Article 3 NIS2 essential and important entities: requirements

How NIS2 Article 3 sorts entities into essential or important

Article 3 of NIS2 sorts every in-scope entity into one of two categories: essential or important. The category changes how national authorities supervise the entity and how high the maximum fines can go. It does not change the Article 21 risk-management measures or the Article 23 reporting duties, which apply to both categories in the same way. An entity that has confirmed it is in scope should therefore treat classification as a supervisory question, not a question of how much security work it owes. The essential list in Article 3(1) is the first test. It covers Annex I entities above the medium-sized ceilings, qualified trust service providers, TLD name registries and DNS service providers of any size, medium-sized or larger public electronic communications providers, central government entities and critical entities under Directive (EU) 2022/2557. Member States may also add entities they identified as operators of essential services under the first NIS Directive before 16 January 2023. Anything in scope that does not meet these tests is important under Article 3(2), including entities a Member State designates as important. Classification is often harder than it looks because group structures, the size of a specific legal entity versus its group, and national designations can each move an organization between categories. Confirm the national transposition law and the competent authority's guidance before settling on a category.

Once the category is settled, Article 3(4) requires the entity to give its competent authority at least its name, address and contact details, including email addresses, IP ranges and telephone numbers, its Annex I or II sector and subsector, and the Member States where it provides services. Any later change to these details must be notified without delay and in any event within two weeks of the change. Some Member States run national self-registration mechanisms, so the practical step is to find out which portal applies and who inside the organization owns it. A managed registry entry that goes stale after an acquisition, a new IP range or a new country of service is a common compliance gap. The Commission has published guidelines on Article 3(4) to help with these questions, and they are worth reading alongside the national rules before filing.

Which entities Article 3 applies to and how the category is set

Article 3 sorts in-scope entities into essential or important. The category depends on the sector annex, the size of the entity, and a few entity types that are essential regardless of size. Work through these decision points in order before deciding which category applies.

Annex I or Annex II sector

Start by identifying which annex covers the entity's activity. Annex I lists the 11 sectors of high criticality, such as energy, transport, health and digital infrastructure. Annex II lists 7 other critical sectors, such as manufacturing, food, postal services and research. An entity in an Annex I sector that exceeds the medium-sized ceilings is essential by default. An entity in an Annex II sector is generally important unless a Member State designates it as essential. Check the subsector against the annex text, not the trade name of the business.

Medium-sized ceilings

For Annex I entities, size decides whether the entity is essential or important. Entities above the medium-sized ceilings in the EU SME definition fall in the essential category. Ask your national authority or legal counsel how group structures, partner enterprises and linked enterprises are counted, because headcount and turnover may aggregate across a corporate group. Record the calculation and the date you made it, since the category can change when the figures change.

Trust service and DNS and TLD providers

Some entities are essential whatever their size. These include qualified trust service providers, TLD name registries and DNS service providers. If your organization operates any of these services, the size test does not apply, and the essential category follows from the service type. Confirm whether the service you provide meets the legal definition in the directive, because a similar name or product line does not establish the category.

Public communications and central government

Medium-sized or larger public electronic communications providers are essential. Central government entities also fall in the essential category under Article 3(1). Check whether your organization is a public electronic communications provider in the sense the directive uses, and whether it is a central government entity as defined by your Member State. Local government and other public bodies depend on national choices and may follow a different path.

Critical entities and prior essential services

Entities identified as critical under Directive (EU) 2022/2557 are essential. Member States may also treat operators they identified as operators of essential services under the first NIS Directive before 16 January 2023 as essential. Ask your competent authority whether your earlier identification carries over, and keep the identification letter or record. Do not assume the earlier list maps automatically to the current annexes.

Member State designation route

Entities that fall within scope under Article 2(2)(b) to (e) can be designated by a Member State. Any in-scope Annex I or II entity that does not qualify as essential is important, including those designated under these points. Ask the national authority whether it has designated your entity, and in which category. Designation decisions are national, so the same business can be classified differently across Member States.

