Annex II Other critical sectors: requirements and evidence

Which NIS2 Annex II sectors put an entity in scope

If your company makes, ships, processes, distributes or hosts something, NIS2 may apply to you through Annex II even if you are not a utility or bank. An entity falls in scope when its activity matches one of the seven other critical sectors listed in Annex II and it is above the size thresholds that apply to that sector. Annex II covers postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research. Entities in these sectors are classified as important by default, unless the Member State where they are established identifies them as essential. The first decision is therefore sector fit, and the second is the national classification, which you should confirm with your competent authority rather than assume.

The sector wording decides most disputes. For manufacturing, Annex II covers medical devices and in vitro diagnostic devices plus NACE Rev. 2 divisions 26 to 30, which take in electronics, electrical equipment, machinery, motor vehicles and other transport equipment. Food businesses are covered when they engage in wholesale distribution or industrial production and processing, so a retail-only operation may fall outside. Waste management undertakings are excluded where waste management is not their principal economic activity, so a manufacturer with a small recycling arm should document its main activity. Map each legal entity in your group to the NACE code of its principal activity and record the reasoning, since this file is the first thing a supervisor will ask for.

Digital providers in Annex II are online marketplaces, online search engines and social networking services platforms. A B2B software vendor or hosting business is not automatically in this category, but it may fall under Annex I digital infrastructure or ICT service management instead, so check both annexes. Ask your legal or compliance team to write a short scope memo for each entity, listing the Annex sector, the activity relied on, the size test result and the expected classification. Revisit the memo when your activities change, and watch the Commission's January 2026 proposal (COM(2026) 13), which is still a proposal and does not yet change these sector definitions.

Annex II scope decisions that change the work

Annex II sectors are scoped by activity, not by company label, so the same business name can land in or out of NIS2 depending on what it actually does. Each card below names the scoping choice that changes the program and the record the entity should keep to justify it to a national authority.

Manufacturing scope by NACE division

Annex II covers medical devices and in vitro diagnostic devices, plus NACE Rev. 2 divisions 26 to 30, which include computer and electronic products, electrical equipment, machinery, motor vehicles and other transport equipment. Map each production site and product line to its NACE code before deciding coverage. Keep the code assignment, the revenue split by activity and the organization chart that shows which unit makes covered goods, so the scope decision can be shown later.

Food wholesale and industrial production

Food businesses are covered only when they engage in wholesale distribution or industrial production and processing, so retail outlets and small-scale kitchens typically fall outside. The test is the activity the entity performs, and a group may have covered and uncovered entities side by side. Document each legal entity's activity mix and the threshold it uses to separate wholesale from retail, and review that record when the business model changes.

Chemicals manufacture and distribution

The chemicals sector covers the manufacture, production and distribution of chemicals, so a company that only imports, repackages or resells finished chemicals may be covered on a different basis than a producer. Confirm with the national authority how the Member State reads distribution in its transposition law. Record which substances, production steps and sales channels the entity handles, since these facts decide whether it falls within the sector.

Postal and courier service providers

Postal and courier providers are an Annex II sector, and the scope question is whether the business actually provides postal or courier services as a core activity. Logistics firms that move goods for their own use, or that offer delivery only as an incidental add-on, need a documented reason for their position. Keep the service catalog, the revenue lines and the operational dependencies on networks and systems, because those show how much of the operation a supervisor would examine.

Waste management as principal activity

Waste management undertakings are excluded where waste management is not their principal economic activity, so a manufacturer or utility that handles waste as a side function usually falls outside this sector. The decision turns on the principal activity, which the entity must establish from its own accounts and operations. Keep a dated analysis of revenue, staffing and asset use that shows waste management is or is not the main business, and repeat it when the mix changes.

Digital providers and platform scope

Digital providers in Annex II are online marketplaces, online search engines and social networking services platforms. A company that offers a marketplace feature inside another product, or a search function that is not a standalone engine, needs to test whether that feature is the covered service. Record the service features, the user base that uses them and the architecture decisions, since the main establishment rule for these providers depends on the same facts.

How a national authority tests Annex II classification

This table compares the steps a national competent authority typically takes to confirm that an entity falls within an Annex II sector, the evidence it asks for, and the findings that come up most often. Read it as a checklist for your own pre-assessment: each row is a question the authority can ask, and a gap in any row can move an entity into or out of scope.

