NIS2 essential and important entities explained

Two categories, one set of obligations

NIS2 sorts every organisation in its scope into two categories: essential entities and important entities. Many companies read the split as a measure of how much work they have to do. It is not. The category changes how a national authority supervises you and how high the fine ceiling sits. It does not change what you have to implement.

Both categories carry the same three core obligations. Article 20 makes the management body approve the cybersecurity risk management measures, oversee how they are implemented and follow cybersecurity training. Article 21 sets the measures themselves: risk analysis and information security policies, incident handling, business continuity and backups, supply chain security, security in acquisition and development, procedures to assess whether the measures work, basic cyber hygiene and training, cryptography, human resources security with access control and asset management, and multifactor authentication. Article 23 sets the reporting timeline for significant incidents: an early warning within 24 hours, an incident notification within 72 hours and a final report within a month of that notification.

So the useful question is not how much less an important entity has to do. It is how an authority will check what you do, and what evidence you need ready when it does. If you are still working out whether NIS2 applies to you at all, start with which Spanish companies are in scope of NIS2. This article assumes you are in scope and explains how each category is defined, then what changes in supervision, fines and registration.

How an entity becomes essential

Article 3(1) of Directive (EU) 2022/2555 lists the routes into the essential category. Most medium sized companies meet only the first one, but the others matter because they catch organisations that assume they are too small to qualify.

Large entities in Annex I sectors

Annex I covers the sectors of high criticality: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management between businesses, public administration and space. An entity of a type listed there becomes essential when it exceeds the ceilings for medium enterprises in Recommendation 2003/361/EC. In practice that means 250 or more staff, or annual turnover above €50 million together with a balance sheet total above €43 million.

Digital infrastructure and ICT service management are where technology companies often land without expecting it. Digital infrastructure includes cloud computing service providers, data centre service providers and content delivery networks. ICT service management covers managed service providers and managed security service providers working for other businesses. A large managed service provider is an essential entity even if it thinks of itself as a supplier rather than a regulated company.

Entities that are essential regardless of size

Article 3(1)(b) makes qualified trust service providers, top level domain name registries and DNS service providers essential whatever their size. Article 3(1)(c) makes providers of public electronic communications networks or services essential once they reach the medium enterprise threshold, one step lower than every other Annex I sector.

Two more routes have nothing to do with headcount. Article 3(1)(d) covers public administration entities of central government. Article 3(1)(f) covers entities identified as critical under the Critical Entities Resilience Directive (EU) 2022/2557, which are essential under NIS2 whatever their size because the two directives are designed to work together.

Designation by the member state

Article 2(2)(b) to (e) allows a member state to bring in entities of any size from Annex I or II in four cases:

• the entity is the sole national provider of a service essential for critical societal or economic activities;
• a disruption could significantly affect public safety, security or health;
• a disruption could create a significant systemic risk;
• the entity is critical at national or regional level.

Article 3(1)(e) lets the member state classify those entities as essential. Article 3(1)(g) also allows a member state to keep as essential the operators of essential services it identified under the previous NIS Directive.

For a company of 60 people, this is the route that matters. The size thresholds set a floor for automatic inclusion; they do not guarantee exclusion. If a hospital network, a regional utility or a public body depends on a service that only you provide, it is worth asking whether you could be designated.

How an entity becomes important

Article 3(2) works by subtraction. Any entity of a type listed in Annex I or II that is in scope and does not qualify as essential is important. That makes important the default category for most medium sized companies inside NIS2.

Medium entities in Annex I

A medium enterprise in an Annex I sector is important. Under the recommendation, that is an enterprise with 50 or more staff, or with annual turnover and balance sheet total both above €10 million, that stays below the large enterprise ceilings. A managed service provider with 120 employees or a private clinic group with 150 staff falls here. The exceptions are entities the member state designates as essential and telecoms providers, which are essential at this size.

Medium and large entities in Annex II

Annex II covers other critical sectors:

• postal and courier services;
• waste management;
• manufacture and distribution of chemicals;
• production and distribution of food;
• manufacturing of medical devices, electronics, electrical equipment, machinery and vehicles;
• digital providers such as online marketplaces, search engines and social networking platforms;
• research organisations.

