NIS2 covers only part of manufacturing: makers of medical devices and in vitro diagnostic medical devices, and undertakings active in NACE Rev. 2 divisions 26 to 30 (electronics, electrical equipment, machinery, motor vehicles, other transport equipment). Those with 50 or more staff, or turnover and balance sheet both above EUR 10 million, are in scope, normally as important entities.
This guide covers the Annex II list, what the NACE divisions mean, the size test, automotive suppliers, car dealerships, essential or important status, what applies, what the law leaves open, and a checklist.
| Annex II point | Subsector, as worded | Who is covered |
|---|---|---|
| 5(a) | Manufacture of medical devices and in vitro diagnostic medical devices | MDR and IVDR manufacturers, except Annex I critical devices |
| 5(b) | Manufacture of computer, electronic and optical products | NACE Rev. 2, section C, division 26 |
| 5(c) | Manufacture of electrical equipment | Division 27 |
| 5(d) | Manufacture of machinery and equipment n.e.c. | Division 28 |
| 5(e) | Manufacture of motor vehicles, trailers and semi-trailers | Division 29 |
| 5(f) | Manufacture of other transport equipment | Division 30 |
Which manufacturers are in scope of NIS2?
Annex II, point 5 has six subsectors. Five use the same wording, changing only the division number:
“Undertakings carrying out any of the economic activities referred to in section C division 26 of NACE Rev. 2”
The sixth, point 5(a), is not defined by NACE at all:
“Entities manufacturing medical devices as defined in Article 2, point (1), of Regulation (EU) 2017/745 […], and entities manufacturing in vitro diagnostic medical devices as defined in Article 2, point (2), of Regulation (EU) 2017/746 […] with the exception of entities manufacturing medical devices referred to in Annex I, point 5, fifth indent, of this Directive”
The exception refers to Annex I, health: makers of medical devices considered critical during a public health emergency, on the list under Article 22 of Regulation (EU) 2022/123.
Note the words “any of the economic activities”. The waste management entry in the same annex excludes undertakings for whom waste management “is not their principal economic activity”. The manufacturing entries have no such limit, so a secondary activity can bring a company in. National laws can narrow this: Germany’s lets an entity disregard activities that are negligible within its business as a whole (§ 28(3) BSIG).
Which manufacturers are not listed?
Pharmaceuticals (division 21) are in Annex I, health. Chemicals and food are separate Annex II sectors, defined by REACH and EU food law. The rest of section C is outside the entry, for example plastic products (group 22.2), fabricated metal products (division 25) and repair and installation of machinery (division 33). Outside point 5 is not always outside NIS2: the chemicals entry, Annex II point 3, also covers undertakings producing articles, as defined in REACH, from substances or mixtures. Check how your national law and authority read it.
What does section C division 26 of NACE Rev. 2 mean?
NACE Rev. 2 is the EU’s statistical classification of economic activities. Section C is “Manufacturing”. Divisions have two digits, groups three (29.3) and classes four (29.31). “Section C division 26” means all of division 26, the manufacture of computer, electronic and optical products. “n.e.c.” means not elsewhere classified.
| Division | NACE Rev. 2 title | What it covers, by group |
|---|---|---|
| 26 | Manufacture of computer, electronic and optical products | Electronic components and boards (26.1); computers and peripherals (26.2); communication equipment (26.3); consumer electronics (26.4); measuring, testing and navigation instruments, watches and clocks (26.5); irradiation, electromedical and electrotherapeutic equipment (26.6); optical instruments and photographic equipment (26.7); magnetic and optical media (26.8) |
| 27 | Manufacture of electrical equipment | Electric motors, generators, transformers and electricity distribution and control apparatus (27.1); batteries and accumulators (27.2); wiring and wiring devices (27.3); electric lighting (27.4); domestic appliances (27.5); other electrical equipment (27.9) |
| 28 | Manufacture of machinery and equipment n.e.c. | General-purpose machinery (28.1); other general-purpose machinery, such as lifting and handling equipment (28.2); agricultural and forestry machinery (28.3); metal forming machinery and machine tools (28.4); other special-purpose machinery (28.9) |
| 29 | Manufacture of motor vehicles, trailers and semi-trailers | Motor vehicles (29.1); bodies (coachwork), trailers and semi-trailers (29.2); parts and accessories for motor vehicles (29.3) |
| 30 | Manufacture of other transport equipment | Ships and boats (30.1); railway locomotives and rolling stock (30.2); air and spacecraft (30.3); military fighting vehicles (30.4); transport equipment n.e.c., such as motorcycles and bicycles (30.9) |
NACE classifies activities, not companies, so start from what each site does, not from the code on your register entry. A medical device maker classified elsewhere, for instance in group 32.5 (medical and dental instruments and supplies), is still covered through point 5(a). A sensible approach is to record the decision per legal entity:
NIS2 MANUFACTURING ACTIVITY MAP
Legal entity: [name, registration number]
Registered code: [code, NACE Rev. 2 or Rev. 2.1]
Size category: [medium-sized / large, with group data]
Activity NACE Rev. 2 Annex point Staff Turnover
[ECU assembly] 29.31 II 5(e) [ ] [ ]
[Vehicle repair] 45.2 none [ ] [ ]
[Device under MDR] n/a II 5(a) [ ] [ ]
Negligible activity? [national rule, if any, and reasoning]
Result: [out of scope / important / essential if identified]
Reviewed by, date: [name, role], [date]NACE Rev. 2 or NACE Rev. 2.1?
