Fundamental concepts and principles of the NIS 2 Directive
This domain tests the legal architecture of Directive (EU) 2022/2555: why it exists, who is caught, how entities are tiered, and which EU and national bodies do what. Expect definitional precision rather than tool-level detail.
The instrument and its timeline
NIS2 is a directive, not a regulation: Member States had to transpose it into national law by 17 October 2024, and it applies from 18 October 2024. It repeals the 2016 NIS Directive but keeps a risk-based, all-hazards approach. It is minimum harmonisation, so national law can add stricter rules.
Scope and tiers
The scope is sector-led. Annex I covers high-criticality sectors such as energy, transport, health, drinking water, digital infrastructure, ICT service management and public administration. Annex II covers other critical sectors such as postal, waste, chemicals, food, manufacturing, digital providers and research. The main size gate is medium-sized or larger: broadly, 50 or more employees, or turnover above EUR 10 million. Certain categories are in scope regardless of size, including qualified trust service providers, top-level-domain registries and DNS providers. Essential entities include large Annex I entities and specified categories; important entities are in-scope entities that are not essential.
Worked example
A cloud computing provider with 60 staff and EUR 15 million turnover is in Annex I, digital infrastructure. It passes the medium-size gate but is not large, so it is an important entity, not essential. It must register, apply Article 21 measures and follow Article 23 reporting.
Traps
Do not equate Annex I with essential; size and category decide the tier. Do not say NIS2 replaces GDPR; it sits alongside it. Do not treat it as a directly applicable EU regulation. Do not forget public administration and the regardless-of-size categories.