, product lists, and classification notes). Legal and product teams should sign it off together.
Measure size at group level
Count headcount and take annual turnover or balance sheet total for the entity, then add the figures for linked enterprises and partner enterprises as the SME definition requires, so that a small subsidiary of a large group is not treated as small. Use the thresholds in Recommendation 2003/361/EC as the reference point. The output is a dated size calculation per entity, with the financial year used and the source of each figure. Finance and HR should provide the inputs, and the calculation should be reviewed by someone who knows the group structure.
Identify Union activities and main establishment
Establish whether each entity provides goods or carries out activities in the European Union, including sales made from outside the Union into it. Then identify where decisions on cybersecurity measures are taken and where the entity has the most employees, because that location usually determines which Member State is competent. The output is a written record of Union activities and a main establishment statement for each entity operating in more than one country. Legal counsel should confirm the reasoning for any multi-country group.
Assign essential or important status
Apply the Annex II rule: manufacturers in these sectors are important entities unless the Member State has identified them as essential under the classification rules in Article 2(2)(b) to (e). Check the national transposition law for any such identification, any sector-specific law that may displace NIS2, and any national rule on the measures. The output is a classification table for each entity showing sector, size, status and the national basis, marked as provisional until step four is complete.
Confirm classification with the competent authority
Ask the national competent authority or its designated single point of contact to confirm the classification, the supervisory regime and the registration steps that apply in that Member State. Put the request in writing with the scope memo, size calculation and classification table attached. Record the reply, the reference number and any open questions. The closing output is a confirmed scope record that the compliance file can cite. Where the authority's answer differs from the internal reading, update the memo and the Article 21 program scope before work starts.
What we need in place before a supervisor asks
A supervisor does not need a certificate from NIS2, but it does expect a documented, owned and tested set of controls it can review. The cards below cover the four areas most often requested, and each one shows what the organization must own and what an implementation partner can prepare. DeployOpen prepares systems and evidence; the organization owns its controls, and only independent assessors or the competent authority assess them.
Documented Article 21 measures
Article 21 requires a proportionate, all-hazards approach to managing risks to network and information systems, covering at least ten minimum measures. For a manufacturer, the written policy set should tie each measure to the plants, engineering networks and product development systems in scope, not only the corporate IT estate. Check that every measure has a named owner, a current procedure and a dated record showing it runs. Where Implementing Regulation (EU) 2024/2690 applies to a provider in your supply chain, confirm how that requirement flows down to you.
Management body oversight
Article 20 places responsibility for approving and overseeing the Article 21 measures with the management body, and makes its members accountable for infringements. A supervisor will look for board or management minutes that show the risk picture was presented, the measures were approved and the budget decisions were recorded. Confirm that training for management body members is scheduled and documented, because the Article 20 training duty is one of the first things a reviewer asks to see.
Incident reporting procedures
Article 23 sets the reporting clock for significant incidents, with an early warning, an incident notification and a final report. Manufacturers often run separate processes for IT outages, plant disruptions and product security events, which makes it hard to show one decision path. Map who classifies an incident as significant, who contacts the national CSIRT or competent authority, and how the process links to GDPR breach notification when personal data is involved. Run a tabletop exercise and keep the record.
Product vulnerability handling for CRA
For products with digital elements, the Cyber Resilience Act adds vulnerability handling and reporting duties that run alongside NIS2. Under Article 14 of Regulation (EU) 2024/2847, a manufacturer must report an actively exploited vulnerability in its product to the designated CSIRT and to ENISA through the Single Reporting Platform. Check that the product security team has a published intake channel, a triage procedure, a software bill of materials and a way to issue patches, and that these records link to the NIS2 incident process rather than running in isolation.
Evidence trail and assessment readiness
Supervisors test whether controls work over time, not only whether a policy exists. Keep dated logs, access reviews, backup restore tests, change records and supplier assessments in a location the organization controls, and be able to show a sample from each area on request. Ask your implementation partner to prepare the evidence index and collection routine, and ask your independent assessor or competent authority what format it expects. Plan for ex post supervision, which starts from evidence or information that an entity may not comply.
Questions manufacturers ask about NIS2 scope
Do medical device manufacturers fall under NIS2 or the MDR?
Both can apply, and they do different jobs. NIS2 covers medical devices and in vitro diagnostic devices as part of the manufacturing sector in Annex II, so a manufacturer in that group is in scope if it meets the size and EU activity tests. The Medical Device Regulation governs conformity, safety and performance of the device itself. NIS2 governs how the organization manages cybersecurity risk and reports incidents across its systems. Compliance with one does not satisfy the other, so confirm with your national competent authority and your notified body how each obligation applies to your products and your corporate entity.
Does a NACE code alone decide whether a manufacturer is in scope?
No. The NACE code places an activity in a sector, but scope also depends on the entity's size and whether it provides services or carries out activities in the Union. Annex II covers NACE Rev. 2 divisions 26 to 30, and entities that qualify as medium-sized enterprises or larger are the ones NIS2 reaches under Article 2(1). A small manufacturer in a listed division may fall outside the directive, while a group whose parent or subsidiaries meet the thresholds may need closer analysis. Ask your national authority or legal counsel to confirm the classification using the group structure and headcount, turnover and balance sheet figures.
Can a small manufacturer become in scope through a customer contract?
