NIS2 covers food businesses engaged in wholesale distribution and industrial production and processing, if they are medium-sized or larger. That means 50 or more staff, or turnover and balance sheet total both above €10 million. Food wholesalers, processors, dairies and drinks makers of that size are normally important entities. Retail, restaurants and farms are not named.
This guide covers the scope text, the size rule, edge cases by business type, essential or important, what applies, systems at stake and a checklist.
| Food business | In scope of NIS2? | Why |
|---|---|---|
| Food wholesaler or distributor | Yes, if medium-sized or larger | ”Wholesale distribution” is named |
| Food manufacturer or processor | Yes, if medium-sized or larger | ”Industrial production and processing” is named |
| Dairy processor | Yes, if medium-sized or larger | Turning milk into dairy products is processing |
| Drinks maker | Yes, if medium-sized or larger | In EU food law, “food” includes drink |
| Food supplements, nutritional products | Same test as other food | Food, unless a medicinal product |
| Supermarkets and shops | Not for retail | Retail is not named; distribution centres are a grey zone |
| Restaurants, restaurant groups, catering | Not for food service | Food law classes them as retail |
| Farms, including dairy farms | Not named | ”Industrial” is not defined |
| Food logistics, cold stores | Not named | Unlike the CER Directive, NIS2 omits logistics |
| Animal feed producers | Not as food | Feed is excluded from “food” |
Which food businesses does NIS2 cover?
Annex II of NIS2 lists “other critical sectors”. Point 4, “Production, processing and distribution of food”, has one type of entity:
“Food businesses as defined in Article 3, point (2), of Regulation (EC) No 178/2002 of the European Parliament and of the Council which are engaged in wholesale distribution and industrial production and processing”
Regulation (EC) No 178/2002, the General Food Law, defines a food business as “any undertaking, whether for profit or not and whether public or private, carrying out any of the activities related to any stage of production, processing and distribution of food”. That is the whole chain. NIS2 narrows it to two activities: wholesale distribution, and industrial production and processing.
What the directive does not define
NIS2 does not define “wholesale distribution” or “industrial”, and unlike most manufacturing entries, the food entry cites no NACE codes. The only numeric filter is the size rule. Near the line, national law and the national competent authority decide. Article 5 also lets Member States adopt provisions “ensuring a higher level of cybersecurity”, so national law can go further.
Does NIS2 apply to small food companies?
Normally not. Article 2(1) covers Annex I and II entities that qualify as medium-sized enterprises under Commission Recommendation 2003/361/EC, or exceed those ceilings. A small enterprise has fewer than 50 staff and a turnover and/or balance sheet total of at most €10 million.
Three details decide most food cases:
- Both financial figures matter. With fewer than 50 staff, a company stays small if either figure is €10 million or less. A 30-person wholesaler with €40 million turnover and an €8 million balance sheet is small. Food wholesale often combines high turnover with a small headcount, so check both.
- Group data counts. Figures of linked enterprises are added in full, those of partner enterprises in proportion to the stake. A subsidiary controlled by a larger group is measured with the group.
- Seasonal staff count. Staff means annual work units, with part-time and seasonal workers counted as fractions. A change of category needs the ceilings crossed in two consecutive accounting periods.
Size can also be overridden. Article 2(2), points (b) to (e), can bring in a smaller entity, for example the sole provider of an essential service in a Member State. The NIS2 scope and applicability guide covers these cases, and the NIS2 scope checker runs the test.
What about retailers, restaurants and catering?
Retail is not named in Annex II. The General Food Law’s definition of “retail” expressly includes “catering operations, factory canteens, institutional catering, restaurants and other similar food service operations, shops, supermarket distribution centres and wholesale outlets”.
- Restaurants, restaurant groups and caterers are food businesses, but NIS2 does not name food service, whatever the group’s size. A central kitchen supplying many sites raises the question of industrial production, which is for national authorities.
- Supermarket chains are not in scope for their shops. Their distribution centres are the grey zone: food law files them under retail, while in ordinary language they do wholesale distribution. The directive does not settle it.
