NIS2 Essential Entity: The 7 Routes in Article 3(1) — Only One Requires Being Large

Article 3(1) of the NIS2 Directive does not define an essential entity by size. It lists seven separate routes to essential status, and only one of them — point (a) — turns on being large. The other six catch entities on what they do, who they answer to, or what a Member State has already decided about them, and four of those six apply regardless of size.

That matters because almost every scope guide published since 2024 compresses Article 3(1) into one sentence: large entity in an Annex I sector equals essential. The sentence is true, and it is about one seventh of the provision.

The Seven Routes to Essential Status

In plain terms: sector and size are the default path, not the only path. Five of the seven routes can make a small organisation essential, and one of them can only ever apply to an organisation that is not large. Here is Article 3(1) of Directive (EU) 2022/2555 in full [1].

Route	Art. 3(1)	Who it covers	Does size matter?
1	(a)	Entity types listed in Annex I that exceed the ceilings for medium-sized enterprises	Yes — must be above the ceilings
2	(b)	Qualified trust service providers, top-level domain name registries, DNS service providers	No — “regardless of their size”
3	(c)	Providers of public electronic communications networks or publicly available electronic communications services that qualify as medium-sized	Yes, but inverted — must be medium-sized
4	(d)	Public administration entities of central government (via Art. 2(2)(f)(i))	No
5	(e)	Any Annex I or Annex II entity a Member State identifies as essential under Art. 2(2)(b) to (e)	No — but needs a Member State decision
6	(f)	Entities identified as critical entities under the CER Directive (EU) 2022/2557	No
7	(g)	Entities a Member State identified before 16 January 2023 as operators of essential services under NIS1 — where that Member State so provides	No — Member State option

One structural consequence decides a large number of borderline cases: route (a) is restricted to Annex I, as are routes (b), (c) and (d). No amount of growth turns an Annex II organisation into an essential entity — a food manufacturer with 10,000 staff is an important entity. Only routes (e), (f) and (g) reach Annex II, and all three require a decision by a Member State or a designation under another law, never a headcount.

Route (a): The Size Test, and the Three Numbers Most Guides Get Wrong

Route (a) sends you to Article 2(1) of the Annex to Commission Recommendation 2003/361/EC for the ceilings [2]. That provision reads: SMEs are enterprises “which employ fewer than 250 persons and which have an annual turnover not exceeding EUR 50 million, and/or an annual balance sheet total not exceeding EUR 43 million.”

The punctuation carries the rule. You are an SME — and therefore not essential under route (a) — if you employ fewer than 250 persons and stay under either one of the two financial ceilings. To exceed the ceilings you need 250 or more staff, or turnover above EUR 50 million and a balance sheet total above EUR 43 million. Ireland’s National Cyber Security Centre states the same test in its NIS2 FAQ: large means “250+ employees OR EUR 50M+ turnover AND EUR 43M+ balance sheet” [3].

The EUR 43 million figure is not a third independent trigger, which is how it is usually written up. A company turning over EUR 60 million on a EUR 30 million balance sheet has not exceeded the ceilings: it is a medium-sized enterprise, and in an Annex I sector that makes it important, not essential. Eversheds Sutherland flags the same confusion, calling it “a common misconception that the criteria of headcount, annual turnover or annual balance sheet total are cumulative” [5].

Two further adjustments apply to public bodies and subsidiaries. NIS2 Article 2(1) contains a sentence almost nobody quotes: “Article 3(4) of the Annex to that Recommendation shall not apply for the purposes of this Directive” [1]. Article 3(4) is the rule that an enterprise cannot be an SME where 25% or more of its capital or voting rights are controlled by public bodies [2]. NIS2 switches it off, so a wholly municipally owned water utility is sized on its own headcount and accounts like any private company. The Recommendation’s linked and partner enterprise rules in Articles 3 and 6 do still apply, so a 90-person subsidiary of a 4,000-person group is sized on consolidated figures [2].

How “250 Employees” Is Actually Counted

The threshold is not 250 employees. Article 5 of the same Annex defines headcount as “the number of annual work units (AWU)”, and the difference is large enough to move organisations across the line [2].

