NIS2 for online marketplaces, search engines and social networks

Online marketplaces, online search engines and social networking services platforms are listed in Annex II of NIS2, the sectors of other critical importance. Under Article 3, entities in Annex II are treated as important entities by default. That means they face the same Article 21 risk-management duties and Article 23 reporting duties as essential entities, but their supervision is ex post, meaning authorities act after a problem appears rather than through routine pre-approval of the controls. The definitions for these services come from outside NIS2: online marketplaces and online search engines take their meaning from Directive 2005/29/EC and Regulation (EU) 2019/1150, while social networking services platforms are defined in Article 6(33).

• Default status: Annex II providers are in scope as important entities unless a Member State classifies them as essential.
• Ex post supervision: Authorities typically act on evidence after an incident, a complaint or a request for information.
• Same duties: Important status does not lower the Article 21 measures or the Article 23 reporting clock.
• Definitions matter: Check whether your service meets the legal definition of a marketplace, search engine or social platform before assuming it is in scope.

Confirm with your national competent authority or legal counsel whether your service falls under one of these definitions and how your Member State has transposed Article 3.

Article 3 allows a Member State to identify an Annex II provider as essential under the criteria in Article 2(2)(b) to (e). Essential status changes the supervision model, moving the provider to ex ante supervision, and it is a national decision, so the same platform could be treated differently depending on where it is established or where its national law places it. Buyers should not assume a platform's status from its sector alone. The status is a classification question for the Member State, and the answer should be confirmed in writing, not inferred from a peer's situation.

• National decision: Classification is made under the national transposition law, not by the Commission.
• Possible change: Essential status can apply even though the default for Annex II is important.
• Different supervision: Essential entities face ex ante supervision, which usually involves more upfront evidence requests.
• Documentation: Keep the classification decision or the national register entry as part of your compliance file.

Ask the competent authority of your Member State how Annex II online platforms are classified in its transposition law, and request the classification in writing if it applies to you.

Article 26(1)(b) places online marketplaces, search engines and social networks under the jurisdiction of the Member State where the provider has its main establishment in the Union. A provider has one supervising Member State for NIS2 purposes, even if it serves users in many countries. This avoids parallel regimes, but it means that the national authority of the main establishment carries the supervisory role, and the Article 21 and Article 23 obligations are applied through that state's law. Establishment is a factual question about where the provider's decisions on cybersecurity and operations are taken and where it is registered, so the answer should be documented rather than assumed.

• One Member State: The main establishment determines the single jurisdiction for supervision.
• Documented decisions: Record where cybersecurity and operational decisions are made to support the position.
• Group structures: Parent and subsidiary arrangements need a clear view of where the main establishment sits.
• Cross-border users: Serving users in other Member States does not by itself move supervision.

Review your corporate structure with counsel to confirm the main establishment, and record the reasoning in your compliance file.

Article 26(3) addresses providers listed in Article 26(1)(b) that offer services in the Union without being established there. Such a provider must designate a representative in a Member State where it offers services. The representative is the point of contact for authorities, and it is the anchor for legal action. If no representative is designated, any Member State where the provider provides services may take legal action against it. This makes the designation a practical risk control, not an administrative formality. Your organization owns this decision, and the representative must be appointed by the provider itself. An implementation partner can help prepare the records, but it cannot issue the designation.

• Who needs it: Non-EU providers of marketplaces, search engines or social platforms that offer services in the Union.
• Where to designate: In a Member State where the services are offered.
• Consequence of silence: Without a representative, any Member State where services are provided may bring legal action.
• Records: Keep the written designation, the representative's contact details and the date it took effect.

Confirm with counsel which Member States you offer services in, and confirm the representative's role and contact requirements with the relevant national authority.

Article 27(2) required Member States to require these providers to submit registration information by 17 January 2025. The information goes to the competent authority so that the entity appears in the national registry that supervisors use to contact providers and direct requests. Registration is not a certificate of compliance. It is an administrative step that tells authorities who you are and where you can be reached. Because the deadline has passed, a provider that has not registered should treat that as an open gap to close with its national authority immediately, and should verify the details that were submitted are still accurate.

• Deadline: Member States had to require submission of registration information by 17 January 2025.
• Content: Typically includes the entity's name, address, contact details and the Member States where it provides services, as set by national rules.
• Updates: Changes to contact details or establishment should be reported as national rules require.
• No certificate: A registry entry does not show that Article 21 measures are in place.

Check your registration status with the national competent authority, confirm the content your Member State requires, and correct any outdated details.

The online marketplace, search engine or social networking service provider remains the entity bound by NIS2. Its management body approves and oversees the Article 21 risk-management measures, and the organization carries the legal responsibility for compliance, for its risk decisions and for every report it files with the competent authority. No outside firm can take those duties over.

• Controls and policies: The organization decides which measures apply to its services, adopts the written policies and accepts residual risk.
• Decisions and accountability: Management signs off on risk treatment, budgets, supplier choices and the scope of the Article 21 program.
• Incident reporting: The organization makes the early warning, notification and final report under Article 23 and informs affected service recipients when required.
• Registration and representation: It handles the registry entry and, where it is established outside the Union, designates its EU representative.
• Evidence ownership: Its staff can explain how each control works and keep the records that show it.

Before engaging anyone, confirm which of these duties sit with named people in your organization and which you intend to delegate in writing.

An implementation partner such as DeployOpen works on the platform's systems and documentation under a written scope. It helps plan, build, harden and document the self-hosted open-source components that support the controls, runs security testing and training, and prepares the evidence that the platform's team and its assessors will review. The partner does not decide the risk position and does not issue any report or certificate.

• System preparation: The partner configures logging, access control, backup, patching and monitoring in the platform's own infrastructure.
• Evidence preparation: It assembles configuration records, test results and runbooks that show how controls operate.
• Security testing and training: It can run application, API and infrastructure tests and staff exercises, with findings delivered to the platform's team.
• Documentation handover: The platform's team receives the material it needs to maintain the controls after delivery.
• Limits: The partner cannot sign attestations, approve risk acceptance or file reports on the platform's behalf.

Ask for a written statement of which deliverables are prepared, which are the platform's responsibility and which parties receive the final documentation.

National competent authorities supervise compliance under the transposition law of the Member State where the platform is established. For important entities, supervision is ex post, meaning authorities act when they have evidence of non-compliance, through information requests, inspections, security audits, security scans and administrative fines. Independent assessors may also be engaged by the platform to test its controls, but their conclusions are their own and carry no regulatory status unless a supervisor relies on them.

• Supervisory powers: Authorities can request information, inspect premises and order audits or scans under Articles 32 to 34 of NIS2.
• Ex post supervision: Online platforms in Annex II are important entities unless a Member State designates them as essential, so the trigger is usually a concern or an incident.
• Independent assessment: An external assessor or auditor can test a platform's controls and report findings to the platform.
• No certificate: NIS2 provides no certificate of compliance, so no body issues a general NIS2 certificate for the platform.
• Framework reports: Where a customer asks for an ISO/IEC 27001 certificate or a SOC 2 report, a certification body or CPA firm issues that document, which is not a NIS2 certificate.

Confirm with your national competent authority which supervision approach it applies and what evidence it expects.