NIS2 scope is set by law, not by contract. A customer cannot bring a small manufacturer into the directive by signing an agreement, but the customer can require security measures, audit rights and incident notice in its supplier terms. Those contractual duties are often where smaller manufacturers first feel NIS2 pressure, because a customer in scope must manage its supply chain under Article 21. Before committing to a program, confirm with the customer exactly which controls and evidence it requires and whether the obligations are contractual or statutory for you.
Does NIS2 require a certificate of compliance?
No. NIS2 does not create a certificate of compliance. National competent authorities oversee compliance through inspections, security audits, security scans, information requests and administrative fines. Some customers or sector bodies may ask for an ISO/IEC 27001 certificate or another assessment as a practical proof point, but that is a choice made by the organization or its customers, not a NIS2 requirement. Only an independent auditor or certification body issues such a certificate. Ask your authority which evidence it expects, because the answer shapes what you prepare.
What does a NIS2 scoping exercise cost and how long does it take?
The effort depends on how many legal entities, sites and product lines you have, how well your asset and supplier records are kept, and whether your national transposition law has been reviewed for your sector. A scoping exercise is usually a fixed-scope piece of work in which the organization's legal and compliance staff confirm entity classification, while technical staff inventory systems and products. You will need to provide group structure, headcount, turnover and balance sheet figures, a list of sites and products with digital elements, and current security policies. Ask any partner for a written scope and quote before work starts, and confirm the duration in writing.
Can an implementation partner handle NIS2 for a manufacturer alone?
No. An implementation partner can prepare systems, configurations, documentation and evidence, but the organization must own its controls, risk decisions and reporting obligations. Management is accountable under Article 20 for approving and overseeing the Article 21 measures, and no outside party can take that role. Only an independent auditor, assessor or certification body issues reports or certificates. DeployOpen plans, implements, hardens and documents self-hosted open-source platforms inside your infrastructure and prepares evidence for assessments, while your leadership and internal teams keep ownership of the program.
When does the Cyber Resilience Act apply to a manufacturer's products?
NIS2 governs your organization's own systems and processes, while the Cyber Resilience Act governs products with digital elements placed on the EU market. Under the CRA, a manufacturer must report actively exploited vulnerabilities in its product, with an early warning within 24 hours of becoming aware, a vulnerability notification within 72 hours and a final report within 14 days after a corrective or mitigating measure is available, sent to the designated CSIRT and to ENISA through the Single Reporting Platform. Start by mapping which products contain digital elements and who handles their vulnerabilities, then confirm the classification and timing with the Commission guidance and your legal advisers.
Next step: confirm scope before choosing a partner
Before you contact any implementation partner, write down three things: your scope conclusion (whether you are in scope as a manufacturer under Annex II, point 5, or as a medical or in vitro diagnostic device maker), the national competent authority that would supervise you, and the list of products and product lines in view. A partner can only price work it can see in writing. If you cannot yet say which NACE division or device category applies, that is the first task, and it usually needs your legal or compliance lead and, for regulated devices, your regulatory affairs team.
Confirm the national points with your counsel rather than assuming the EU default. Member States transpose NIS2 through their own laws, may identify some Annex II entities as essential, and may adopt stricter rules for the Article 21 measures. Check the size position against the Recommendation 2003/361/EC thresholds using your current headcount and financials, and note that the Commission's January 2026 proposal (COM(2026) 13) is still a proposal, so ask counsel how a change would affect you. Product scope also needs a decision: list which products have digital elements that may fall under the Cyber Resilience Act, so the NIS2 and product workstreams do not duplicate or contradict each other.
Then request a fixed-scope proposal. DeployOpen does not publish a price list. Each quote follows from a written scope that names the entity, the authority, the products, the systems and evidence to be prepared, the deliverables and the exclusions, and most engagements are fixed-scope with scope, deliverables and timelines agreed in writing before work starts. Ask any partner to state in writing what it will prepare and what remains your responsibility, and remember that an independent auditor or authority, not the partner, assesses compliance.
How DeployOpen scopes NIS2 readiness for manufacturers
DeployOpen is a Chainscore Labs company that plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure. For manufacturers, we prepare the systems and evidence that support NIS2 readiness, while the organization keeps ownership of its controls and any regulator or auditor issues the conclusions.
How we scope
- Confirm which entity type, NACE division or medical device activity applies, and whether the entity is classed as important or essential.
- Record the written scope of systems, sites and product lines before any work starts, agreed in writing up front.
- Identify which Article 21 measures your national transposition law requires, and where the Implementing Regulation 2024/2690 does not apply.
How we build
- Implement and harden self-hosted open-source platforms for asset inventory, access control, logging and backups in your own environment.
- Configure vulnerability handling workflows that track vulnerabilities in products and supporting software from discovery to fix.
- Test security of applications, APIs and infrastructure in scope, and record findings against the measures they affect.
How we hand over
- Deliver documented procedures, configuration baselines and evidence records that your team can maintain after the engagement ends.
- Map each delivered control to the Article 21 measure it supports, so your compliance lead can show a supervisor what exists.
- Train your staff on operating the platforms, and confirm in writing which tasks remain with management and internal owners.
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer, sized to the written scope of your program.
- Review evidence and configuration drift on a schedule agreed in the contract, so records stay current between assessments.
- Ask your independent auditor or certification body to confirm which evidence they will accept, since DeployOpen does not issue reports or certificates.