Test step	Test approach and evidence the authority asks for	Findings that come up most often
Confirm the sector match	Check which Annex II sector the entity's activities fall under, using the sector definitions and the entity's own description of its business. Expect requests for the statutes, licences and a description of products or services.	Entities classed under the wrong sector because one product line drove the classification while the main revenue came from another.
Check activities against NACE divisions and Annex II definitions	Map each activity to the relevant NACE Rev. 2 division, for manufacturing usually divisions 26 to 30, and to the medical device or in vitro diagnostic wording. Expect a product or activity register with NACE codes.	Misread or outdated NACE codes, and activities listed under a general code that hides a covered manufacturing line.
Check the principal-activity test for waste and food	Test whether waste management is the principal economic activity, and whether food activity is wholesale distribution or industrial production and processing. Expect revenue or turnover breakdowns by activity.	Retail or catering activity counted as food processing, or waste handling treated as principal when it is a side activity.
Check the national designation	Confirm whether the Member State has identified the entity as essential rather than important under its transposition law, and whether any national list or register applies. Expect the entity's registration and any correspondence with the authority.	Entities assuming they are important without checking the national list, or missing a registration step after designation.
Check the size position and group structure	Confirm headcount, turnover and balance sheet figures against the size-cap rules, and map parent, subsidiary and linked enterprises. Expect group charts, consolidated figures and the reference period used.	Unrecorded group structures, subsidiaries left out of headcount, and stale financial data used for the size test.
Record the classification decision	Keep a dated, signed classification memo that states sector, activity codes, principal-activity findings, national status and size position. Expect this memo to be produced on request.	No written record, or a memo that is not updated after acquisitions, reorganizations or new product lines.

Why Annex II entities are important by default

An in-scope Annex II entity starts as an important entity. Under Article 3 of NIS2, the Annex II sectors (including manufacturing, food, chemicals, postal and courier services, waste management, digital providers and research) are classed as important unless a Member State identifies the entity as essential under the criteria in Article 2(2)(b) to (e). The default matters because it sets the supervisory regime before any national decision is made. Your starting assumption should be important status, and you should treat any move to essential status as a documented outcome that you must confirm, not an assumption you can make in your favor.

The classification changes how authorities supervise you, not what you must do. Essential entities face ex ante supervision, meaning authorities can check compliance before an incident occurs. Important entities face ex post supervision, meaning authorities act mainly after they receive evidence of a failure, a report or other indication of non-compliance. Both categories carry the same Article 21 risk-management duties and the same Article 23 reporting obligations. A manufacturer that assumes lighter obligations because it is important will be wrong on the controls and will still need its 24-hour, 72-hour and one-month reports ready. The practical difference lies in when a regulator can look at your evidence and how fines are calculated, which the supervision section covers in detail.

The national list is where the outcome can differ. Member States decide how they apply the Article 2(2) criteria to Annex II entities, so two companies in the same sector and of the same size may be treated differently across borders. Before you plan, confirm the designation in the national transposition law of each Member State where you operate or provide services, and check whether the authority has published a list or requires you to register. Ask your legal team to record the source and date of that check, because the designation determines which authority supervises you and what evidence it will request. Re-check the position when national law changes or when the proposed NIS2 amendments of January 2026 move through the legislative process.

Confirming your Annex II position in six steps

This sequence turns a general question about whether NIS2 applies into a documented position for each legal entity and activity. It produces a file that management, customers and the national competent authority can read, and it shows why each entity is or is not in scope as an important entity.

