Annex I — Sectors of high criticality (11)
- Energy — electricity, district heating/cooling, oil, gas, hydrogen (DNSC §101)
- Transport — air, rail, water, road (DNSC §102)
- Banking — credit institutions (DNSC §103)
- Financial market infrastructure — trading venues, CCPs (DNSC §104)
- Health — providers, EU reference labs, medical R&D, pharma (DNSC §105)
- Drinking water — suppliers and distributors (DNSC §106)
- Waste water — collection, disposal, treatment (DNSC §107)
- Digital infrastructure — IXPs, DNS, TLDs, cloud, data centres, CDNs, trust services, public electronic communications (DNSC §108)
- B2B ICT service management — MSPs and MSSPs (DNSC §109)
- Public administration — central and (where designated) regional (DNSC §110)
- Space — ground-based infrastructure operators (DNSC §111)
Annex II — Other critical sectors (7)
- Postal & courier services (DNSC §201)
- Waste management (DNSC §202)
- Manufacture, production and distribution of chemicals (DNSC §203)
- Food — production, processing, distribution (DNSC §204)
- Manufacturing — medical devices, electronics, machinery, motor vehicles (DNSC §205)
- Digital providers — online marketplaces, search engines, social platforms (DNSC §206)
- Research (DNSC §207)
Annex I vs Annex II — at a glance
| Annex I | Annex II | |
|---|---|---|
| Criticality | High | Other critical |
| Default entity type | Essential | Important |
| DNSC registration deadline | 60 days | 150 days |
| Maximum fine | 10M EUR / 2% turnover | 7M EUR / 1.4% turnover |
| Supervision | Ex-ante & ex-post | Ex-post |
Not sure which sector applies?
Use the free NIS2 classification tool — enter your VAT ID, NACE code and headcount; you get sector, annex, DNSC code and essential/important/excluded status in seconds.