• Part-time and seasonal staff count as fractions. Article 5 counts part-time work “regardless of duration” and seasonal work “as fractions of AWU”. A workforce of 300 heads averaging 0.7 FTE is 210 AWU — below the ceiling.
• Apprentices and vocational trainees do not count at all, where they hold an apprenticeship or vocational training contract.
• Owner-managers and working partners do count, alongside employees and persons deemed employees under national law.
• Maternity and parental leave is not counted toward the reference year.

There is also a built-in lag that reads as a grace period. Article 4(2) provides that exceeding or falling below a ceiling “will not result in the loss or acquisition of the status of medium-sized, small or microenterprise unless those ceilings are exceeded over two consecutive accounting periods” [2]. Crossing 250 AWU once does not make you an essential entity; crossing it at two consecutive year-ends does. Route (a) status is therefore visible roughly a year before it takes effect — enough time to build the Article 21 evidence rather than retrofit it. Our five-step NIS2 scope test walks the same figures through group aggregation and jurisdiction.

The Routes That Ignore Size Entirely

Four routes make an organisation essential with no reference to how large it is.

Route (b) — qualified trust service providers, TLD name registries and DNS service providers. A twelve-person DNS operator is an essential entity. Note the adjective: only qualified trust service providers are named. An unqualified one is in scope under Article 2(2)(a)(ii), but nothing in Article 3(1) reaches it, so Article 3(2) makes it important [1].

Route (c) — the inversion. This is the only route in the Directive where being smaller is what triggers essential status. Providers of public electronic communications networks or publicly available electronic communications services are essential if they “qualify as medium-sized enterprises”. Large ones are already caught by route (a), because Annex I’s digital infrastructure sector lists both provider types. Every telecoms provider from medium-sized upward is therefore essential, while other Annex I sectors only reach essential status at large. A small provider below the medium-sized floor stays in scope through Article 2(2)(a)(i) and lands as an important entity [1].

Route (d) — central government only. Article 3(1)(d) points at Article 2(2)(f)(i), which covers public administration entities “of central government as defined by a Member State in accordance with national law”. Regional-level bodies sit in the neighbouring point (f)(ii), which route (e) does not reach either — its range stops at point (e). Regional public administration is therefore in scope but defaults to important under Article 3(2) [1]. Article 5 sets NIS2 as a floor rather than a ceiling, so a Member State may go further; our public administration checklist covers the management-liability side.

Route (f) — designation under the CER Directive. Any entity identified as a critical entity under Directive (EU) 2022/2557 is an essential entity under NIS2, regardless of size and regardless of Annex [1][6]. It is the cleanest way a mid-sized chemicals or food business becomes essential, and the route that most often surprises Annex II organisations — see NIS2 and CER compared, and how the Article 3(1)(f) upgrade actually works for why it reaches entities that sit in no NIS2 Annex sector at all.

Route (g) — the NIS1 carry-over. Where a Member State so provides, organisations it had already identified as operators of essential services before 16 January 2023 remain essential. This one is optional and national, so the answer genuinely differs by country.

Sole Provider and Systemic Risk: In Scope Automatically, Essential Only by Designation

The most common overstatement in this area concerns Article 2(2)(b) to (e) — the sole provider in a Member State, the entity whose disruption could significantly affect public safety or health, the entity that could “induce a significant systemic risk”, and the entity critical for its “specific importance at national or regional level”. These are widely described as automatically essential. The text does not say that.

Article 2(2) does one thing automatically: it puts those entities in scope irrespective of size. Becoming essential is a separate step. Route (e) applies to entities “that are identified by a Member State as essential entities pursuant to Article 2(2), points (b) to (e)” [1] — identification by a Member State is the operative act. Until it happens, an in-scope sole provider that meets no other route is an important entity under Article 3(2).

The distinction is procedural rather than academic: the trigger you are watching for is an entry on the national list under Article 3(3), not an internal calculation, and the supervisory regime that comes with essential status can therefore arrive without any change in your own size or systems. Registration mechanics are covered in our NIS2 entity registration guide.

Twelve Worked Classifications

Each row applies the routes above to a concrete profile. Figures are illustrative; the reasoning is the point.

