EU cybersecurity regulation

Who Does NIS2 Apply To? A Practical Guide for Manufacturing Companies

Understand sectors, company size, exceptions and why supplier relationships need separate analysis.

NIS2 does not apply automatically to every factory

A common misunderstanding is that every manufacturer in the EU must comply with NIS2 because production is important. The directive has a more specific scope. Whether an organization falls under NIS2 depends on the activities it performs, its size or particular exceptions, and the national law implementing the directive. The correct unit of assessment is not simply the product name or the presence of an industrial network.

The NIS2 directive divides covered activities between sectors of high criticality in Annex I and other critical sectors in Annex II. The European Commission explains that, as a general rule, medium-sized and large entities in the listed sectors must implement appropriate cybersecurity measures and report significant incidents. Additional rules bring certain types of entities into scope regardless of their size, and national arrangements must be checked.

Which manufacturing activities are listed?

Manufacturing appears in Annex II in defined categories, including manufacture of medical devices and in vitro diagnostic medical devices, manufacture of computer, electronic and optical products, electrical equipment, machinery and equipment not elsewhere classified, motor vehicles, trailers and semi-trailers, and other transport equipment. These categories refer to specified classifications, not all manufacturing in general.

For example, an electronics producer or an automotive component manufacturer may belong to a category relevant to NIS2, subject to the actual activity classification, company size and national implementation. A food-processing site should not be assumed to be covered solely because it operates PLCs and automated packaging lines; food production, processing and distribution, and the manufacture of chemicals, have their own defined treatment within Annex II. The exact classification and activity matter.

Size matters, but simple headcount slogans are incomplete

NIS2 generally uses the EU definition of medium-sized and large enterprises (Commission Recommendation 2003/361/EC), with rules linked to employment and financial thresholds. Assessing eligibility may require examining turnover, balance-sheet figures and linked or partner enterprises, not simply looking at employees working at one plant. A multinational group’s organizational structure can therefore change the assessment.

Some listed entities can be covered regardless of size because of the type of service they provide or because they are specifically identified under relevant provisions. A small business cannot conclude that NIS2 never applies without examining these exceptions and the implementing national law.

Essential and important entities

NIS2 distinguishes essential entities from important entities. This classification influences supervisory arrangements and possible enforcement consequences; it is not a ranking of whether a company should care about cybersecurity. The legal basis for classification depends on sector, size and other directive provisions. An organization should document how it reached its conclusion rather than infer its category from marketing labels such as “critical manufacturer.”

What about manufacturers supplying a larger company?

Supply-chain security is an explicit concern under NIS2. A supplier that is not directly in scope may still receive stronger contractual security expectations from customers that are covered. A European automotive supplier might be asked about asset inventory, vulnerability handling, access controls, incident notification and continuity planning because its products or services affect a customer’s operations.

However, a customer contract cannot by itself change the statutory classification of the supplier into an essential or important NIS2 entity. Direct legal obligations and commercial security requirements must be assessed separately.

How an organization can check its status

Begin with the legal entity and countries where it operates. Identify the activities actually provided, compare them with Annex I and Annex II sector definitions, and verify the relevant classifications. Determine enterprise size using the applicable EU rules and consider the particular exceptions. Then review the implemented legislation and regulator guidance for the relevant Member State.

For Germany, BSI states that the national NIS2 Implementation Act came into force on 6 December 2025. BSI provides a portal for registration and reporting. Registration with BSI was originally due by 6 March 2026. Because many entities had not yet registered, BSI asked them to complete registration by 31 July 2026. That date has passed, so an organization that is in scope and not yet registered should register without further delay. German companies should consult current BSI guidance for classification and procedural obligations. Businesses with activities in more than one country should seek advice on the relevant jurisdictional rules.

A structured way to assess potential NIS2 applicability

Explanatory figure
  1. Identify the legal entityDetermine which company, establishment and Member State are being assessed.
  2. Check sector and activityCompare its activities with Annex I and Annex II definitions.
  3. Assess enterprise sizeApply the relevant staff and financial thresholds, including linked enterprises.
  4. Check exceptions and classificationReview size-independent cases and essential-versus-important provisions.
  5. Confirm national implementationUse competent authority and regulator guidance before concluding legal scope.
This sequence organizes a legal assessment; it is not a determination that any particular company is in scope.

If the company is in scope, what should it do next?

Identify the management body responsible for cybersecurity governance, define the services and systems that support covered activities, and evaluate relevant risks across IT, OT and supplier connections. Establish documented processes for vulnerability management, access control, incident response and business continuity, and understand significant-incident reporting requirements.

If the company is not directly within NIS2, many of these practices are still commercially and operationally valuable. In manufacturing, a cyber incident can disrupt production whether or not a particular legal threshold is met. The distinction is between legal applicability and sensible security practice, and it is important to be accurate about both.

Official sources and further reading

The resources below support the technical and regulatory information discussed. Review current vendor advisories and applicable national law before making operational or compliance decisions.

DTSecLabs / Industrial cybersecurity knowledge

Educational resource | Published Sep 15, 2026

Back to all blogs