What is the difference between essential and important entities under NIS2?

Mainly how they are supervised and the maximum fines, not the duties themselves. Both must meet the risk-management measures of Article 21 and report significant incidents under Article 23. Under Article 3, essential entities are, broadly, large companies in the Annex I sectors, plus some entities regardless of size, such as qualified trust service providers, top-level domain registries and DNS service providers, and those a Member State designates; important entities are the other entities in scope from Annexes I and II. Essential entities face proactive supervision, with inspections and audits possible at any time (Article 32), while important entities are supervised after the fact, when there are signs of non-compliance (Article 33). Maximum fines differ under Article 34. National laws use their own names, for example particularly important and important entities in Germany.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

Read next

← All 40 questions on NIS2 scope and dutiesAll topics