How a supervisor tests the essential or important classification

This table compares each step a national competent authority is likely to take when testing an entity's classification, the evidence it will ask for, and the mismatches that most often appear. Read it as a checklist for what to have ready before a supervisor asks, since the national authority decides how its checks are run. The main takeaway is that classification errors usually come from stale registration data rather than from disputes over the law.

Supervisory check	What the authority compares	Evidence it will ask for	Common finding
Registration match	Submitted name, address and contacts against the entity's current records	Registration form, legal entity extract, named contact list	Stale contact details or a departed named contact
Sector and subsector	Declared Annex I or II sector against the services the entity actually provides	Service catalogue, revenue or activity breakdown, licence or permit listings	Sector declared from an old business line or left blank
Size test	Headcount, turnover and balance sheet against the medium-sized ceilings	Latest annual accounts, headcount records, group consolidation details	Size assessed at legal entity level without checking linked enterprises
Group structure	Parent, subsidiary and partner relationships that may change the size or essential status	Group chart, ownership records, list of entities in the group	Subsidiary treated as independent when it is linked to a larger group
Essential or important category	Entity type and size against the essential criteria, plus any national designation	Written classification rationale, national designation letters where they exist	Category recorded as important where a qualifying criterion applies
Change notices	Dates of material changes against the date the authority received an update	Change log showing notices sent, with dates and recipients	Changes made in the business but not reported within two weeks
Member State link	Countries where services are provided against the registration filed	List of service countries, establishment records, EU representative details for non-EU providers	Services offered in other Member States without the matching filing
Response to a mismatch	Whether the entity corrects the record and explains the cause	Corrected submission, root-cause note, updated process owner	No owner for the registration, so corrections take longer than the authority expects

Steps to classify an entity and file its registration

This sequence takes an organization from a scope question to a filed, maintained registration record. Each step ends with an output that the next step depends on, so the classification can be defended to a national authority.

Confirm scope and sector against Annexes I and II
Start by confirming that the organization is in scope at all. Identify which Annex I or Annex II sector and subsector its services fall under, and note any sector-specific EU law that may displace NIS2 for part of the business. Owner: the legal or compliance lead, with input from the business unit that delivers the services. Output: a written scope memo naming the sector, the subsector and the services that bring the entity in. Confirm the final scope test with the national competent authority or a qualified adviser where the position is unclear.
Test the Article 3(1) essential triggers
Work through each essential category in Article 3(1) in turn: Annex I entities above the medium-sized ceilings, qualified trust service providers, TLD registries and DNS service providers of any size, medium-sized or larger public electronic communications providers, central government entities, and critical entities under Directive (EU) 2022/2557. Also check whether the Member State has carried over operators of essential services identified under the first NIS Directive. Owner: legal counsel with the finance function, since headcount and turnover figures drive the ceiling tests. Output: a trigger-by-trigger table showing which tests were met, which were not, and the evidence behind each answer.
Apply the important default to remaining entities
Any Annex I or Annex II entity in scope that does not meet an essential trigger is an important entity under Article 3(2). Include entities a Member State has designated as important under Article 2(2)(b) to (e). Record the classification as a decision, not an assumption, and state the reason. Owner: the same team that completed the trigger test, with sign-off from the management body. Output: a single classification decision (essential or important) per entity or per legal entity in a group, with the rationale attached.
Assemble the Article 3(4) registration data set
Collect the details the competent authority requires: the entity name, address and contact details, including email addresses, IP ranges and telephone numbers, the Annex I or II sector and subsector, and the Member States where the entity provides services. IP ranges and contact mailboxes usually sit with IT and network teams, so assign each field a named owner. Owner: compliance lead, with IT and network operations supplying technical fields. Output: a validated data set in one controlled record, checked against the classification from the previous step.
File through the national registration mechanism
Submit the data set through the channel the Member State has set up. Some Member States run self-registration portals, while others use a different procedure, so confirm the exact route with the national competent authority before filing. Keep the submission receipt and a copy of every field as filed. Owner: the designated registration contact. Output: a filing confirmation and an internal copy of the submitted record, dated and stored with the classification memo.
Set a change-notification process
Article 3(4) requires entities to notify changes to submitted details without delay and in any event within two weeks of the change. Build triggers into existing processes: acquisitions, new Member State operations, new IP ranges, changes to sector activity, and staff changes to listed contacts. Assign an owner for each trigger and a single point of record. Owner: compliance lead, with change management and procurement as trigger sources. Output: a written procedure, a trigger list and a test showing that a change to a contact or IP range reaches the registration record within the two-week limit.
Re-check classification and records periodically
Repeat the trigger test and compare the registration record against actual systems and contacts on a fixed review cycle set by the organization. Re-run the classification whenever turnover, headcount, sector activity or group structure changes, since the ceilings and triggers depend on those facts. Owner: compliance lead, reporting to the management body. Output: a dated review record confirming that the classification and the filed details still match reality, or a change notice filed where they do not.

