Annex I sectors under NIS2: who is essential by default

Which Annex I sectors make an entity essential under NIS2

An organization is essential under NIS2 when it operates in one of the 11 Annex I sectors and exceeds the medium-sized enterprise ceilings. If your entity sits in an Annex I sector and is above those ceilings, treat it as essential unless a more specific rule in Article 3 applies. Annex I covers energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business-to-business), public administration and space. Several sectors have subsectors that matter for the label: energy includes electricity, district heating and cooling, oil, gas and hydrogen, and transport includes air, rail, water and road. Digital infrastructure and ICT service management contain the provider types most often misread, such as cloud, data center, DNS, TLD, managed service and managed security service providers.

Classification drives supervision intensity. Essential entities face ex ante supervision, meaning authorities can check compliance before an incident happens, while important entities face ex post supervision that usually starts after a problem surfaces. Both categories carry the same Article 21 risk-management and Article 23 reporting duties, so the label changes how and when you are inspected and how high the fines can go, not what you must build. Confirm the classification against the text of Article 3 and against your national transposition law, because Member States may apply their own rules on top of the Directive.

The sector label is usually the easy part. The hard part is documenting why your entity is or is not in scope: which legal entity you assessed, which activity places it in a listed subsector, how you measured headcount, annual turnover and balance sheet total against the medium-sized ceilings, and whether any group or partner entities count toward those figures. Keep a dated scope record signed by management, with the sources you relied on and the reasons for each judgment. NIS2 creates no certificate of compliance, so this record is the evidence an authority or auditor will ask for when they test your classification. Ask your legal counsel or national competent authority to confirm any borderline case in writing before you finalize the record.

Which entities fall inside the Annex I sector lists

Annex I groups eleven sectors of high criticality. Inside each sector, the sub-sector and entity-type lists decide who is covered, and an entity above the medium-sized ceilings is essential by default. The cards below group the sectors by theme and flag the scoping questions that most often change the result.

Energy subsectors

The energy sector covers electricity, district heating and cooling, oil, gas and hydrogen. Hydrogen is easy to miss because it sits alongside the traditional fuels rather than in a separate sector. Check each subsidiary against its own subsector activity, not only the parent's main business, because a group can hold an electricity generator, a heating network operator and a fuel distributor under one roof.

Transport modes

The transport sector has air, rail, water and road subsectors. Road transport is the subsector where operators often ask how far the definition reaches, so confirm with your national authority which road operators fall within the listed types. Air and water operators may also be governed by sector-specific rules, which can change the regime that applies.

Banking and financial market infrastructure

Annex I lists banking and financial market infrastructures as separate sectors. For financial entities, check first whether DORA applies, because Article 4 can displace NIS2 for entities covered by equivalent sector rules. Entities that remain in scope need to map which of their activities are regulated credit institutions and which are trading venues or clearing functions.

Health sector entity types

The health sector includes healthcare providers, EU reference laboratories, research and development of medicinal products, manufacturers of basic pharmaceutical products (NACE Rev. 2 division 21) and manufacturers of medical devices critical during a public health emergency. Hospitals and laboratories often belong to larger groups, so confirm whether each legal entity or site is the one that carries the listed activity.

Drinking and waste water

Drinking water and waste water are listed as separate Annex I sectors. Utilities commonly run shared operational technology with municipal or contracted operators, so ask who is the entity supplying or treating water in the legal sense. Responsibilities for SCADA and remote monitoring often sit with a third party, which affects who must meet the Article 21 measures.

Digital infrastructure and ICT service management

Digital infrastructure lists internet exchange points, DNS providers (excluding root name server operators), TLD registries, cloud, data center, content delivery network and trust service providers, and public electronic communications networks. ICT service management covers managed service providers and managed security service providers. Group structures matter here: a managed provider serving customers across Member States may need to confirm its main establishment under Article 26.

How the Annex I essential or important split is decided

An entity in an Annex I sector that exceeds the medium-sized enterprise ceilings is essential by default under Article 3(1)(a). Size is the deciding factor here, so the entity does not need any further designation to fall into this category. Its supervisor applies ex ante supervision, which means the authority can act before an incident and check compliance proactively, not only after a problem surfaces.