#	Organisation	Result	Why
1	Electricity distribution system operator, 800 staff, EUR 400M turnover	Essential	Annex I energy, exceeds the ceilings — route (a)
2	Drinking water utility, 180 staff, EUR 25M turnover, wholly council-owned	Important	Annex I but medium-sized; public ownership disregarded, since NIS2 disapplies Art. 3(4)
3	Regional ISP, 90 staff, EUR 14M turnover	Essential	Medium-sized provider of electronic communications services — route (c)
4	Rural broadband provider, 20 staff, EUR 3M turnover, EUR 2M balance sheet	Important	In scope via Art. 2(2)(a)(i), but too small for route (c)
5	DNS service provider, 12 staff	Essential	Named in route (b), regardless of size
6	Unqualified trust service provider, 30 staff	Important	In scope via Art. 2(2)(a)(ii), but route (b) names only qualified TSPs
7	Sole national manufacturer of a basic pharmaceutical product, 40 staff	Depends	Annex I health; in scope via Art. 2(2)(b), but essential only if the Member State identifies it under route (e)
8	Managed service provider, 70 staff, EUR 12M turnover, EUR 9M balance sheet	Important	Annex I ICT service management, but medium-sized — below route (a)
9	Central government tax administration	Essential	Central government — route (d), no size test
10	Regional environmental protection agency, 120 staff	Important	Regional bodies sit in Art. 2(2)(f)(ii), which route (d) does not reach
11	Frozen food manufacturer, 900 staff, EUR 300M turnover	Important	Annex II; route (a) is Annex I only, so size cannot upgrade it
12	Speciality chemicals plant, 140 staff, identified as a critical entity under CER	Essential	Route (f) — regardless of size and of Annex

Rows 2, 6, 10 and 11 are the four that guides built on the two-axis summary get wrong; rows 3 and 12 are the two they miss entirely.

What the Classification Changes — and Who Needs to Act

Both categories carry the same Article 21 risk-management measures and Article 23 reporting duties. What differs is supervision and penalty exposure — set out in our essential vs important entity comparison and quantified in the NIS2 penalties guide. The next step differs by role:

• Compliance officer / legal: record which route you relied on and the accounting periods used, then monitor the national Article 3(3) list — route (e) status arrives from outside.
• CISO / IT security: if route (a) is close, assume essential and build for proactive supervision now; the two-period rule gives roughly a year of visibility.
• SME owner: check routes (b), (c), (f) and (g) before concluding you are too small. Four of the seven have no size floor.
• Board: classification is self-assessed [3], and the duty to submit your registration details under Article 3(4) does not wait for an authority to contact you.

One caveat on all of this: NIS2 is a directive, so the binding text is your national transposition — and transposition is still incomplete. On 8 July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice for failing to notify transposing measures, asking the Court to impose “financial sanctions, consisting of a lump sum and daily penalties” [4]. Where national law is not yet in force, the routes above tell you what your transposition must at minimum deliver, not what is already enforceable against you.

Frequently Asked Questions

Is a company with EUR 60 million turnover automatically an essential entity? No. Exceeding the ceilings requires 250 or more annual work units, or turnover above EUR 50 million and a balance sheet total above EUR 43 million. Turnover alone does not do it [2][3].

Can an Annex II entity ever be an essential entity? Yes, but never because of size. Only routes (e), (f) and (g) reach Annex II — Member State identification, CER designation, or NIS1 carry-over [1].

Does state or municipal ownership make our utility essential? Not by itself. NIS2 Article 2(1) disapplies Article 3(4) of the SME Recommendation, the rule that would otherwise strip SME status from an entity 25% or more publicly controlled [1][2].

We crossed 250 staff last year — are we essential now? Generally not yet. Article 4(2) of the Recommendation requires the ceilings to be exceeded over two consecutive accounting periods before status changes [2].

Will an authority tell us which category we are in? Classification is self-assessed. Member States were required to establish lists of essential and important entities by 17 April 2025 and to review them at least every two years, but the duty to submit your own registration details sits with the entity [1][3].

Sources

1. Directive (EU) 2022/2555 (NIS2), Articles 2, 3 and 5 and Annexes I–II — EUR-Lex, Official Journal (linked above)
2. Commission Recommendation 2003/361/EC, Annex Articles 2, 3, 4, 5 and 6 — EUR-Lex
3. NIS2 FAQ — National Cyber Security Centre, Ireland (linked above)
4. “Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice for failing to transpose the rules on cybersecurity” — European Commission, 8 July 2026 (linked above)
5. “Determining the size of your organization under the NIS2 Directive and the SME Recommendation” — Eversheds Sutherland, 21 October 2024
6. Directive (EU) 2022/2557 on the resilience of critical entities (CER) — EUR-Lex

This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.