What essential versus important status changes in practice

The classification between essential and important entities changes how authorities watch you and how large the fines can be, but it does not change the security work you must do. Both categories face the same Article 21 risk-management measures and the same Article 23 reporting duties. An important entity that treats its status as a lighter regime will be out of step with the law from the first day, because the measures and the 24-hour early warning, 72-hour notification and one-month final report apply in full. The practical question for management is therefore not which label applies, but whether the program would satisfy an inspector working under either regime.

The difference lies in supervision. Essential entities face ex ante supervision, meaning authorities can check compliance before an incident or complaint triggers action, while important entities face ex post supervision, meaning authorities act mainly once evidence suggests a failure (Articles 32 and 33). For an essential entity, expect that inspections, security audits and information requests may arrive without a prior trigger, so the evidence for each Article 21 measure must be kept current rather than assembled on request. The maximum administrative fines also differ under Article 34(4) and (5). Read the national transposition law of your Member State to confirm how it applies these ranges, and ask your legal counsel to model the exposure for your entity type and turnover basis.

Before relying on a classification, confirm it with your national competent authority and with the national list you submitted under Article 3(4). The proposed amendments of 20 January 2026 (COM(2026) 13), including a new small mid-cap category, are a proposal that still needs approval by the European Parliament and the Council, so do not plan around them as settled law. Record which assumptions you made, review them when the amendment progresses, and check that any change to your details is notified within the two-week deadline, because a reclassification you did not track can leave the program built for the wrong regime.

Evidence that proves the classification and registration

Article 3 classification is only as credible as the paper behind it. The cards below cover the records an entity should hold to show how it was classified, what it submitted, and how it has kept those details accurate since. Each one needs an owner and a review point, because the registration duty continues after the first submission.

Scope and classification memo

A dated memo that records each service the entity provides, its Annex I or Annex II sector and subsector, the size test applied, and why the entity is classed as essential or important. Record the legal reasoning, including any Member State designation under Article 3(1)(g) or Article 3(2). Ask counsel to confirm the reading against the national transposition law, and reopen the memo whenever the group structure or service mix changes.

Copy of the submitted registration

Keep the exact dataset sent to the competent authority, with the submission date, the reference returned and the person who approved it. Store it unchanged in the evidence repository so that a later supervisor can compare it with the live data. Check that it includes the name, address, contact details, sector and subsector, and the Member States where services are provided, as Article 3(4) requires.

National confirmation or reference

Retain any acknowledgment, registration number or confirmation letter from the national authority. Where a Member State runs a self-registration portal, export the entity record and capture the screen state with a date. If the authority has issued no confirmation, record that gap and the follow-up request, since an unanswered registration is hard to defend in an inspection.

Group entity and Member State register

Maintain a register listing every legal entity in the group, its registered address, the Annex sector it falls under, and each Member State where it provides services. Mismatches between this register and the submitted record are a common source of inconsistent filings. Assign an owner to reconcile the two at each review and after any acquisition or disposal.

IP range and contact inventory

Build an inventory of the public IP ranges, domains and contact mailboxes and telephone numbers the entity has submitted or relies on for supervisory contact. Tie each item to a named role, such as the security contact or the incident reporting desk. Verify the list against cloud accounts and DNS records each quarter, because stale ranges and unmonitored mailboxes undermine the registration.