The directive’s annexes refer to NACE Rev. 2. NACE Rev. 2.1, established by Commission Delegated Regulation (EU) 2023/137, is used for European statistics from 2025 onwards. In practice, if your register entry now shows a Rev. 2.1 code, use Eurostat’s correspondence tables to find the Rev. 2 class before you conclude.
Does the NIS2 size threshold apply to manufacturers?
Yes. Article 2(1) requires the entity to be medium-sized or larger under Recommendation 2003/361/EC: 50 or more staff, or turnover and balance sheet total both above EUR 10 million. Linked enterprises count in full and partner enterprises in proportion, so a 40-person subsidiary of a large group can be large. Recital 16 lets Member States weigh how independent its systems and services are.
Smaller manufacturers are out unless their Member State identifies them under Article 2(2) or as critical entities under the CER Directive (Article 2(3)). The NIS2 scope checker gives a first answer from sector, headcount and turnover.
Are automotive suppliers in scope?
Many are. Division 29 includes group 29.3, “Manufacture of parts and accessories for motor vehicles”, with two classes: electrical and electronic equipment for motor vehicles (29.31), and other parts and accessories (29.32). A medium-sized or larger supplier active there is in scope under point 5(e). Makers of electronic components (26.1) and batteries (27.2) are in scope through points 5(b) and 5(c). Tyres (22.11), plastic parts (22.2) and metal castings (24.5) are outside point 5, though the chemicals entry described above may still apply.
Out of scope is not unaffected. Your in-scope customers must take into account “the vulnerabilities specific to each direct supplier and service provider” and their cybersecurity practices (Article 21(3)). In practice that arrives as questionnaires, contract clauses and audit rights: see NIS2 supply chain security.
Are car dealerships in scope?
Not as dealers. The sale of motor vehicles is NACE group 45.1, in section G, “Wholesale and retail trade; repair of motor vehicles and motorcycles”, alongside maintenance and repair (45.2) and the sale of parts (45.3). Neither annex lists them.
Two caveats. A dealer group that also carries out a listed activity is assessed on it. Operating a recharging point that provides a recharging service to end users, for example, is an Annex I energy entity type. And in practice, in-scope manufacturers and importers may set security requirements for dealers connected to their ordering, warranty or diagnostic systems. That is a contract, not NIS2 applying to the dealer.
Are manufacturers essential or important entities?
Important, as a rule, whatever their size. The size rule for essential status, Article 3(1)(a), covers Annex I only; every in-scope entity not listed in Article 3(1) is important (Article 3(2)). An Annex II manufacturer is essential only if:
- its Member State identifies it as essential under Article 2(2), points (b) to (e), for example because a disruption could significantly affect public safety, public security or public health (Article 3(1)(e));
- it is a critical entity under the CER Directive, (EU) 2022/2557 (Article 3(1)(f));
- the Member State so provides for operators of essential services it identified before 16 January 2023 (Article 3(1)(g)).
Makers of devices on the critical devices list are Annex I entities, so a large one is essential.
Important entities are supervised after the fact, on evidence or indication of non-compliance (Article 33). Maximum fines must be at least EUR 7 million or 1.4% of worldwide annual turnover, whichever is higher (Article 34). See essential vs important entities.
What do NIS2 manufacturers have to do?
The duties are the same for essential and important entities and reach you through national law. Not every Member State met the 17 October 2024 transposition deadline: check yours.
- Management body (Article 20): approves the risk-management measures, oversees their implementation and can be held liable for infringements of Article 21. Its members must follow training. See NIS2 board accountability.
- Measures (Article 21): appropriate and proportionate measures for the network and information systems “which those entities use for their operations or for the provision of their services”, with at least the ten in Article 21(2). In practice, for a manufacturer, that includes production systems. See the 10 measures of Article 21.