Any entity in scope from Annex II is important, even if it is very large, unless the member state designates it as essential.

This produces results that surprise people. A food manufacturer with 3,000 employees is an important entity. A managed service provider with 260 employees is an essential one. The category reflects the criticality of the sector first and the size of the company second.

How size is calculated

The thresholds come from Recommendation 2003/361/EC. Staff is counted in annual work units, and the financial figures come from the last approved accounts. The recommendation's rules on partner and linked enterprises apply, so a subsidiary that is small on its own can cross the threshold once the figures of its group are added. Article 2(1) of NIS2 excludes only one provision of that recommendation: the rule in Article 3(4) of its annex on enterprises controlled by public bodies.

Two consequences follow. A company that belongs to a larger group should calculate on the group basis before assuming it is out of scope, or important rather than essential. And headcount alone does not decide: a company with 40 employees whose turnover and balance sheet total both exceed €10 million counts as a medium enterprise.

Supervision: proactive for essential entities, after the fact for important ones

This is the real difference between the two categories, and the one that should shape how you organise your evidence.

Article 32: essential entities are supervised before anything goes wrong

For essential entities, Article 32 gives authorities powers they can use at any time:

• inspections at the premises and remote supervision with random checks;
• regular and targeted security audits by an independent body or the authority itself;
• ad hoc audits after a significant incident or an infringement;
• security scans;
• requests for documented policies and evidence of implementation, such as the results of audits by a qualified auditor and the evidence underneath them.

The audited entity pays for a targeted audit carried out by an independent body unless the authority decides otherwise.

The enforcement powers go further. Authorities can issue binding instructions with deadlines, order the entity to implement the recommendations of a security audit, and designate a monitoring officer to oversee compliance with Articles 21 and 23 for a set period. If those measures fail, Article 32(5) allows the authority to suspend temporarily a certification or authorisation covering the entity's services. It can also request a temporary prohibition on the chief executive or legal representative exercising managerial functions.

Article 33: important entities are supervised when there is a reason

For important entities, Article 33 says authorities act after the fact, when they receive evidence, an indication or information that the entity may not comply, in particular with Articles 21 and 23. The toolkit looks similar, with inspections, targeted audits, security scans and requests for information. The difference is that a signal triggers it: an incident report, a complaint or a finding from another investigation.

Two powers are missing from the important entity list. There is no monitoring officer and no temporary suspension of certifications or managers. Article 33(5) does apply the personal liability rule of Article 32(6) to important entities, so the people who represent or control the entity can be held liable for breaching their duty to ensure compliance.

What this means for the evidence you keep

An essential entity must assume an inspection can come at any time, so its evidence has to be current every day:

• the risk analysis;
• the policies approved by management;
• the incident register;
• supplier assessments;
• training records;
• the results of tests on backups and controls.

An important entity is more likely to meet the authority after something has gone wrong, which is the worst possible moment to reconstruct proof.

The supervision model differs; the need for evidence that already exists does not. For both categories the most useful asset is the same: a record showing that the Article 21 measures run continuously, with owners, dates and results, rather than a folder assembled for an audit. The way a compliance platform collects and traces evidence is built for exactly that record.

Fines and management liability

Article 34 sets the fine ceilings for infringements of Articles 21 and 23. Essential entities face maximum fines of at least €10 million or 2% of the total worldwide annual turnover of the undertaking they belong to, whichever is higher. For important entities the figures are at least €7 million or 1.4%. The wording matters: these are minimum levels for the maximum, and national law can set higher ceilings.

Turnover is that of the undertaking the entity belongs to, so the group figure can drive the cap. Fines come on top of the other enforcement measures rather than replacing them. Authorities must weigh factors such as:

• the seriousness and duration of the infringement;
• previous infringements;
• the damage caused and the measures taken to limit it;
• the level of cooperation.