Change log for registration updates

Record every change to the submitted details with the date it occurred, the date it was notified, the approver and the evidence used. Article 3(4) requires notice without delay and in any event within two weeks of the change, so the log should show that interval for each entry. Test the process with a tabletop change, such as a new hosting provider, so the team knows who files the update.

What classification and registration cost in money and effort

This table breaks down the people, advice and systems work behind classifying an entity and registering its details with the competent authority. Read each row for who is paid, whether the cost is one-time or recurring, and what pushes it up, then use the last column to shape your quote request. No fees or durations are given because none were supplied for this topic.

Cost component	Who is paid or who does the work	One-time or recurring	What drives it up or down
Internal legal and compliance time	Your own legal, compliance and company secretarial staff, who test the Annex I or II sector fit and the size ceilings	One-time for the initial classification, then recurring when group structure or services change	Number of legal entities, sectors served and how well existing group records are kept
External legal advice on Member State rules	Outside counsel licensed in each Member State where you provide services, who confirms transposition rules and the registration channel	One-time for the first mapping, recurring for updates after national law changes	Number of Member States, whether a national self-registration portal exists and whether local counsel must confirm sector rules
Contact and IP inventory build	Your IT, network and operations teams, with platform or managed service support where systems are self-hosted or cloud-based	One-time for the baseline inventory, recurring as addresses and ranges change	Size of the IP estate, number of cloud accounts and data centers, and whether an asset register already exists
Designated contact and authority liaison	Internal staff or an outside adviser who holds the authority relationship and receives correspondence	Recurring, usually absorbed into existing governance roles	Whether one contact covers all entities or each subsidiary needs its own named person
Change monitoring and two-week notification process	Internal owners for mergers, new services, new IP ranges and new Member States, plus any tool used to watch for them	Recurring for the life of the entity	Frequency of corporate restructuring, pace of cloud expansion and how quickly change requests reach the compliance owner
Group and multi-country coordination	Group compliance lead and subsidiary contacts, sometimes supported by an outside adviser who coordinates filings	One-time setup, recurring coordination for each new filing or change	Number of subsidiaries, differences between national rules and whether the parent or each subsidiary files
Records to keep for evidence	Internal records owner, with storage handled in your own environment	Recurring, low marginal cost once the register is in place	Retention periods set by national law and the level of detail your authority asks for

Who classifies the entity, who files, and who decides

The management body and the legal owner of the entity decide how the entity sees itself under Article 3. That means confirming whether the entity is in scope at all, which Annex I or II sector and subsector applies, and whether the entity falls in the essential or important category. The category drives supervision and maximum fines, so it is a governance decision, not a clerical one. Management is also accountable for the Article 20 duties, so the classification rationale should be approved and recorded at board or equivalent level.

Scope decision: Record why each service the entity provides does or does not fall within an Annex I or II sector.
Category decision: Approve the essential or important outcome and the reasoning behind it, including any Member State designation.
Accountability: Confirm that the entity, not an adviser, answers to the authority for every submitted detail.
Re-approval triggers: Set a rule that material changes, such as new markets or acquisitions, return to the board for review.
Documentation: Keep the approved decision and its date in the governance record that supervisors may request.

Check that the board minutes name the decision owner and that the rationale matches the service map the team actually maintains.

Where entities get Article 3 wrong and how to close the gap

Most Article 3 mistakes come from treating classification as a one-time label instead of a set of facts that change with the business. The cards below cover the errors we see most often in scoping work, and the checks that keep the registration accurate after the entity is on the national list.

Size alone does not decide category

Many organizations assume a large headcount or revenue automatically makes them essential. Under Article 3, the sector annex, the entity's size against the medium-sized ceilings, and the specific categories in Article 3(1) all matter. An Annex I entity above the ceilings is essential by default, while an Annex II entity in scope is generally important unless a Member State designates it otherwise. Fix: document the sector test and the size test separately, and record which Article 3 paragraph places the entity in its category.

Missing group subsidiaries

Parent companies often register themselves and overlook subsidiaries, branches or service entities that provide covered services in the EU. Each entity in scope has its own submission duty, its own sector and subsector, and its own list of Member States where it provides services. Fix: map the legal entity structure against the services each entity delivers, then confirm with national counsel which entities must register in which Member State before the first submission.

