The essentials
The NIS2 dossier lists the eighteen sectors. For a manufacturer, the question is settled at a finer level: the exact nature of what it makes.
The industrial activities named in the annexes
| Activity | Annex | Criterion used by the directive |
|---|---|---|
| Computer, electronic and optical products | II | NACE Rev. 2, division 26 |
| Electrical equipment | II | NACE Rev. 2, division 27 |
| Machinery and equipment not elsewhere classified | II | NACE Rev. 2, division 28 |
| Motor vehicles, trailers and semi-trailers | II | NACE Rev. 2, division 29 |
| Other transport equipment | II | NACE Rev. 2, division 30 |
| Medical devices and in vitro diagnostic medical devices | II | Manufacturers within the meaning of Regulations (EU) 2017/745 and 2017/746 |
| Chemicals | II | Manufacture of substances, distribution of substances or mixtures, production of articles from substances or mixtures, within the meaning of the REACH Regulation |
| Food | II | Industrial production and processing, wholesale distribution |
| Basic pharmaceutical products and pharmaceutical preparations | I (health) | NACE Rev. 2, division 21 |
| Medical devices considered critical during a public health emergency | I (health) | List drawn up under Regulation (EU) 2022/123 |
The French NAF rév. 2 classification takes over the NACE divisions: the first two digits of a company’s APE code give the division.
Three points of reading
The activity carried out, not just the activity code
For divisions 26 to 30, the directive covers undertakings “carrying out any of the economic activities” of the division. It does not say this must be the principal activity, whereas it does so for waste management. The APE code, assigned according to the principal activity, therefore gives a first indication; a secondary manufacturing activity deserves to be examined.
The “chemicals” line is broader than its heading
It also covers the production of articles from substances or mixtures, within the meaning of REACH. A materials processor checks this point before concluding.
Metalworking is not on the list
Division 25, the manufacture of fabricated metal products, general mechanical engineering included, appears in neither annex. A machining workshop therefore has no direct obligation on that basis. The manufacture of parts and accessories for motor vehicles, by contrast, falls under division 29.
Essential or important: what changes for a manufacturer
Annex II activities fall into the category of important entities, including for a large enterprise. A machinery manufacturer with 2,000 employees is an important entity. A pharmaceutical company of the same size, covered by Annex I, is an essential entity. The State can also designate an entity whose interruption would have particular consequences.
Four manufacturers’ cases
| Situation | Reading |
|---|---|
| Packaging equipment manufacturer, 180 employees | Division 28 and medium size: important entity. |
| General engineering workshop, 70 employees, subcontractor to several manufacturers | Division 25, absent from the annexes: no direct obligation. Its customers in scope will send it their security requirements. |
| Food manufacturer, 300 employees | Industrial food processing, Annex II: important entity, including for a large enterprise. |
| Group of three companies: a holding company, an electric motor plant with 140 employees, a trading company with 30 employees | Qualification is done company by company. The plant falls under division 27: important entity. The trading company does not carry out a listed activity, even though the group’s headcount is added together to calculate its size. |
The size calculation within a group is detailed on the page NIS2 and SMEs.
Are production systems in scope?
Yes. Article 21 covers the network and information systems the entity uses “for their operations”. It does not separate business IT from industrial IT: controllers, supervision, shop-floor management and remote maintenance access are to be protected wherever production depends on them. The same article takes an “all-hazards approach”, which includes the physical environment of those systems.
The questions to ask on a production site
- Which lines stop if the ERP, the supervision system or the plant network goes down, and how long do they hold in degraded mode?
- Who accesses the machines remotely: manufacturers, integrators, maintenance providers? With which accounts and what trace?
- Do backups cover controller programs, recipes and machine parameters? Have they been restored?
- Which equipment no longer receives patches, and how is it isolated?
- Would an incident on a line reach management fast enough to meet the 24-hour early warning deadline?
IKNSA’s approach for industry starts from these dependencies between production, supply chain and site infrastructure.
Frequently asked questions
Our APE code starts with 28: are we in scope?
We make parts for a car manufacturer: are we in scope?
Does a group present in several countries answer to a single authority?
Does a maker of connected products fall under NIS2 or the Cyber Resilience Act?
Check your situation
The guided NIS2 assessment reviews the entity, the sector, the size, governance, suppliers and incidents. It takes about six minutes and returns a first reading of applicability. If you supply a manufacturer in scope, see NIS2 for suppliers and subcontractors.