Essential entity explained

What is an essential entity?

Essential entities are organisations from particularly critical sectors such as energy, health, drinking water, banking, financial market infrastructure, transport or digital infrastructure. They count as the backbone of supply: if a cyberattack knocks out an entity of this kind, whole supply chains or essential public services can be hit. That is precisely why NIS2 places the strictest requirements on essential entities and assigns them to the highest tier of supervision and sanctions.

How you are classified

Classification depends on the sector – Annex I to the directive lists the “sectors of high criticality” – and on the size of the organisation. As a rule, large enterprises with 250 or more employees or more than EUR 50 million in turnover count as essential entities in those highly critical sectors. On top of that come special cases such as qualified trust service providers or TLD registries, which count as essential regardless of size.

How this differs from an important entity

The dividing line is sharp. Where an important entity is checked reactively, an essential entity is supervised proactively – that is, even without a particular trigger, for example through on-site inspections or security audits. The level of fines is higher too: Article 34 sets a minimum ceiling of EUR 10 million or 2 % of total worldwide annual turnover instead of EUR 7 million or 1.4 % for important entities, and Member States may go higher. The Management body carries responsibility for the risk measures and can be held personally liable.

Essential vs important, side by side

Note: the substantive security duties themselves – risk management, reporting channels, minimum technical measures – are almost identical for both categories. What differs is above all how hard and how early the authorities look.

Duties in practice

The substantive duties – Risk management, reporting obligations along the 24h/72h/one-month chain and Governance – resemble those of important entities, but are supervised more strictly. Picture a regional energy supplier with 400 staff that has to act after a ransomware incident: it has registered with the authority designated in its own Member State and named a contact point, reports the significant incident within 24 hours as an early warning, adds its assessment of the incident together with a first root-cause analysis after 72 hours, and files the final report within one month at the latest. Because it counts as an essential entity, it also has to reckon with unannounced evidence checks at any time.

What you actually have to do

Are you an essential entity? Then these are the steps that count:

• Document your self-classification: check your sector (Annex I) and your size class and record the result in writing – responsibility for the classification rests with you, not with the authority.
• Register with your national authority: which body you sign up with, in what form and by when is set by your Member State; where that date has already passed, the duty does not lapse and you should catch up without delay.
• Set up the reporting chain: define processes for the 24-hour early warning, the 72-hour assessment and the one-month final report, and rehearse them with your team.
• Involve the management body: senior management takes training, approves the risk measures and oversees their implementation – otherwise it is personally liable.
• Prepare for proactive audits: collect evidence without gaps, so that an unannounced inspection does not come up empty.

Further reading: European Commission – NIS2 Directive