Outdated IP ranges and contacts

The submission must include contact details such as email addresses, telephone numbers and IP ranges. These details drift as staff leave, cloud accounts change and new egress points are added, and a stale record can mean the authority cannot reach the right person during an incident. Fix: assign an owner for the registration record, review IP ranges and contacts on a fixed internal schedule, and reconcile them with the asset inventory after every infrastructure change.

Missing the two-week change deadline

Article 3(4) requires entities to notify changes to submitted details without delay and within two weeks of the change. Mergers, acquisitions, carve-outs, new sectors and reorganizations often trigger changes that nobody connects to the registration. Fix: add a registration review step to the change management and M&A checklists, and set a named owner who has seven days to confirm the update, leaving time to file within the two-week limit.

Carrying over old NIS status

Some entities assume that being an operator of essential services under the first NIS Directive makes them essential under NIS2 automatically. Article 3(1)(g) lets Member States treat those entities as essential, so the outcome depends on the national decision, not on the old label. Fix: ask the national competent authority how it applied the transition rule, get the classification in writing, and check whether the entity's supervisory regime and fine ceiling match that decision.

Treating registration as a one-time task

Once the submission is filed, many teams stop reviewing it, even though the sector, subsector, service footprint and contacts can all change. Classification also affects which supervisory regime applies, so an outdated record can misstate the entity's obligations. Fix: schedule an annual full review of the classification basis, the sector mapping and the Member State list, and log each review so the organization can show the authority how it keeps the record current.

Questions buyers ask about Article 3 classification

Can an entity decide for itself whether it is essential or important?

No. The classification follows from the sector annex, the size of the entity and the specific categories in Article 3(1), and the Member State's national law applies those rules. An entity can work out its likely category by checking its Annex I or II sector, its size against the medium-sized ceilings, and whether it falls into a named essential category such as a qualified trust service provider or a DNS service provider of any size. Where the rules leave room, the national competent authority decides, and Member States may designate an entity as essential even when the default would be important. Ask your national authority which categories it applies, and record your reasoning in writing so you can show how you reached your position.

How much effort does NIS2 registration take?

The effort is mostly information gathering. Under Article 3(4), you must give the competent authority your name, address, contact details including email addresses, IP ranges and telephone numbers, your Annex I or II sector and subsector, and the Member States where you provide services. Effort rises with the number of IP ranges, legal entities, subsidiaries and countries involved, and with how current your asset inventory is. Some Member States offer a national self-registration mechanism, which may be a simple online form. Check your national portal for the form and deadline, and assign one owner to keep the submitted data accurate. Internal staff can usually do this work, but a consultant can help when the group structure is complex.

Do we need a consultant to classify the entity?

Not always. Classification is a legal and factual exercise that the organization owns, and many entities with a simple structure can complete it with legal and security staff. A consultant adds value when the group has several subsidiaries, operates across Member States, or has unclear sector boundaries. Ask any consultant to show the sector mapping, the size calculation and the list of data points they will submit, and confirm who signs the final submission. Fees depend on the number of entities, jurisdictions and sectors in scope, and on whether the work is a one-time review or ongoing support. Ask for a fixed-scope quote with written deliverables. DeployOpen does not issue legal opinions on classification, but it can prepare the asset inventory and technical data that the submission relies on.

What changes if our entity is reclassified from important to essential?

The security duties stay the same. Article 21 risk-management measures and Article 23 reporting apply to both categories. What changes is supervision and penalties: essential entities face ex ante supervision, meaning oversight before any incident, while important entities face ex post supervision, meaning oversight after an incident or evidence of non-compliance. Under Article 34, maximum fines are higher for essential entities. Reclassification may also mean more frequent inspections and information requests, so keep your evidence current. Confirm with your national authority when a reclassification takes effect and what it expects you to provide.

How do we meet the two-week deadline for reporting changes?