Map every legal entity and its activities
Start with the group structure and list each legal entity, branch and subsidiary that carries out economic activity in the EU. For each one, record the activities it performs, its products or services, its customers and the Member States where it operates. Owners are the legal and finance teams, supported by operations leads who know what each entity actually does. The step is complete when the activity register lists every entity and every activity, with the source document for each line, such as an articles of association extract or a product catalogue.
Match each activity to an Annex II sector
Compare each activity in the register against the seven Annex II sectors: postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research. Where the activity falls within manufacturing, check the medical device and in vitro diagnostic wording as well as the NACE Rev. 2 divisions 26 to 30 that Annex II names. Record the sector and the NACE division for each match. The output is a sector memo for each entity that states the matched sector, the reasoning and any activity that matched no sector at all.
Apply the size test to each entity
Test each entity against the size thresholds that NIS2 applies to Annex II entities and check whether the entity is a medium or large enterprise under the EU SME definition, including partner and linked enterprise data. Entities that fall below the cap may still be in scope through other provisions, so confirm the treatment with the scope rules before concluding. Finance teams usually hold the headcount and balance sheet figures, and they should record the source and reference date. The output is a size worksheet that sits alongside each sector memo.
Record principal activity reasoning for borderline cases
Some entities sit on the edge of a sector definition. Waste management undertakings are excluded where waste management is not their principal economic activity, and food businesses are covered only when they engage in wholesale distribution or industrial production and processing. For each borderline entity, write down the revenue or activity split, the principal activity conclusion and the evidence behind it. Legal counsel should review the memo before it is relied on. The output is a signed-off borderline memo that shows why the entity was included or excluded.
Check the national designation and classification
Annex II entities are important entities unless the Member State identifies them as essential under the national rules. Check the transposition law of each Member State where the entity operates, and look for any designation, list or threshold that changes the classification. Confirm with the national competent authority or a qualified counsel where the published rules are unclear. The output is a national position note for each Member State that records the classification, the source and the date the check was made.
Notify the authority where registration is required
Where the national rules require in-scope entities to register or provide information, prepare the registration record using the activity register, sector memo and national position note. Management approves the submission, and the entity keeps a copy with the date and the reference returned by the authority. Confirm the deadline and format directly with the authority, as these vary by Member State. The closing output is a registration record and a file of supporting evidence that can be shown to a supervisor on request, and this file should be reviewed when the group structure or activities change.

What scoping an Annex II position costs

This table breaks down the cost components of deciding whether an entity sits in an Annex II sector, who is paid for each one, and whether it is a one-time or recurring effort. Use it to see where spending concentrates and what to ask for in a written, fixed-scope quote, since no prices or durations are published for this work.

Cost component	Who is paid, and for what	One-time or recurring	What drives it up, and how to keep it down
Internal legal and compliance time	Your own legal, compliance and management staff, who confirm activities, revenue mix and group position	One-time, then recurring at each review	Drives up: unclear activity records. Keep down: maintain a current activity and NACE register so the position can be shown quickly
Sector and NACE analysis	Internal staff or an outside adviser who maps each activity to the Annex II wording, including NACE Rev. 2 divisions 26 to 30 for manufacturing	One-time, refreshed when products or activities change	Drives up: mixed-activity entities with several product lines. Keep down: analyze by legal entity and product line rather than by group headline
National law review	Counsel in each relevant Member State to confirm how the transposition law designates or classifies the sector	One-time per Member State, then recurring when national law changes	Drives up: operations in several Member States. Keep down: confirm which Member State has jurisdiction before reviewing local rules
Group structure mapping	Internal finance or legal staff, sometimes with an adviser, to map parents, subsidiaries and shared sites	One-time, then recurring after acquisitions or reorganizations	Drives up: complex holding structures and shared production sites. Keep down: keep a legal entity chart updated with each transaction
Contested waste or food positions	Outside legal opinion on whether waste management is the principal activity, or whether food activity is wholesale or industrial	One-time per contested position, sometimes repeated on challenge	Drives up: mixed collection, recycling and trading revenue, or retail-adjacent food activity. Keep down: document the principal activity test with revenue and operational evidence
Outside legal opinion where the position is contested	External counsel, written opinion on classification and the essential or important question	One-time per opinion, updated if facts change	Drives up: disputed classification with regulator contact. Keep down: define the question precisely and provide complete factual records
Periodic re-checks after activity changes or amendments	Internal staff for monitoring, counsel or adviser for interpretation of amendments such as the January 2026 proposal	Recurring	Drives up: frequent product launches and pending legislative change. Keep down: schedule a fixed review and tie it to change management

Who owns the Annex II decision, who helps and who decides

The organization owns its classification decision. Its management body and legal function decide whether each entity falls within an Annex II sector, whether it is a manufacturer, food business, waste undertaking or digital provider in the sense the Directive uses, and what position the organization will take with its national authority. That position is accountable to the management body, which also carries the duties NIS2 places on it for approving and overseeing the risk-management measures.

