NIS2 essential vs important entities: what is the difference?

An essential entity is, as a rule, a large enterprise in a sector of high criticality (NIS2 Annex I), or an entity designated as such. Every other in-scope organisation is an important entity. Security measures and incident reporting duties are identical. What differs is supervision, proactive or only after the fact, and the maximum fine.

To check first whether you are in scope at all, see Who does NIS2 apply to?.

How classification works

Article 3 of Directive (EU) 2022/2555 defines essential entities as:

• Annex I entities that exceed the medium-sized enterprise ceilings, in practice 250 or more employees, or more than €50 million turnover and more than €43 million balance sheet total;
• qualified trust service providers, top-level domain name registries and DNS service providers, regardless of size;
• medium-sized providers of public electronic communications networks or services;
• central government public administration entities;
• entities designated as essential by the Member State under the special cases of Article 2;
• critical entities identified under the CER Directive (2022/2557);
• where the Member State so provides, former operators of essential services designated under NIS1.

All other in-scope entities from Annexes I and II are important entities. For example:

• a medium-sized Annex I organisation, such as an MSP with 80 staff, would in principle fall among important entities under these criteria;
• a large Annex II organisation, such as a food manufacturer with 2,000 staff, would in principle also fall among important entities.

These examples illustrate how the Article 3 criteria read; they do not replace the analysis of a specific situation, which is a matter for the national authority and the entity’s legal adviser.

What stays the same

Obligation	Essential entity	Important entity
Cybersecurity risk-management measures (Article 21)	Yes	Yes
Management body accountability and training (Article 20)	Yes	Yes
Reporting significant incidents: early warning within 24 hours, notification within 72 hours, final report within one month (Article 23)	Yes	Yes
Providing your details to the authority (Article 3(4))	Yes	Yes

This is the most common misunderstanding: the directive does not provide lighter security measures for important entities.

What changes

Topic	Essential entity	Important entity
Supervision	Proactive and reactive: on-site inspections, regular and targeted audits, security scans (Article 32)	Reactive only, when there is evidence of non-compliance (Article 33)
Maximum fine	At least €10 million or 2% of worldwide annual turnover, whichever is higher (Article 34)	At least €7 million or 1.4% of worldwide annual turnover
Heaviest measures	Temporary suspension of a certification or authorisation, temporary ban on exercising management functions (Article 32(5))	Not provided for

These fine levels are minimum ceilings set by the directive: national laws may go further. Check the law of the country where you are established.

Why the distinction matters in practice

For an essential entity, the directive provides for supervision that can take place without any prior incident. Hence the value of being able to show at any time that measures are in place: policies, logs, evidence of incident detection and handling.

For an important entity, supervision usually follows an incident or a complaint. Being able to show how the incident was detected, contained and reported then becomes decisive.

Either way, a pragmatic approach is the same: document what is done, and aim to detect incidents early enough to be in a position to meet the 24-hour deadline set by the text.

Can you change category?

Yes. Classification depends on the entity’s size and activity, which change over time. Article 3(3) requires Member States to review their list of entities at least every two years. Growth, an acquisition or a new activity can move an entity from one category to the other. Thresholds are detailed in NIS2 size thresholds.

Talk to an expert

Whether you are essential or important, detecting an incident in time for the 24-hour early warning in practice relies on continuous monitoring. If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Frequently asked questions

Who decides my category?

In most cases the directive's criteria determine it, and the entity states it when registering with the authority. The state can also designate an entity as essential under the special cases of Article 2. National self-assessment tools, such as ANSSI's in France, give an indication of the likely category; for a specific case, your legal adviser remains the reference.

Can an important entity be inspected without an incident?

Supervision of an important entity is triggered by evidence or indications of non-compliance (Article 33). A complaint, a report or information from an incident at a third party can be enough.

Is management of an important entity accountable?

Article 20 of the directive covers both categories: it provides that management approves the measures, oversees their implementation and takes training. The temporary ban from management functions, provided for in Article 32, concerns essential entities only.

Does the category change reporting deadlines?

No. Article 23 sets the same deadlines for both categories: early warning within 24 hours, notification within 72 hours and a final report within one month.

Can I choose to be treated as essential?

Under the directive, category follows from the criteria or from designation by the state. Nothing stops an important entity, however, from adopting the same level of evidence and documentation as an essential one.