Category result: The entity is essential, and the essential category carries the heavier supervisory regime and the higher fine ceiling set out in the supervision pages.
Supervision style: Expect proactive oversight, including inspections, security audits, security scans and information requests that can start without a triggering event.
Evidence readiness: Keep current documentation of the Article 21 measures, asset inventories and risk assessments, because authorities may ask for them without notice.
Governance exposure: The management body remains accountable for approving and overseeing the measures, so board-level records matter as much as technical ones.
Ask your counsel: Confirm your headcount and turnover figures against the medium-sized ceilings and the EU SME definition, since the threshold test drives the whole outcome.

Before relying on this path, confirm the exact size test that applies in your Member State's transposing law.

How to classify your entities against Annex I

This sequence turns a question about NIS2 applicability into a documented decision: which legal entities fall under which Annex I sector and subsector, whether each is essential or important, and which national law governs them.

Confirm the legal entities and group structure
Start by listing every legal entity in the group, including subsidiaries, joint ventures and holding companies, and record which entity owns or operates each service. Legal management, compliance or the general counsel usually owns this step, with IT supplying the service inventory. The output is a group structure chart tied to registered legal names and registration numbers. The step is done when every service in the inventory points to one named legal entity, so no service sits with an unassigned company.
Map each service to an Annex I sector and subsector
For each legal entity, match its activities to the Annex I sectors: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management, public administration and space. Where a sector has subsectors, such as electricity, district heating and cooling, oil, gas and hydrogen under energy, or air, rail, water and road under transport, name the one that applies. The output is a mapping table with one row per service, sector and subsector. Confirm each row against the Annex I text on EUR-Lex, and where an activity is borderline, record the question for legal review rather than guessing.
Test size against the medium-sized ceilings
For each entity mapped to Annex I, compare its size with the medium-sized enterprise ceilings in the EU SME definition, using headcount, annual turnover and balance sheet total, measured on the basis the SME definition sets out. Finance or the company secretary typically provides the figures, and the group level and partner or linked enterprise rules can change the result. The output is a size worksheet per entity showing each figure and the threshold it was tested against. Entities above the ceilings are candidates for essential status. Ask your Member State authority or counsel to confirm how group consolidation applies to your case.
Identify other Article 3(1) routes to essential status
Check whether any entity is essential for reasons other than size. Article 3(1) contains further categories, so review the entity against each one, including whether it is a qualified trust service provider, top-level domain name registry or DNS service provider, public electronic communications provider, or a public administration body, and any other category your national law adds. The output is a short note per entity recording each category tested and the result. An Annex I entity below the ceilings can still be essential through another route, so this check cannot be skipped for small entities.
Record the classification with its reasoning
Combine the outputs of the earlier steps into a single classification decision for each entity: sector, subsector, size result, any other essential route, and the resulting category, essential or important. Legal and the accountable manager sign off, and the document is stored with the date and the version of the source texts used. The output is a signed scope register that a supervisor could read without further explanation. Re-open the register when the group structure, service inventory or size figures change, and track any pending legislative changes, such as the January 2026 Commission proposal, as a separate review item.
Check the national transposition law for the Member State
NIS2 applies through national laws, so compare each entity's classification with the transposition law of the Member State where it is established or otherwise under that state's jurisdiction. Confirm whether the national law keeps the Annex I sector list as written, adds or narrows entity types, sets its own registration process and names the competent authority. Local counsel or the national authority usually confirms this. The output is a per-jurisdiction note listing the law, the competent authority and any national additions. Treat differences between Member States as a reason to verify, not as a reason to assume the EU text applies unchanged.
Prepare the entity list for national notification
Turn the signed register into the entity list the national authority requires, with the information it asks for on each entity, such as name, address, sector, subsector, contact details and IP ranges where requested. Check the registration deadline and format in the national law, because they differ between Member States. The output is a notification-ready entity list, reviewed by legal and approved by the management body. Keep a copy of what was submitted, and set a recurring check so changes to the group are reported within the period the national law sets.

How an assessor or supervisor tests the Annex I classification

This table compares each step an assessor or supervisor takes to test whether an entity is correctly placed in an Annex I sector, what evidence they ask for, and where classifications usually fail. Read it as a checklist you can run before a supervisor does.

