NIS2 for small and micro manufacturers

Last updated: October 20, 2026

NIS2's own scope article names entities that are medium-sized or larger; it does not name small or micro enterprises. A small or micro machinery manufacturer can still face indirect pressure from an in-scope customer who must assess the security practices of its own suppliers.

Who Article 2(1) names

“This Directive applies to public or private entities of a type referred to in Annex I or II which qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC, or exceed the ceilings for medium-sized enterprises provided for in paragraph 1 of that Article, and which provide their services or carry out their activities within the Union.”

Article 2(1) names entities that qualify as medium-sized, or exceed the ceilings for medium-sized, under Recommendation 2003/361/EC. It does not name small or micro enterprises. Source: Directive (EU) 2022/2555, Art. 2(1), checked 19 October 2026

Machinery manufacturing, by name

“Manufacture of machinery and equipment n.e.c. (undertakings carrying out any of the economic activities referred to in section C division 28 of NACE Rev. 2).”

Machinery and equipment manufacturing is named directly in NIS2's Annex II. Source: Directive (EU) 2022/2555, Annex II, point 5(d). Wording cross-checked against published copies, 19 October 2026.

“Important entity,” defined

“For the purposes of this Directive, entities of a type referred to in Annex I or II which do not qualify as essential entities pursuant to paragraph 1 of this Article shall be considered to be important entities.”

This is the definition Article 3(2) gives for “important entity,” the status Article 2(1) and Annex II combine to generally produce for a medium or large machinery manufacturer. Source: Directive (EU) 2022/2555, Art. 3(2), checked 19 October 2026

What this doesn't settle

These four quotes are what Article 2(1), Annex II point 5(d), and Article 3(2) actually say. They don't, by themselves, state every exception or every national implementing law's own detail, and this page doesn't add any beyond what's quoted above. NIS2 supply chain and remote access, explained covers the national transposition dates for the Netherlands, Belgium, and Luxembourg, each with its own citation.

Even outside this scope, a customer may still ask

“The measures referred to in paragraph 1 shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following: (a) policies on risk analysis and information system security; (b) incident handling; (c) business continuity, such as backup management and disaster recovery, and crisis management; (d) supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers.”

Point (d) is one of the measures an in-scope entity must take. If your customer is itself in scope, this is the provision behind why it might ask you, its supplier, about your own remote-access security, even though Article 2(1) may not name you directly. Source: Directive (EU) 2022/2555, Art. 21(2)(d), checked 19 October 2026

Related guides

NIS2 supply chain and remote access, explained and What “proportionate” means under NIS2.

This is a general guide based on published sources, not legal advice. Confirm your specific obligations with a qualified advisor.