Manufacturing is covered by NIS2, but only for specific subsectors and only as an Important Entity. Here is the test.
Manufacturing is an Annex II sector
The NIS2 Directive (Directive (EU) 2022/2555) places manufacturing in Annex II (other critical sectors). Annex II entities can only be Important Entities, never Essential, which means reactive supervision and a lower fine cap (up to EUR 7M or 1.4% of global turnover).
Which manufacturing subsectors are listed
NIS2 names these manufacturing activities:
- Medical devices and in-vitro diagnostic medical devices
- Computers, electronic and optical products
- Electrical equipment
- Machinery and equipment not elsewhere classified
- Motor vehicles, trailers and semi-trailers
- Other transport equipment
Food production, chemicals and waste management are also Annex II, listed separately.
The size threshold
You are in scope from the medium enterprise level: 50+ employees, or EUR 10M+ annual turnover or balance sheet. A small workshop below that is normally out of scope.
So: are you in?
If you manufacture one of the listed product types and are medium-sized or larger, the answer is yes, as an Important Entity. You must implement the Art. 21 cybersecurity measures, meet incident-reporting deadlines, and register with your national authority.
Confirm your status
-> Run the NIS2 Applicability Checker - select your manufacturing subsector and size.
-> Read the full NIS2 scope guide.
Source
Directive (EU) 2022/2555 (NIS2), Annex II
Last verified: 21 June 2026.