Test step	What the assessor checks	Evidence requested	Common finding
Scope register against Annex I	Each legal entity and service line is matched to the Annex I sector and subsector wording, such as electricity versus district heating, or cloud versus data center	Written classification register with the sector and subsector chosen for each entity and the reasoning behind it	Service lines filed under a broad sector label without a subsector decision
Unrecorded subsidiaries and affiliates	The register is compared with the group structure, including holding companies, subsidiaries and recently acquired entities	Group chart, entity list from the company registry and the date each entity was added	Subsidiaries that provide Annex I services but never appear in the register
Services assumed out of scope	Services delivered by one entity to group companies or customers are tested against Annex I, even when they are internal or free of charge	Service catalog, contracts and invoices showing which services are delivered and to whom	Shared IT, hosting or managed service functions excluded because they seemed internal
Size data against the ceilings	Headcount, annual turnover and balance sheet totals are checked against the medium-sized enterprise ceilings in the EU SME definition	Payroll extracts, audited accounts and group consolidation figures for the reference period	Group-level figures not used, or partner and linked enterprise data left out of the calculation
Sampling of group entities	A sample of entities is selected from the group and each one is traced back to its sector and size position	Sampling plan, selected entities and the classification file for each sampled entity	Sample drawn only from the largest entities, leaving smaller Annex I entities untested
Subsector mapping of service lines	Each service is checked against the subsector definitions, for example whether a managed service provider falls under ICT service management	Mapping memo linking each service line to the Annex I point and subsector	Managed service offerings classified as general IT consulting without analysis
Essential or important decision	Entities above the medium-sized ceilings are reviewed for essential status, and the others are checked for any other Article 3 category	Essential or important determination for each entity with the size test attached	Essential status assigned by sector alone without a size test, or important status given to entities above the ceilings
Change control over time	The assessor checks whether the register is updated after acquisitions, reorganizations and new service launches	Change log, board or management approvals and dated versions of the register	Register last reviewed at initial setup and not updated since

Evidence that proves an entity is correctly classified

An Annex I classification is only as strong as the records behind it. The cards below cover the documents an entity should hold to show why it is in an Annex I sector, why it is essential or important, and that the position still holds after structural or service changes.

Dated scope and classification register

This is the master record: each legal entity, the Annex I sector and subsector it falls under, its essential or important status, and the date the status was last confirmed. It is the first document a competent authority asks for. Check that every entity in the group has a row, that the sector reference points to the Annex I text, and that the register names the person accountable for keeping it current. Review it whenever a legal entity is created, acquired or dissolved.

Size calculation with source data

Annex I entities above the medium-sized enterprise ceilings are essential by default, so the headcount and financial figures behind that decision must be reproducible. Keep the extracted staff numbers, turnover, balance sheet totals and the reference period used, with the source ledger or payroll report attached. Confirm with counsel which enterprise-linking and partner-enterprise rules apply, since they can change the result. Recalculate at each reporting cycle and record the date.

Group structure chart

Control and ownership determine whether an entity is counted on its own or within a group, and which Member State it falls under. Maintain a chart showing parent, subsidiary, and affiliated entities with percentage holdings and the registered seat of each. Illustrative example: a holding company that acquires a logistics firm should see that firm added to the chart, and its headcount and turnover pulled into the size test, before the next filing. Update the chart after every acquisition, disposal or restructuring.

Service-to-sector mapping

Many entities provide several services, and only some fall within an Annex I sector. Map each service the entity delivers to the Annex I subsector it supports, such as a managed security service mapped to ICT service management, or a hospital pharmacy mapped to health. This record shows the authority why the classification is right and where the boundary lies. Review the mapping when the product catalog, customer contracts or hosting locations change.

Management body approval record

The classification is a governance decision, so the management body should approve it and the approval should be minuted. Keep the agenda item, the minutes, the approved register version and the name of each member who approved it. This links the classification to the accountability duties in Article 20. Ask the board to re-approve after any material change, and confirm the approval process against your own articles of association and internal rules.

Record of updates and notifications

Keep a change log that records each classification change, the trigger, the date of the change, and the date the change was reported to the competent authority. Entities must inform authorities of changes within a set period, so the log is the proof that the duty was met. Store prior versions so that a reviewer can see what was true on any past date. Assign one owner for the log and check it at each quarterly governance review.

What classifying Annex I entities costs in money and effort

This table compares the main cost components of working out whether an Annex I entity is essential or important, who is paid for each, and whether the cost recurs. Read it to see where internal time goes, where outside advice adds value, and what to request in a written quote. No national fee or duration figures were researched, so confirm those with your competent authority.