- Mixed groups. A retail or restaurant group that also runs a wholesale business or a processing plant can be in scope through that activity.
What about farms, agriculture and dairies?
Farms are food businesses. The General Food Law’s chain starts “from and including the primary production of a food”. Primary production includes “harvesting, milking and farmed animal production prior to slaughter”.
NIS2 does not name primary production, and it does not say whether a large arable or livestock operation is “engaged in industrial production”. National law and the authority decide. Do not assume either way.
- Dairies. A medium-sized or larger dairy processor is a typical in-scope entity. A dairy farm is primary production, with the open question above. A small artisanal cheese maker is out because of its size; a large dairy plant is in because of its activity and size.
- Agricultural trade. Bulk trade in harvested crops for human consumption is, in the ordinary sense, food wholesale. Feed trade is not: the General Food Law excludes feed from “food”.
What about drinks, nutritional products and food logistics?
- Drinks. The General Food Law states that “‘Food’ includes drink”. Breweries, distilleries and soft drink makers face the same test as food processors.
- Food supplements and nutritional products are food, unless they are medicinal products, which the General Food Law excludes. Pharmaceutical manufacturers sit in the Annex I health sector instead.
- Food logistics. Storage and transport are stages of food distribution, so a cold store or food haulier is a food business. The NIS2 food entry does not mention logistics, while the CER Directive’s food entry names “logistics and wholesale distribution”. How your authority reads the NIS2 wording is a national question. Either way, in-scope customers will pass their Article 21(2)(d) supply chain requirements on to you.
Is a food business essential or important?
Important, in almost every case. Article 3(2) makes every Annex II entity important unless Article 3(1) makes it essential. For a food business, that happens mainly in two ways:
- The Member State identifies it as essential under Article 2(2), points (b) to (e).
- It is identified as a critical entity under the CER Directive, (EU) 2022/2557, which also covers food. Member States had to identify critical entities by 17 July 2026. A critical entity is essential under NIS2 regardless of size.
A Member State may also treat as essential an entity it identified as an operator of essential services before 16 January 2023 under NIS1 or national law (Article 3(1)(g)). Food was not a sector under NIS1, so this matters only where national law went further. The class changes supervision and fines, not the measures:
| Important (default for food) | Essential | |
|---|---|---|
| Supervision | Ex post, on evidence or indication of non-compliance (Art. 33) | Includes regular and targeted security audits (Art. 32) |
| Maximum fine, at least | €7 million or 1.4% of worldwide turnover, whichever is higher | €10 million or 2%, whichever is higher |
| Measures and reporting | Articles 20, 21 and 23 | The same |
The full comparison is in NIS2 essential vs important entities.
What does NIS2 require from a food business?
The same as from any entity in scope, through your national law:
- Governance, Article 20. The management body approves the risk-management measures, oversees their implementation and can be held liable for infringements. Its members must follow training. See NIS2 board accountability.
- Measures, Article 21. Appropriate and proportionate measures on an all-hazards approach. At least ten are listed, from risk analysis and incident handling to supply chain security and MFA where appropriate. See the 10 measures of Article 21.
- Reporting, Article 23. Significant incidents go to the CSIRT or competent authority. Early warning within 24 hours, notification within 72 hours, final report within one month of the notification. See the NIS2 incident reporting timeline.
- Registration, Article 3(4). Your details, including sector and IP ranges, go to the authority under a national procedure.
An incident is significant if it caused or could cause severe operational disruption or financial loss, or considerable damage to others. There is no food-specific EU implementing act: Implementing Regulation (EU) 2024/2690 covers only a list of digital service types, such as DNS, cloud and managed service providers.
Which systems are at stake in a food business?
This is practice, not law. In a food company, Article 21 usually lands on four groups of systems:
- Production lines and OT. PLCs, SCADA and recipe management on filling, cooking, pasteurising and packing lines. Often old, often maintained by the equipment supplier over remote access.