Owns the written position: Records the scope conclusion for each legal entity, with the Annex II sector and activity relied on.
Sets the threshold questions: Decides how to read terms such as principal economic activity and whether a Member State has designated the entity as essential.
Signs off on changes: Approves reassessment when products, customers or group structure change.
Handles the authority channel: Makes the registration and notification filings that the national transposition law requires.
Decides on external advice: Commissions and accepts any independent legal opinion.

Before relying on the position, confirm with counsel which national transposition law applies and which deadlines it sets for registration and for reporting changes.

Where Annex II scoping usually goes wrong

Annex II scoping errors rarely come from misreading the law. They come from relying on paperwork that describes what a company was registered to do, rather than what it actually does today. The cards below cover the gaps we see most often and the check that closes each one.

NACE codes taken from registration

Many organizations classify themselves by the NACE codes on their commercial register entry. Those codes can be years old and rarely reflect the revenue actually earned. For Annex II, check the activities that generate the business: a company registered as a holding or trading entity may still run production or processing. Pull turnover by activity for the last financial year and test each activity against the Annex II wording, not the code label. Confirm the result with your national competent authority guidance, since Member States apply the sector definitions in their own transposition laws.

Subsidiaries never mapped

A group can have an in-scope subsidiary that nobody at group level has tested. Operating companies in food processing, chemicals or manufacturing often sit under a parent whose registration suggests a different sector. Build a legal-entity register for the whole group, record each entity's activities and headcount, and test every entity separately. Ask the group legal team to confirm ownership links, because a missed entity is still in scope for the reporting and management duties that apply to the group.

Waste and food without a principal-activity test

Waste management is covered only where it is the principal economic activity, and food businesses are covered when they engage in wholesale distribution or industrial production and processing. Many companies with mixed activity never write down how they reached their conclusion. Record a short, dated principal-activity analysis with revenue shares, the activities considered and the reasoning. Ask counsel to review it, and keep it with the scoping file so an authority can see how the decision was made.

Medical device activity assumed out of scope

Manufacturers often assume that medical devices and in vitro diagnostic devices fall outside NIS2 because they are regulated under a separate product regime. Annex II includes them within the manufacturing sector, alongside NACE divisions 26 to 30. Check every product line, including devices made under contract or sold through a subsidiary, against the Annex II text. Where a sector-specific law might displace NIS2 for a given activity, document that analysis separately rather than assuming it.

Digital provider definitions unchecked

Annex II covers providers of online marketplaces, online search engines and social networking services platforms. Companies that run a community forum, a seller portal or a search feature inside another product often never test those features against the platform definitions. Inventory every public-facing service, state which ones let users transact, search or interact with each other, and record the conclusion for each. Also check the main establishment rules for digital providers, since they determine which Member State supervises the entity.

No owner for re-scoping

Scope changes after an acquisition, a new product line, a disposal or a shift in revenue mix. A scoping analysis done once and filed away becomes wrong quietly. Name one accountable owner, usually the head of compliance or legal, and set a trigger list: mergers, new business lines, material revenue shifts and annual financial close. Each trigger should reopen the Annex II test and update the register. Confirm with management that the owner has authority to request information from every group entity.

Questions buyers ask about Annex II scope

Can an Annex II entity decide for itself that NIS2 applies to it?

Yes, in practice you assess your own position first, but the decision has to be defensible. An entity in one of the seven Annex II sectors is in scope only if it meets the definition in its sector and is above the size threshold that applies to it. You then check whether it is an important entity, which is the default for Annex II, or whether your Member State has identified you as essential. Your national competent authority will test that reasoning through information requests, and it can ask for the basis of your scoping decision. Record the sector test, the size test, the group structure and the national list check in writing, with a date and an owner. Confirm the exact national transposition law and any registration duty with your national authority, because the procedure differs between Member States.

Do we need a consultant to scope NIS2 for an Annex II business?

A consultant is not legally required, but many organizations buy outside help for the scoping exercise because the sector definitions and national rules are easy to misread. The work usually covers mapping legal entities and their activities to the Annex II wording, checking size against the applicable thresholds, reviewing group relationships and confirming the national position. An implementation partner can prepare the asset inventory and technical facts that support the decision, but the organization keeps ownership of the classification and the sign-off. Ask any provider to state which deliverables they produce, who approves the conclusion, and whether they will document assumptions for the authority. DeployOpen plans and documents engagements on a fixed-scope basis, with the scope agreed in writing before work starts.