- Incident reporting (Article 23): for a significant incident, an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report within one month of the notification. Significant means severe operational disruption or financial loss for the entity, actual or potential, or considerable damage to others. See the NIS2 incident reporting timeline.
- Registration (Article 3(4)): name, contact details including IP ranges, sector and subsector, Member States served; changes within two weeks.
NIS2 covers the security of your organisation, not of the products you sell. That is the Cyber Resilience Act, Regulation (EU) 2024/2847: its reporting obligations for manufacturers have applied since 11 September 2026, and its main obligations apply from 11 December 2027.
What NIS2 leaves open on the factory floor
Article 21 does not distinguish office IT from production technology. That leaves questions the ten headings do not answer:
- controllers that cannot be patched without the machine builder;
- integrators with standing remote-maintenance access;
- flat networks where an infected office laptop can reach the line;
- no inventory of what is connected in production.
What closing them looks like in practice: production assets in the same inventory as IT, measure (i). Segmentation between office and production, with documented exceptions. One controlled path for supplier remote access, with MFA, logging and time limits, measures (d) and (j). Compensating controls recorded for every system that cannot be patched. A tested restore of machine configurations, not only of servers, measure (c).
The harder part is showing it still holds six months later: MFA on every remote account, supplier access expired on time, the restore still working. On the CloudSoul platform, an automated platform with human-in-the-loop expertise, that evidence is collected from your systems and exceptions go to a person for review. The wider programme is on the NIS2 compliance page.
NIS2 manufacturing checklist
- Map each activity of each legal entity to a NACE Rev. 2 class, not only the registered code.
- If you make medical devices or IVDs, check point 5(a) and the critical devices list.
- Calculate size from the latest approved accounts, with linked and partner enterprise data.
- Record whether you are important or have been identified as essential.
- Register with your national authority and report changes within two weeks.
- Record management body approval of the Article 21 measures and its members’ training.
- Test the 24-hour early warning path, including for a production outage.
Sources
- Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 20, 21, 23, 33 and 34, recital 16, Annex I points 1 and 5, Annex II points 2, 3 and 5, EUR-Lex.
- Regulation (EC) No 1907/2006 (REACH), Article 3, EUR-Lex.
- Regulation (EU) 2017/745 on medical devices, Article 2(1), EUR-Lex.
- Regulation (EU) 2017/746 on in vitro diagnostic medical devices, Article 2(2), EUR-Lex.
- Regulation (EU) 2022/123, Article 22, EUR-Lex.
- Commission Recommendation 2003/361/EC (SME definition), EUR-Lex.
- Directive (EU) 2022/2557 (CER Directive), EUR-Lex.
- NACE Rev. 2, section C and section G, EU Publications Office.
- Eurostat, NACE and NACE Rev. 2.1; Commission Delegated Regulation (EU) 2023/137, EUR-Lex.
- BSI, general NIS-2 FAQ, on § 28(3) BSIG.
- European Commission, Cyber Resilience Act, Regulation (EU) 2024/2847.
Frequently asked questions
Does NIS2 apply to manufacturing companies?
Only to some. Annex II lists manufacturers of medical devices and in vitro diagnostic medical devices, and undertakings carrying out activities in NACE Rev. 2 divisions 26 to 30. They are in scope if they have 50 or more staff, or turnover and balance sheet total both above EUR 10 million.
What does section C division 26 of NACE Rev. 2 mean?
Section C of NACE Rev. 2, the EU classification of economic activities, is manufacturing. Division 26 is the manufacture of computer, electronic and optical products, from electronic components and boards to computers, communication equipment, measuring instruments and optical equipment.
Are automotive suppliers covered by NIS2?
Manufacturers of parts and accessories for motor vehicles fall under NACE group 29.3, part of division 29, which Annex II lists. Suppliers whose activity is classified elsewhere, such as tyres in class 22.11, are not covered by the manufacturing entry. The chemicals entry in Annex II, which also covers producing articles from substances or mixtures, may still apply.
Are car dealerships in scope of NIS2?
Not as dealers. The sale of motor vehicles is NACE group 45.1 in section G, which neither annex lists. Manufacturers and importers may still require security measures from dealers by contract, but that is not NIS2 applying to the dealer.
Are NIS2 manufacturers essential or important entities?
Important, as a rule, whatever their size. An Annex II manufacturer is essential only if its Member State identifies it under Article 2(2), points (b) to (e), if it is a critical entity under the CER Directive, or if national law keeps it as a former operator of essential services.
