NIS2 Directive: what it covers, who it applies to, and how incident reporting works

NIS2 sorts in-scope organisations into two supervisory categories: essential entities and important entities. The European Commission's policy page describes the directive as reaching "medium-sized and large entities" across critical sectors, broadening coverage well beyond the original NIS Directive. The Commission's summary lists sectors carried over from NIS1, energy, transport, healthcare, finance, water management and digital infrastructure, alongside sectors newly added by NIS2:

Exact size thresholds and which specific entities fall under "essential" versus "important" per sector are set out in the directive's annexes; the Commission's FAQ page checked for this guide does not itemise them, so confirm against the official text or your national transposing law before relying on a self-assessment.

Most device makers that fall under NIS2 at all are important entities, through the manufacturing sector in Annex II. Two tests in Directive (EU) 2022/2555 decide it.

Sector test. Annex II, point 5, "Manufacturing", lists six subsectors:

Size test. Article 2(1) applies the directive to entities that qualify as medium-sized under Commission Recommendation 2003/361/EC, or exceed those ceilings. In that Recommendation:

• a medium-sized enterprise employs fewer than 250 persons, with an annual turnover up to EUR 50 million and/or a balance sheet total up to EUR 43 million;
• a small enterprise employs fewer than 50 persons, with turnover and/or balance sheet up to EUR 10 million, and is outside the general size rule;
• under its Article 6, the data of partner and linked enterprises are added, so a small subsidiary of a larger group can still be in scope.

Category. Under Article 3(1)(a), Annex I entities above the medium-sized ceilings are essential by default; Annex II entities are not on that list. An Annex II manufacturer is therefore an important entity under Article 3(2), unless its member state designates it essential under Article 2(2)(b) to (e), for example as the sole national provider of a service essential for critical societal or economic activities. Member states had to establish their lists of essential and important entities by 17 April 2025 (Article 3(3)), and listed entities must report changes to their registration details within two weeks (Article 3(4)).

Article 21(2) lists ten measures, points (a) to (j), which every essential and important entity must cover on an "all-hazards" basis; these are the "10 key elements" the Commission FAQ refers to. The right-hand column is our example for a device maker's own operations, not text of the Directive.

Two further articles matter. Article 21(3) asks entities to take into account their suppliers' "overall quality of products and cybersecurity practices", "including their secure development procedures", so NIS2 customers send security questionnaires to device makers even where the maker itself is out of scope. And Article 20 requires management bodies to approve the measures, oversee their implementation and follow training; they "can be held liable" for infringements. For digital infrastructure and managed service providers, Implementing Regulation (EU) 2024/2690 sets the technical detail of each measure.

The Commission's FAQ sets out a staged reporting obligation once an entity becomes aware of a "significant incident":

The table paraphrases the Commission's plain-language FAQ. The legal source is Article 23(4) of the Directive, which also sets what each stage must contain:

• Early warning (24 hours): whether the incident is suspected of being caused by unlawful or malicious acts, or could have a cross-border impact.
• Incident notification (72 hours): an update of the early warning and an initial assessment, including severity and impact and, where available, indicators of compromise.
• Intermediate report: on request of the CSIRT or competent authority.
• Final report (one month after the notification): a detailed description, the type of threat or root cause, applied and ongoing mitigation measures and any cross-border impact. If the incident is still ongoing, a progress report is due at that point and the final report within one month of handling it.

An incident is "significant" under Article 23(3) if it has caused or can cause severe operational disruption or financial loss for the entity, or considerable material or non-material damage to others. Where an incident is likely to affect the services they provide, entities must also tell the recipients of those services without undue delay (Article 23(1)). Reports go to the national CSIRT or, where applicable, the competent authority. For the digital providers it covers, Implementing Regulation (EU) 2024/2690 adds numeric criteria, for example a direct financial loss above EUR 500,000 or 5% of annual turnover, whichever is lower.

Essential entities are supervised proactively; important entities mainly after the fact. The rules are in Articles 32 to 34:

"A maximum of at least" means member states may set higher ceilings; the national transposing law gives the actual figure.

ENISA's own NIS2 policy page lists several tasks the directive assigns to the agency: developing and maintaining a European vulnerability registry; acting as secretariat for the European Cyber Crises Liaison Organisation Network (CyCLONe); publishing an annual report on the state of cybersecurity in the EU; supporting peer reviews between member states; and maintaining a registry for certain cross-border service providers, including DNS providers, top-level domain registries, domain registration services, cloud computing and data centre services.

NIS2 and the Cyber Resilience Act are separate EU laws aimed at different things. NIS2 is an organisational law: it obliges essential and important entities in covered sectors to run a risk-management programme and report significant incidents. The Cyber Resilience Act is a product law: it sets cybersecurity requirements that hardware and software with digital elements must meet before being placed on the EU market, including its own 24-hour/72-hour reporting duty for actively exploited vulnerabilities and severe incidents in the product itself. The European Commission's NIS2 policy page describes the Cyber Resilience Act as complementing NIS2. A device maker can face both: CRA duties as a product manufacturer, and separately NIS2 duties if it also operates as an essential or important entity, for example by running its own cloud infrastructure or operating in a covered sector. See the Cyber Resilience Act guide and CRA 24h/72h vulnerability reporting for the product-level duty, which runs on a similar but legally distinct clock.

On 20 January 2026, as part of a cybersecurity package, the Commission proposed targeted amendments to NIS2 "to increase legal clarity", which it says will ease compliance for 28,700 companies, including 6,200 micro and small enterprises. As read on 10 November 2026, this is a Commission proposal: Directive (EU) 2022/2555 and the national transposing laws remain the rules that apply until an amendment is adopted and transposed.

• Assuming "product company" means out of scope. Annex II point 5 names the NACE divisions most hardware makers belong to.
• Counting only the local entity. Partner and linked enterprises count toward the size test.
• Mixing up the two 24-hour clocks. NIS2 runs from awareness of a significant incident in your services; the CRA from awareness of an actively exploited vulnerability or a severe incident affecting your product. Recipients and content differ.
• Treating Article 21 as an IT-only list. Build systems, signing keys and the update service are systems the business depends on.
• Ignoring customer-driven NIS2. In-scope customers will assess you as a supplier under Article 21(3), whatever your own status.
• Reading the Commission FAQ as the law. Supervisors enforce the national transposing law.

SoftWSP's passive OT and firmware vulnerability work feeds the asset and vulnerability data an incident-response and risk-management programme needs to meet NIS2 obligations; see OT Snapshot and device firmware security. For a manufacturer, the platform extracts a firmware SBOM as CycloneDX JSON, matches it against NVD, CISA KEV, FIRST EPSS and CISA CSAF ICS advisories, drafts a cited report for an engineer to review, and sends watchlist alerts on a CVE id or a vendor and product. It does not file NIS2 or CRA reports for you.

This guide is general information, not legal advice.