How long does an Annex II scoping exercise take?

The duration depends mainly on group size and the number of Member States involved. A single entity operating in one country with a clear activity profile can be scoped much faster than a group with several legal entities, mixed activities across Annex I and II, and subsidiaries registered in multiple countries. Each additional jurisdiction adds a check against its transposition law and any national list. Before you commit, ask the provider to state the timeline in the written quote, along with the number of legal entities in scope, the jurisdictions covered and the points where the client must supply information. A fixed-scope quote should name both the duration and the assumptions behind it, so changes to the group structure can be handled through a documented change request.

Can we do the Annex II scoping in-house?

Yes, many organizations scope NIS2 internally, especially when they have a clear group structure, a compliance function and access to legal advice on national law. The in-house team needs three inputs: a current register of legal entities and their activities, the size data for each entity measured against the applicable thresholds, and a reading of the national transposition law. Legal counsel is often needed for the national question, while a security or compliance lead handles the sector mapping. The risk of in-house scoping is missing a subsidiary, a product line or a supplier relationship that changes the answer. Keep a documented review date so the decision is revisited when the group changes or the rules move.

Does being an important entity instead of essential reduce our NIS2 work?

No, important and essential entities face the same risk-management duties under Article 21 and the same incident reporting duties under Article 23. The difference lies in supervision and penalties. Essential entities are supervised ex ante, meaning authorities can act before an incident, while important entities are supervised ex post, after evidence suggests a failure. The security program you must build is the same either way, so budget and plan for the full set of measures. Being important may reduce the intensity of proactive oversight, but the evidence you keep must still show that each measure is in place and working. Confirm the supervisory approach and fine regime in your Member State's transposition law.

What happens if our classification changes after the proposed NIS2 amendments?

A change depends on whether the amendments are adopted and how your Member State transposes them. On 20 January 2026 the Commission proposed targeted amendments to NIS2 (COM(2026) 13), including a new small mid-cap category. The proposal still needs approval by the European Parliament and the Council, so it is not current law. If it is adopted, your size and classification position may change, and you would need to reassess scope. Build the scoping record so that the size data, sector mapping and national assumptions can be rerun quickly. Track the proposal's progress and your national implementing rules, and agree with your provider how a change in law would be handled as a documented change request.

Which Annex II sectors are most often misclassified?

The most frequent errors occur in manufacturing, food and waste management, because the definitions turn on activity rather than on the company's name. In manufacturing, the category includes medical and in vitro diagnostic devices and several NACE Rev. 2 divisions, so a company may be covered even if it considers itself a general industrial business. In food, coverage depends on whether the entity engages in wholesale distribution or industrial production and processing. Waste management undertakings are excluded where waste management is not their principal economic activity. Review each legal entity against the activity wording in Annex II, not only against the group's headline business. Confirm edge cases with your national authority or counsel before you rely on them.

How DeployOpen works on this

DeployOpen helps organizations that think they may fall under the Annex II sectors check their scope and prepare evidence for the classification. We plan, build and document the systems involved, while the organization keeps ownership of its scope decision and the national authority decides how entities are treated.

How we scope

We agree a written scope listing the Annex II activities, entity types and systems to be reviewed before work starts.
We map which business lines fall under manufacturing, food, chemicals, postal, waste, digital provider or research activity.
We record the Member State question and flag where a national authority must confirm essential or important status.

How we build

We deploy self-hosted open-source platforms for asset inventory, configuration records and access logs inside your environment.
We configure the systems so they produce the evidence a supervisor would ask to see for in-scope activities.
We test the configured controls against the written scope and record the gaps we find in a remediation list.

How we hand over

We deliver a scope memo, system documentation and an evidence index tied to each in-scope activity.
We train your named staff to run, maintain and update the platforms and records after handover.
We leave decisions on classification, filings and sign-off with your management body and its legal advisers.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer agreed in writing.
We can re-check scope when your activities change, acquisitions close or the national transposition law is updated.
Ask us to confirm the deliverables, responsibilities and review dates in your written scope before you commit.

Annex II Other critical sectors