Article 3(4) requires you to notify changes to your submitted details without delay and in any event within two weeks of the change. Set up a trigger list that includes new IP ranges, changed contact details, new sectors or subsectors, new Member States of service, mergers, acquisitions and disposals. Assign an owner, and link the trigger list to your change management and procurement processes, so that a new cloud region or subsidiary prompts a review. Keep a dated record of each change and each notification. Check whether your Member State offers an online update function, and test it once so the process works under pressure.

How could the July 2026 proposal affect our category?

The Commission proposed targeted amendments to NIS2 on 20 January 2026 (COM(2026) 13), including a new small mid-cap category. The proposal still needs approval by the European Parliament and the Council, and Commission pages updated through July 2026 describe it as a proposal. Until it is adopted and transposed, the current Article 3 rules apply. Monitor the legislative progress, and assess how any new category would affect your classification and your national transposition. Plan your current compliance program so that it does not depend on the outcome, because the Article 21 measures are likely to remain the core of your work whatever the final text says.

Which evidence supports our classification if a regulator asks?

Keep a classification file that records the sector and subsector you matched, the size data you used against the medium-sized ceilings, any national designation or prior operator-of-essential-services status, the Member States where you provide services, and the date and content of each submission. Include the reasoning for any judgment call and the source of each figure. Store the file in a controlled repository with version history, and review it whenever the group structure, services or sector changes. The Commission's guidelines on applying Article 3(4) can help you structure the file, and your national authority can confirm what it expects.

Primary sources for Article 3

The primary source for Article 3 is the consolidated text of Directive (EU) 2022/2555 on EUR-Lex, which you should read at the Article 3 anchor rather than relying on secondary summaries. Article 3 is short, but its effects are not. It sets the test for whether an in-scope entity is essential or important, lists the categories that are essential by default, and defines the information you must give your competent authority, including names, addresses, contact details such as email addresses, IP ranges and telephone numbers, your Annex I or II sector and subsector, and the Member States where you provide services. Read paragraphs 1 to 4 against your own entity profile before you decide what you must submit. Confirm the version you cite against the official journal text, since national transposition laws may add detail that the directive leaves open.

The European Commission's NIS2 policy page is the second source to keep open. It gives the Commission's overview of the directive, links to the implementing regulation and related guidance, and shows how the rules are being applied across the Union. Use it to confirm whether the Commission has issued any guidelines on applying Article 3(4), which the directive requires it to produce with ENISA's assistance, and to check that you are working from the current material. Treat the page as a navigation aid and an orientation to the policy, not as legal authority. The binding obligations sit in the directive and in your national transposition law.

Before you rely on either source for a classification decision, ask your legal or compliance lead to record which national law applies to you and which competent authority receives your details. Also confirm whether your Member State offers a self-registration mechanism, because Article 3(4) allows one and the registration route determines how and when you must notify changes within two weeks. Keep a dated copy of the text you relied on. If a Commission proposal to amend NIS2 is later adopted, the wording you rely on may change, so re-check the consolidated text at each review point.

How DeployOpen prepares classification and registration evidence

DeployOpen helps organizations assemble the facts an Article 3 classification and registration depends on: the sector and subsector, the Member States where services are provided, and the contact details the competent authority asks for. We prepare the systems and records that hold this information, and the organization keeps ownership of the classification decision and the submission itself.

How we scope

Engagements are fixed-scope, with the written scope naming the entity records, sectors and Member States covered.
We confirm with you which Annex I or II sector and subsector each entity falls under before any work starts.
The scope states who inside your organization approves the classification and the registration details.

How we build

We set up a maintained register of entity name, addresses, contact details, email addresses, IP ranges and telephone numbers.
We document the Member States where each service is provided and link each entry to its owner and source system.
We build a change-tracking process so updates to registered details are flagged for notification within the two-week window.

How we hand over

You receive the classification record, the registration data set and the change log in formats your team can maintain.
We document the procedure for submitting or updating details to your national competent authority, including who signs off.
Handover includes a written explanation of which items remain your responsibility after the engagement ends.

How we support

Ongoing support and retainers are available if your entity structure, sectors or service locations change often.
We can review the register after reorganizations, acquisitions or new service launches, against the written scope.
Before relying on the register, confirm with your national authority which registration mechanism and format it uses.