- Cold chain monitoring. Sensors and alarms in cold stores, trucks and chillers. If they go dark, you lose proof that food stayed at safe temperatures, and stock may be destroyed.
- ERP, ordering and warehouse systems. Order intake, EDI and pick lists. Fresh stock does not wait for a restore.
- Traceability records. Article 18 of the General Food Law requires food businesses to be able to identify who supplied them and which businesses they supplied, and to give that to the authorities on demand. If ransomware encrypts those records, a recall becomes guesswork.
One incident can trigger two regimes. If food you supplied may be injurious to health, Article 19 of the General Food Law requires you to inform the food authorities immediately. Write one incident procedure for both, and put food safety and IT in the same risk analysis.
What NIS2 leaves open for food businesses
Article 21 is written in outcomes and does not mention OT, production lines or temperature logging. Its all-hazards approach covers “the physical environment” of your systems too, so a power cut in a cold store counts, not only an attacker.
It leaves open how you secure a line run by ten-year-old controllers. In practice, legacy equipment you cannot patch is contained, not replaced. Segment it, control and log supplier remote access, keep offline copies of PLC programs and recipes, and test a controller rebuild.
The evidence then has to exist when the authority asks: MFA on every supplier remote account, segmentation as built, the last restore test. Gathered by hand once a year, it is out of date on arrival. Collected continuously from the systems, with a person reviewing the exceptions, it stays audit-ready. That is how the CloudSoul platform works, as an automated platform with human-in-the-loop expertise. The wider programme is on the NIS2 compliance page.
NIS2 food sector checklist
- Test your activity against Annex II, point 4: wholesale distribution, or industrial production and processing.
- Calculate size with group data: staff in annual work units, turnover and balance sheet.
- Check national law for grey zones: distribution centres, central kitchens, farms and logistics.
- Register with the competent authority as your national law requires.
- Have the management body approve the Article 21 measures and complete its training.
- Map production OT, cold chain monitoring, ERP and traceability systems, each with an owner.
- Write one incident procedure covering NIS2 deadlines and food safety notification.
- Control and log supplier remote access to production lines.
Sources
- Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 5, 20, 21, 23, 32, 33 and 34 and Annex II, point 4, EUR-Lex.
- Regulation (EC) No 178/2002 (General Food Law), Articles 2, 3, 18 and 19, EUR-Lex.
- Commission Recommendation 2003/361/EC on the definition of micro, small and medium-sized enterprises, Annex, Articles 2 to 6, EUR-Lex.
- Directive (EU) 2022/2557 (CER Directive), Article 6 and Annex, point 11, EUR-Lex.
- Directive (EU) 2016/1148 (NIS1), Annex II, legislation.gov.uk.
- Commission Implementing Regulation (EU) 2024/2690, EUR-Lex.
Frequently asked questions
Does NIS2 apply to the food sector?
Yes. Annex II, point 4 covers food businesses as defined in Regulation (EC) No 178/2002 that are engaged in wholesale distribution and industrial production and processing. They must also be medium-sized or larger, unless a Member State brings them in regardless of size.
Are restaurants and supermarkets covered by NIS2?
Not for their shops or food service. Retail and food service are not named in Annex II, and EU food law classes restaurants and catering as retail. A group that also runs wholesale distribution or industrial production can be in scope through that activity.
Are farms covered by NIS2?
Farms are food businesses under EU food law, but NIS2 does not name primary production and does not define "industrial". Whether a large farming operation counts as industrial production is for national law and the national authority to decide.
Is a food company an essential or important entity under NIS2?
Important, by default. Food is an Annex II sector, so a food business in scope is important unless its Member State identifies it as essential under Article 2(2), it is identified as a critical entity under the CER Directive, or national law keeps it as a former operator of essential services.
Does NIS2 apply to small food businesses?
Normally not. NIS2 applies to medium-sized enterprises and larger: 50 or more staff, or annual turnover and balance sheet total both above €10 million. Linked and partner enterprises count, and a Member State can bring in a smaller entity in the cases listed in Article 2(2) or by identifying it as a critical entity under the CER Directive.