Cost component	Who is paid or who spends time	One-time or recurring	What drives it up or down
Internal legal and compliance review of Article 3 thresholds	Internal legal, compliance and finance staff	One-time, then repeated at each review	Number of legal entities and whether the medium-sized ceilings are tested per entity or per group
Headcount and turnover data gathering	Finance, HR and entity secretaries across the group	Recurring, as headcount and turnover change	Fragmented ledgers, unconsolidated subsidiaries and partner or linked enterprise calculations
External legal or consultant review of classification	Outside counsel or NIS2 consultants, billed by the scope agreed in writing	One-time for the initial opinion, occasional for updates	Group complexity, number of Member States and whether sector-specific law may displace NIS2
Multi-state national rule checks	Counsel in each Member State where the group operates	One-time per jurisdiction, plus updates when national law changes	Number of Member States and differences in how each transposed Annex I rules
Re-classification after a merger, acquisition or new service	Internal deal teams, legal counsel and the IT team mapping new services	Recurring, triggered by corporate or service events	Frequency of M&A activity and whether new services fall into Annex I categories such as cloud or managed services
Reporting changes to the national authority	Compliance lead and legal staff	Recurring, within the deadline set by national rules	Speed of internal change notification and the national reporting process; confirm the deadline locally

Which parts of classification you can hand to a partner

The organization owns the classification decision. Whether an entity falls within an Annex I sector, which subsector and entity type applies, and whether it is essential or important under Article 3 are legal conclusions that the entity's management body must be able to defend. An implementation partner cannot make that call for you, and a partner's report does not change it. What a partner can do is prepare the factual base the decision rests on: a system inventory that lists every network and information system in scope, a service map showing which business services depend on which systems, which third parties operate parts of those services, and where the entity's activity sits in the sector definitions. Your legal or compliance team should review that work against the Annex I text and your national transposition law, and record who approved the outcome and why.

No independent party issues a NIS2 classification certificate. Neither an auditor nor a certification body can certify that an entity is essential or important, and NIS2 creates no certificate of compliance. Instead, the national competent authority judges the record when it requests information, runs an inspection or reviews an incident report. Supervisors will look for a dated classification memo, the inventory and service map it relies on, evidence that the inventory is kept current, and proof that changes in the entity's situation triggered a fresh review. Ask any partner to deliver those artifacts in a form your team can maintain without them, and confirm with your national authority which information it expects for its list of essential and important entities.

Before you scope a partner's work, decide three things internally: who signs the classification, how often it is reviewed, and what event forces an immediate review, such as an acquisition, a new outsourced service or a change in subsidiary status. A fixed-scope engagement can build the inventory, service map and evidence register and hand them over with a runbook. The recurring part, keeping them accurate as systems and suppliers change, usually stays with your own team or a retainer. Ask any quote to separate the one-time build from the ongoing maintenance so you can see what you keep paying for after the first delivery.

Common questions about Annex I classification

Is a cloud or managed service provider automatically an essential entity under NIS2?

Not automatically by sector alone. Cloud computing providers and managed service providers fall within Annex I, so they are in scope, but the essential label depends on size. An Annex I entity that exceeds the medium-sized enterprise ceilings is essential under Article 3(1)(a), while an in-scope Annex I entity below those ceilings is generally important unless another Article 3(1) category applies. Confirm the headcount and turnover or balance sheet figures against the EU SME definition, and check whether the entity is also a provider covered by the implementing regulation, since that affects which technical requirements apply. Your national authority will confirm the final list.

What happens if our entity is just above the medium-sized ceiling?

Crossing the ceiling moves an Annex I entity into the essential category, which brings ex ante supervision instead of ex post supervision. The obligations under Article 21 and the reporting duties under Article 23 are the same for both categories, so the change is mainly about how the authority supervises you and the level of fines available under the national law. Measure headcount and financial thresholds on the basis your national rules and the SME definition require, check the reference period, and document the calculation. Ask your counsel or national authority how a borderline result is treated before you plan around it.

Do we need to repeat classification after an acquisition or merger?

Yes, you should re-run the classification whenever headcount, turnover or group structure changes, because the size test applies to the entity as it stands. An acquisition can add employees and revenue, move a company above a ceiling, or bring a new Annex I activity into your group. Article 3 also requires entities to give the competent authority information for the national list and to report changes within two weeks, so build the check into your deal process. Ask your legal team to confirm how group-level figures and linked enterprises are counted under the national transposition law.

