NIS2 Important Entities: Obligations and Compliance

Important entities under NIS 2 are: 1. Medium-sized organizations in critical sectors from Annex II such as postal, waste management, food, chemicals, and digital providers, with at least

50 employees or at least EUR

10 million in annual turnover; 2. Medium-sized organizations from Annex I sectors with 50–249 employees or EUR 10–50 million in turnover that do not qualify as essential. Important entities face identical Article

21 requirements but only reactive supervision.

The key difference lies in supervision intensity and fines: Essential entities face active supervision meaning authorities can proactively audit them. Important entities face only reactive supervision triggered by specific incidents or complaints. Fines for essential entities: up to EUR

10 million or 2% of global annual turnover. Fines for important entities: up to EUR

7 million or 1.4% of annual turnover. The security requirements under Article

21 are identical for both categories, only enforcement differs.

Important entities must: 1. Register with the competent authority such as BSI in Germany, 2. Implement all ten security measures from Article

21 NIS 2 including risk analysis, incident handling, BCM, supply chain security, MFA, and cryptography, 3. Report significant cybersecurity incidents within 24h and 72h deadlines, 4. Conduct management cybersecurity training per Article 20, 5. Establish an NIS2-compliant governance structure. Unlike essential entities, they are not proactively audited.

You are an important entity if you operate in an NIS 2 sector and meet the size thresholds for important but not essential entities. Self-classification follows these steps: 1. Sector check against NIS 2 Annexes I and II, 2. Size check using the EU SME definition of employees and turnover or balance sheet, 3. Review of automatic classifications for critical infrastructure operators and trust service providers, 4. Registration with the competent authority. Errors in self-classification can lead to fines, so professional legal and technical guidance is recommended.

For important entities, competent authorities can impose fines of up to EUR

7 million or 1.4% of total global annual turnover, whichever is higher. Personal liability of management under Article

20 applies in principle to important entities as well, though national implementations vary. Reactive supervision does not mean violations go unpunished, reporting deadline violations or incidents can trigger enforcement proceedings and fines.

NIS 2 self-classification involves four steps: 1. Sector check against NIS 2 Annexes I and II to identify which annex applies, 2. Size check per EU SME definition covering employee count and annual turnover or balance sheet total, 3. Check for automatic classifications such as critical infrastructure operators and qualified trust service providers, 4. Registration with the competent national authority specifying entity category. Professional legal and technical support for self-classification is strongly recommended to avoid compliance gaps and potential enforcement action.