NIS2 Compliance Automation: Your Entity Class, Derived

AnnexOps derives it from the profile you record: sector and entity type under Annex I or II, and size under Art 2(1). Art 2(2)(a) also brings some categories into scope regardless of size: providers of public electronic communications networks or services, trust service providers, TLD name registries and DNS service providers. Under Art 3(1), essential entities are Annex I entities above the medium-sized ceiling, and qualified trust service providers, TLD name registries and DNS service providers of any size. So are medium-sized providers of public electronic communications networks or services, central government public administration entities, and entities identified as critical under Directive (EU) 2022/2557. Member States can designate further essential entities under Art 2(2)(b) to (e) or Art 3(1)(g). Under Art 3(2), every other Annex I or II entity in scope is important. The result is indicative under the EU baseline. National transposition can extend scope or designate further entities, so you can record a Member State decision as an override with a rationale.

The 26 NIS2 requirements, the classification rules and the Art 21 control mappings are AnnexOps-authored, with specialist review in progress. The product labels them as such on screen; the free check is labelled an indicative self-assessment and not legal advice. Our mappings from automated checks to NIS2 requirements are likewise draft. EU AI Act and GDPR content on the platform has been reviewed by counsel. Nothing here is legal advice: the directive’s text in OJ L 333 and your Member State’s transposition remain the authority, and your counsel makes the call.

No. NIS2 itself creates no certificate or attestation report. Compliance is supervised by the competent authority of your Member State, in Germany the BSI. Essential entities sit under a comprehensive ex ante and ex post regime (Recital 122, Art 32), important entities ex post only (Art 33). In Germany the BSI-Gesetz of 2 December 2025 (in force 6 December 2025) uses its own categories, besonders wichtige and wichtige Einrichtungen (§28 BSIG). Incident reports there go to the joint BSI and BBK reporting point (§32 BSIG); record the German classification as an override. Some Member States recognise certification under their transposition. Belgium, for example, treats a CyberFundamentals or ISO/IEC 27001 certificate from an accredited conformity assessment body as a presumption of conformity. Art 24 also lets Member States require ICT products, services or processes that carry a certificate under EU cybersecurity certification schemes. Any such certificate is issued by an accredited certification body, never by AnnexOps. AnnexOps is not a regulator, certification body or filing service and does not guarantee compliance. It gives you workflow with owners, dates and clocks, tamper-evident evidence, assessed requirement coverage (indicative) and a read-only Audit Room.

Art 23(4) sets a staged cascade for significant incidents. An early warning is due within 24 hours of becoming aware. An incident notification follows within 72 hours of becoming aware (24 hours for trust service providers, for incidents affecting their trust services). An intermediate report is due on request, and the final report no later than one month after the incident notification. If the incident is still ongoing at that point, a progress report is due then, and a final report within one month of handling it. AnnexOps stages those steps as owned, dated records and keeps the audit trail. Filing stays with you: your team confirms each report and submits it to the CSIRT or, where applicable, the competent authority. In Germany that is the BSI, through the joint BSI and BBK reporting point.