How does Annex I relate to Annex II?

Annex I lists 11 sectors of high criticality, and Annex II lists 7 other critical sectors, which together make up the 18 sectors in scope. Entities in Annex I above the medium-sized ceilings are essential by default. Annex II entities are generally important, and a Member State may designate them essential. The same risk-management and reporting duties apply to both annexes, so the main practical difference is the supervision regime and the fine ceiling. An entity can be active in both annexes, so map each activity separately before deciding which category applies.

How long does classification take, and what does management need to do?

The duration depends on how many entities sit in your group, how clean your headcount and financial records are, and whether you operate in several Member States. Expect the work to cover mapping each activity to an Annex I subsector, collecting size data, reviewing group links and documenting the result. Management must approve the outcome, since Article 20 places oversight of the cybersecurity risk-management measures with the management body and the classification drives those duties. Ask any provider for a written scope with a timeline and named inputs, and confirm the internal owner who signs off the result.

Can a consultant make the classification decision for us?

A consultant can prepare the analysis, but the organization owns the decision and its consequences. The management body remains accountable for NIS2 compliance under Article 20, and the national authority decides on the list of entities and their status. A consultant or implementation partner can map activities to sectors, gather size data, document the reasoning and prepare the information for the authority. DeployOpen does not issue legal determinations or certifications. For a binding view, combine the analysis with advice from qualified legal counsel and the relevant national authority.

Where Annex I classifications usually go wrong

The most common Annex I error is measuring the wrong entity. Groups often take the headcount and turnover of a holding company, or of one operating unit, and apply it to the whole structure, or they assume that a small parent means a small regulated business. The size test in NIS2 is applied to the entity that carries out the Annex I activity, and the group structure, partner and linked enterprise relationships in the EU SME definition can pull in headcount and financial figures from other companies. Ask legal and finance to document, for each entity, which figures were used, which group relationships were considered and why. Assign one named owner per entity to sign off the result each year.

The second error is missing subsidiaries in other Member States. A group may have a regulated subsidiary in one country, a shared service company in another and a data center operator in a third, and each may fall under a different national transposition law and a different competent authority. Check every legal entity against every Annex I sector, not only the entities that appear on the group chart for the core business. Where the main establishment rule or the EU representative duty may apply, confirm that with counsel before you conclude which authority supervises the entity. Record the Member State of establishment and the supervisor for each entity in the register.

A third error is assuming a service is out of scope because it is a side business. Cloud, managed service, DNS, data center or trust service activities can sit inside a company whose main business is software sales, consulting or retail, and the Annex I rule looks at the service provided, not the company's reputation. Map every product line and internal service to the Annex I subsector it could fall under, and treat any doubtful case as in scope until a documented assessment says otherwise. Finally, a register that is not updated after a merger, carve-out, acquisition or reorganization becomes wrong quickly. Set a dated review trigger tied to every corporate change, with a named owner who must confirm the register within the timeframe your national law requires.

How DeployOpen prepares your Annex I scope evidence

DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, so the systems that support an Annex I entity can be shown to be in scope and under control. We prepare systems and evidence; your organization owns its classification decision, and only the competent authority or your chosen assessor reaches conclusions on it.

How we scope

Confirm which Annex I sector and subsector your entities fall under, with your legal team's classification decision recorded in writing.
Map the systems, cloud accounts and data centers that support in-scope services for Annex I Sectors of high criticality.
Agree a fixed written scope with deliverables and timelines before any implementation work begins.

How we build

Deploy self-hosted open-source platforms in your cloud accounts, data centers or air-gapped networks to match the agreed scope.
Configure logging, access control and backup so the evidence your supervisor may request is produced by default.
Run security testing of applications, APIs and infrastructure in scope, and track findings to closure.

How we hand over

Document configurations, architecture, control owners and test results in a form your team can maintain after handover.
Provide a handover of administration, runbooks and evidence collection routines to your staff.
Confirm with your auditor or competent authority which evidence formats they accept before the final package is assembled.

How we support

Offer ongoing support, upgrades and continuous testing as a retainer if your team wants continued assistance.
Review changes to your Annex I scope or national transposition rules and update documentation accordingly under the retainer.
Keep your management body informed of evidence gaps so governance decisions stay with your leadership.

Annex I Sectors of high criticality