Management accountability is the same in both categories. Under Article 20 the management body approves the measures, oversees their implementation and must follow training, and Article 20(1) allows management to be held liable for infringements of Article 21. Together with the liability rules in Articles 32(6) and 33(5), this means a board cannot hand NIS2 to the IT team and treat it as someone else's problem.

Who decides your category, and the registration step

NIS2 does not leave classification entirely to the company. Article 3(3) required member states to establish a list of essential and important entities by 17 April 2025 and to review it at least every two years. To build that list, Article 3(4) requires entities to submit:

• their name, address and contact details, including IP ranges;
• their sector and subsector;
• the member states where they provide services.

Entities must report changes within two weeks. Member states may set up national mechanisms for entities to register themselves.

In practice you classify yourself first, using the annexes and the size rules, and the authority confirms or corrects that classification through its list and any designation. A company that registers under the wrong category, or does not register when a mechanism exists, starts its relationship with the regulator from a weak position.

Some digital providers have an extra step. Article 27 requires the following providers to submit details including their main establishment and IP ranges for a registry kept by ENISA:

• DNS service providers, TLD registries and domain registration services;
• cloud computing and data centre service providers;
• content delivery networks;
• managed service providers and managed security service providers;
• online marketplaces, search engines and social networking platforms.

Changes to that information must be notified within three months.

Where Spain stands

Spain has not yet transposed NIS2. The Council of Ministers approved the draft Ley de Coordinación y Gobernanza de la Ciberseguridad on 14 January 2025. The draft would transpose the directive and create a Centro Nacional de Ciberseguridad as the national authority, but no transposing law has been published in the BOE.

On 8 July 2026 the European Commission decided to refer Spain, together with Ireland, France and the Netherlands, to the Court of Justice of the EU for failing to notify full transposition. It asked the Court to impose a lump sum and daily penalties. The Cortes Generales were then dissolved by Real Decreto 806/2026, with general elections on 29 November 2026 and the new chambers due to meet on 23 December. Any Spanish transposing law now depends on the new parliament.

Until that law exists, several national details remain open:

• which authority supervises each sector;
• how registration works in practice;
• whether Spain sets fine ceilings above the minimums in the directive.

The classification logic in Articles 2 and 3 and the core obligations in Articles 20, 21 and 23 come from the directive itself. Supply chain security is one of the Article 21 measures, so companies that expect to be in scope have reason to ask their own suppliers about these measures now, through questionnaires and contract clauses, whatever the Spanish calendar. Our guide to third party risk under DORA and NIS2 covers what those requests usually contain, and the NIS2 topic page collects the rest of our coverage.

How to prepare when your category is still uncertain

Start by working out your likely category with the facts you already have:

• your sector against Annexes I and II;
• your staff and financial figures on a group basis;
• whether any of the routes that apply regardless of size could catch you.

Write the reasoning down. If the classification changes when the Spanish law arrives, you will know exactly which assumption moved.

Then build to the obligations that do not depend on the category. Articles 20, 21 and 23 apply to both. An entity that runs them properly is ready for proactive supervision if it turns out to be essential. If it is important, it already has the evidence on file when an authority asks after an incident. The reporting windows in Article 23 are the part most companies underestimate; our article on NIS2 and DORA incident reporting deadlines explains when the clock starts.

Reuse what you already have. A company certified to ISO 27001 or the ENS already runs most of the Article 21 measures: risk analysis, policies, incident management, continuity, supplier security, access control, cryptography and training. The gaps are usually three:

• the 24 hour early warning procedure;
• the management training requirement;
• supplier assessment at the depth NIS2 expects.

Running NIS2 as a separate project duplicates that work; mapping it onto the management system you already have does not, as we explain in running ISO 27001 and the ENS as one programme.

This is the approach Qalea takes. The Qalea platform reuses one set of controls and evidence across frameworks such as ISO 27001, the ENS and SOC 2, and maps the NIS2 measures onto those same controls, so a measure implemented once counts for every framework that requires it. Qalea's team guides the work of closing the gaps. Continuous monitoring through EDR, a SIEM and a SOC produces the operating evidence that an Article 32 inspection or an Article 33 information request will ask to see.